Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
85s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
13/11/2023, 11:42
Static task
static1
Behavioral task
behavioral1
Sample
89e8997a-d12f-45b2-c4f3-08dbe1425971/806b4744-3a94-8651-7451-6026a58222a2.eml
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
89e8997a-d12f-45b2-c4f3-08dbe1425971/806b4744-3a94-8651-7451-6026a58222a2.eml
Resource
win10v2004-20231020-en
General
-
Target
89e8997a-d12f-45b2-c4f3-08dbe1425971/806b4744-3a94-8651-7451-6026a58222a2.eml
-
Size
17KB
-
MD5
2005014db2312c60338d019d1c4710b8
-
SHA1
7f04161f6181e61ac48534b299daddc7e3ed2229
-
SHA256
f6b457425a2272fd77e9e755e0a6453b0450ca147933b150072f2d54cd3b2083
-
SHA512
100c16a3326922c19d4c83a85bfa3351bbb53e63110701f899fe6a2386d3adcb08888e3da8fd8d0f87d77553e4f354c190d2ed4df90309790778cb790fa0b4e5
-
SSDEEP
192:bCwg4fHhoYVgGCzzvzy6MXuOC2JsrB4Ugv1J6NzcL5/1xY:bCwg2htmGC3vzDAtC4srB4UgdJ6db
Malware Config
Signatures
-
Drops file in System32 directory 14 IoCs
description ioc Process File created C:\Windows\system32\perfc009.dat OUTLOOK.EXE File created C:\Windows\system32\perfc00A.dat OUTLOOK.EXE File created C:\Windows\system32\perfh00A.dat OUTLOOK.EXE File created C:\Windows\system32\perfc011.dat OUTLOOK.EXE File created C:\Windows\system32\perfh007.dat OUTLOOK.EXE File created C:\Windows\system32\perfh009.dat OUTLOOK.EXE File created C:\Windows\system32\perfc00C.dat OUTLOOK.EXE File created C:\Windows\system32\perfc010.dat OUTLOOK.EXE File created C:\Windows\system32\perfc007.dat OUTLOOK.EXE File created C:\Windows\system32\perfh011.dat OUTLOOK.EXE File created C:\Windows\SysWOW64\PerfStringBackup.TMP OUTLOOK.EXE File created C:\Windows\system32\perfh00C.dat OUTLOOK.EXE File created C:\Windows\system32\perfh010.dat OUTLOOK.EXE File opened for modification C:\Windows\SysWOW64\PerfStringBackup.INI OUTLOOK.EXE -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\inf\Outlook\outlperf.h OUTLOOK.EXE File opened for modification C:\Windows\inf\Outlook\outlperf.h OUTLOOK.EXE File created C:\Windows\inf\Outlook\0009\outlperf.ini OUTLOOK.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" OUTLOOK.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit OUTLOOK.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit OUTLOOK.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND OUTLOOK.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor OUTLOOK.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor OUTLOOK.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 OUTLOOK.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" OUTLOOK.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" OUTLOOK.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch OUTLOOK.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor OUTLOOK.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command OUTLOOK.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit OUTLOOK.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\MenuExt OUTLOOK.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command OUTLOOK.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" OUTLOOK.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" OUTLOOK.EXE -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303F-0000-0000-C000-000000000046} OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063104-0000-0000-C000-000000000046} OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D3-0000-0000-C000-000000000046} OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063096-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630A7-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630F3-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063099-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063026-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672ED-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D2-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006308A-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E5-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CB-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630F8-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672EF-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063048-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063086-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006F026-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630DF-0000-0000-C000-000000000046} OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630EE-0000-0000-C000-000000000046} OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303D-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006305C-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006307B-0000-0000-C000-000000000046}\ = "OutlookBarGroupsEvents" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D6-0000-0000-C000-000000000046} OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063026-0000-0000-C000-000000000046} OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672EE-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E5-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C5-0000-0000-C000-000000000046}\ = "_Account" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006302F-0000-0000-C000-000000000046}\ = "_SharingItem" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630DB-0000-0000-C000-000000000046} OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E4-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063074-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063021-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063079-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063077-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672EC-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063043-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C9-0000-0000-C000-000000000046}\ = "_ExchangeUser" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630DE-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063047-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630EC-0000-0000-C000-000000000046} OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{50BB9B50-811D-11CE-B565-00AA00608FAA}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672F5-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630FD-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D6-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630DC-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C6-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063104-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063045-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063042-0000-0000-C000-000000000046}\ = "UserProperty" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E7-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E1-0000-0000-C000-000000000046}\ = "OlkOptionButtonEvents" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630FA-0000-0000-C000-000000000046} OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063079-0000-0000-C000-000000000046} OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063020-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{50BB9B50-811D-11CE-B565-00AA00608FAA}\ = "_DDocSiteControlEvents" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672ED-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063033-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063080-0000-0000-C000-000000000046} OUTLOOK.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1856 OUTLOOK.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1644 chrome.exe 1644 chrome.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe Token: SeShutdownPrivilege 1644 chrome.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 1856 OUTLOOK.EXE 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe 1644 chrome.exe -
Suspicious use of SetWindowsHookEx 23 IoCs
pid Process 1856 OUTLOOK.EXE 1856 OUTLOOK.EXE 1856 OUTLOOK.EXE 1856 OUTLOOK.EXE 1856 OUTLOOK.EXE 1856 OUTLOOK.EXE 1856 OUTLOOK.EXE 1856 OUTLOOK.EXE 1856 OUTLOOK.EXE 1856 OUTLOOK.EXE 1856 OUTLOOK.EXE 1856 OUTLOOK.EXE 1856 OUTLOOK.EXE 1856 OUTLOOK.EXE 1856 OUTLOOK.EXE 1856 OUTLOOK.EXE 1856 OUTLOOK.EXE 1856 OUTLOOK.EXE 1856 OUTLOOK.EXE 1856 OUTLOOK.EXE 1856 OUTLOOK.EXE 1856 OUTLOOK.EXE 1856 OUTLOOK.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1644 wrote to memory of 2404 1644 chrome.exe 34 PID 1644 wrote to memory of 2404 1644 chrome.exe 34 PID 1644 wrote to memory of 2404 1644 chrome.exe 34 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1440 1644 chrome.exe 36 PID 1644 wrote to memory of 1704 1644 chrome.exe 38 PID 1644 wrote to memory of 1704 1644 chrome.exe 38 PID 1644 wrote to memory of 1704 1644 chrome.exe 38 PID 1644 wrote to memory of 632 1644 chrome.exe 37 PID 1644 wrote to memory of 632 1644 chrome.exe 37 PID 1644 wrote to memory of 632 1644 chrome.exe 37 PID 1644 wrote to memory of 632 1644 chrome.exe 37 PID 1644 wrote to memory of 632 1644 chrome.exe 37 PID 1644 wrote to memory of 632 1644 chrome.exe 37 PID 1644 wrote to memory of 632 1644 chrome.exe 37 PID 1644 wrote to memory of 632 1644 chrome.exe 37 PID 1644 wrote to memory of 632 1644 chrome.exe 37 PID 1644 wrote to memory of 632 1644 chrome.exe 37 PID 1644 wrote to memory of 632 1644 chrome.exe 37 PID 1644 wrote to memory of 632 1644 chrome.exe 37 PID 1644 wrