Analysis
-
max time kernel
98s -
max time network
67s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
31-10-2023 16:23
Behavioral task
behavioral1
Sample
old_unpacked_qbot.dll
Resource
win7-20231020-en
windows7-x64
15 signatures
150 seconds
General
-
Target
old_unpacked_qbot.dll
-
Size
120KB
-
MD5
35927b301d9cd6c33a927b97dccf6266
-
SHA1
1ccb9ec68f0fd685a58b1b6d2e78ba3b878783da
-
SHA256
18df034ee69d675ce1b04b95569154f0e3fe41c8bd6a00e59e8dae24b41ed7f7
-
SHA512
0cbbe3dbc6fea05760801bb812a8eac2b981f55a45aa994112e822e9f8f6741ae5052bab25dd1ab29d65e4b05fe353a0c796b9f8c0ddc4d89a03c13da69e081b
-
SSDEEP
1536:DCEh82pWrjickOZol59ZJkCZuH6cYTUk8JrNZmwmIOvnToIfwsbuYkR:WH5r+ckl57J4HpYTaJBZfE/TBfwkuYk
Malware Config
Extracted
Family
qakbot
Version
403.2
Botnet
obama125
Campaign
1636625439
C2
117.198.155.237:443
190.73.3.148:2222
63.143.92.99:995
216.238.71.31:443
216.238.72.121:995
216.238.71.31:995
216.238.72.121:443
105.198.236.99:995
136.232.34.70:443
41.37.243.129:443
140.82.49.12:443
71.13.93.154:2222
96.246.158.154:995
102.65.38.57:443
71.13.93.154:6881
123.252.190.14:443
45.9.20.200:2211
136.143.11.232:443
103.143.8.71:995
103.142.10.177:443
109.177.77.68:995
117.248.109.38:21
120.150.218.241:995
86.98.1.197:443
89.101.97.139:443
94.200.181.154:443
71.13.93.154:2083
93.48.80.198:995
96.21.251.127:2222
86.97.8.204:443
27.223.92.142:995
88.234.20.155:995
115.96.64.9:995
207.246.112.221:443
207.246.112.221:995
129.208.156.253:995
177.172.5.228:995
173.21.10.71:2222
89.137.52.44:443
83.223.164.163:443
76.25.142.196:443
73.151.236.31:443
189.135.98.193:443
71.74.12.34:443
50.194.160.233:443
187.192.70.196:80
189.223.33.109:443
93.147.212.206:443
86.8.177.143:443
50.194.160.233:32100
68.204.7.158:443
45.46.53.140:2222
65.100.174.110:8443
100.1.119.41:443
181.118.183.27:443
189.147.225.12:443
72.252.147.208:995
181.4.49.208:465
24.229.150.54:995
24.55.112.61:443
72.252.147.208:465
24.139.72.117:443
81.250.153.227:2222
78.153.126.175:443
109.12.111.14:443
197.87.182.15:443
91.178.126.51:995
108.4.67.252:443
39.49.72.230:995
146.66.139.84:443
103.116.178.85:993
182.176.180.73:443
67.165.206.193:993
75.66.88.33:443
94.110.12.148:995
79.160.207.214:443
111.250.56.31:443
189.146.127.83:443
2.222.167.138:443
94.60.254.81:443
77.57.204.78:443
75.188.35.168:443
93.48.58.123:2222
41.228.22.180:443
96.37.113.36:993
68.186.192.69:443
92.59.35.196:2222
115.186.190.72:995
86.173.96.126:443
109.133.93.127:995
80.6.192.58:443
109.228.255.59:443
176.35.109.202:2222
72.27.126.188:995
103.150.40.76:995
103.143.8.71:443
185.53.147.51:443
75.169.58.229:32100
162.244.227.34:443
216.201.162.158:443
39.52.224.170:995
188.27.119.243:443
50.194.160.233:465
73.25.109.183:2222
47.72.219.120:995
196.207.140.40:995
115.96.188.188:995
70.93.80.154:443
88.253.105.24:443
27.5.5.31:2222
212.216.213.88:443
Attributes
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\taskschd.msc mmc.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2332 schtasks.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main helppane.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 2164 regsvr32.exe 1392 chrome.exe 1392 chrome.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2692 taskmgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2164 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 2580 mmc.exe Token: SeIncBasePriorityPrivilege 2580 mmc.exe Token: 33 2580 mmc.exe Token: SeIncBasePriorityPrivilege 2580 mmc.exe Token: 33 2580 mmc.exe Token: SeIncBasePriorityPrivilege 2580 mmc.exe Token: 33 2580 mmc.exe Token: SeIncBasePriorityPrivilege 2580 mmc.exe Token: 33 2580 mmc.exe Token: SeIncBasePriorityPrivilege 2580 mmc.exe Token: 33 2580 mmc.exe Token: SeIncBasePriorityPrivilege 2580 mmc.exe Token: 33 2580 mmc.exe Token: SeIncBasePriorityPrivilege 2580 mmc.exe Token: 33 2580 mmc.exe Token: SeIncBasePriorityPrivilege 2580 mmc.exe Token: 33 2580 mmc.exe Token: SeIncBasePriorityPrivilege 2580 mmc.exe Token: 33 2580 mmc.exe Token: SeIncBasePriorityPrivilege 2580 mmc.exe Token: 33 2580 mmc.exe Token: SeIncBasePriorityPrivilege 2580 mmc.exe Token: 33 2580 mmc.exe Token: SeIncBasePriorityPrivilege 2580 mmc.exe Token: 33 2580 mmc.exe Token: SeIncBasePriorityPrivilege 2580 mmc.exe Token: 33 2580 mmc.exe Token: SeIncBasePriorityPrivilege 2580 mmc.exe Token: 33 2580 mmc.exe Token: SeIncBasePriorityPrivilege 2580 mmc.exe Token: 33 2580 mmc.exe Token: SeIncBasePriorityPrivilege 2580 mmc.exe Token: 33 2580 mmc.exe Token: SeIncBasePriorityPrivilege 2580 mmc.exe Token: 33 2580 mmc.exe Token: SeIncBasePriorityPrivilege 2580 mmc.exe Token: 33 2580 mmc.exe Token: SeIncBasePriorityPrivilege 2580 mmc.exe Token: 33 2580 mmc.exe Token: SeIncBasePriorityPrivilege 2580 mmc.exe Token: 33 2580 mmc.exe Token: SeIncBasePriorityPrivilege 2580 mmc.exe Token: 33 2580 mmc.exe Token: SeIncBasePriorityPrivilege 2580 mmc.exe Token: 33 2580 mmc.exe Token: SeIncBasePriorityPrivilege 2580 mmc.exe Token: 33 2580 mmc.exe Token: SeIncBasePriorityPrivilege 2580 mmc.exe Token: 33 2580 mmc.exe Token: SeIncBasePriorityPrivilege 2580 mmc.exe Token: 33 2580 mmc.exe Token: SeIncBasePriorityPrivilege 2580 mmc.exe Token: 33 2580 mmc.exe Token: SeIncBasePriorityPrivilege 2580 mmc.exe Token: 33 2580 mmc.exe Token: SeIncBasePriorityPrivilege 2580 mmc.exe Token: 33 2580 mmc.exe Token: SeIncBasePriorityPrivilege 2580 mmc.exe Token: SeTakeOwnershipPrivilege 1628 helppane.exe Token: SeTakeOwnershipPrivilege 1628 helppane.exe Token: SeTakeOwnershipPrivilege 1628 helppane.exe Token: SeTakeOwnershipPrivilege 1628 helppane.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1628 helppane.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe -
Suspicious use of SendNotifyMessage 62 IoCs
pid Process 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2808 mspaint.exe 2808 mspaint.exe 2808 mspaint.exe 2808 mspaint.exe 2580 mmc.exe 2580 mmc.exe 1628 helppane.exe 1628 helppane.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1164 wrote to memory of 2164 1164 regsvr32.exe 28 PID 1164 wrote to memory of 2164 1164 regsvr32.exe 28 PID 1164 wrote to memory of 2164 1164 regsvr32.exe 28 PID 1164 wrote to memory of 2164 1164 regsvr32.exe 28 PID 1164 wrote to memory of 2164 1164 regsvr32.exe 28 PID 1164 wrote to memory of 2164 1164 regsvr32.exe 28 PID 1164 wrote to memory of 2164 1164 regsvr32.exe 28 PID 2164 wrote to memory of 2408 2164 regsvr32.exe 29 PID 2164 wrote to memory of 2408 2164 regsvr32.exe 29 PID 2164 wrote to memory of 2408 2164 regsvr32.exe 29 PID 2164 wrote to memory of 2408 2164 regsvr32.exe 29 PID 2164 wrote to memory of 2408 2164 regsvr32.exe 29 PID 2164 wrote to memory of 2408 2164 regsvr32.exe 29 PID 2408 wrote to memory of 2332 2408 explorer.exe 30 PID 2408 wrote to memory of 2332 2408 explorer.exe 30 PID 2408 wrote to memory of 2332 2408 explorer.exe 30 PID 2408 wrote to memory of 2332 2408 explorer.exe 30 PID 2580 wrote to memory of 1968 2580 mmc.exe 36 PID 2580 wrote to memory of 1968 2580 mmc.exe 36 PID 2580 wrote to memory of 1968 2580 mmc.exe 36 PID 1392 wrote to memory of 1352 1392 chrome.exe 41 PID 1392 wrote to memory of 1352 1392 chrome.exe 41 PID 1392 wrote to memory of 1352 1392 chrome.exe 41 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 572 1392 chrome.exe 43 PID 1392 wrote to memory of 2132 1392 chrome.exe 44 PID 1392 wrote to memory of 2132 1392 chrome.exe 44 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\old_unpacked_qbot.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\old_unpacked_qbot.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn gmkmvxx /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\old_unpacked_qbot.dll\"" /SC ONCE /Z /ST 16:25 /ET 16:374⤵
- Creates scheduled task(s)
PID:2332
-
-
-
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\SubmitRead.wmf"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2808
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 10442⤵PID:1968
-
-
C:\Windows\helppane.exeC:\Windows\helppane.exe -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1628
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5069758,0x7fef5069768,0x7fef50697782⤵PID:1352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1084 --field-trial-handle=1292,i,16373388356283233861,48925657451472970,131072 /prefetch:22⤵PID:572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 --field-trial-handle=1292,i,16373388356283233861,48925657451472970,131072 /prefetch:82⤵PID:2132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1292,i,16373388356283233861,48925657451472970,131072 /prefetch:82⤵PID:1988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2284 --field-trial-handle=1292,i,16373388356283233861,48925657451472970,131072 /prefetch:12⤵PID:1496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2288 --field-trial-handle=1292,i,16373388356283233861,48925657451472970,131072 /prefetch:12⤵PID:1876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1324 --field-trial-handle=1292,i,16373388356283233861,48925657451472970,131072 /prefetch:22⤵PID:2164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1348 --field-trial-handle=1292,i,16373388356283233861,48925657451472970,131072 /prefetch:12⤵PID:1124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3416 --field-trial-handle=1292,i,16373388356283233861,48925657451472970,131072 /prefetch:82⤵PID:2628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3436 --field-trial-handle=1292,i,16373388356283233861,48925657451472970,131072 /prefetch:82⤵PID:2144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3420 --field-trial-handle=1292,i,16373388356283233861,48925657451472970,131072 /prefetch:82⤵PID:2608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3764 --field-trial-handle=1292,i,16373388356283233861,48925657451472970,131072 /prefetch:82⤵PID:2168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3844 --field-trial-handle=1292,i,16373388356283233861,48925657451472970,131072 /prefetch:82⤵PID:1820
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1404
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
217KB
MD5c9bb5ee2d96e1912f6d717cae04ae921
SHA17fc4fc2beb502946e8c92b67e6a44c2eea343d50
SHA256ae8055219fd1098846f2bec98b6feb90cf8f41bc9190ba7cfed42b27cb1249d6
SHA512aee99e2861b45746f84cb325edf184261a5cea6645ffd85ef410f68ded55b9948f45b4516eb2ab765dfa056ce429a41ee7e09e4bdf6f643edb6bc70e8a9ed7f5
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Filesize16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2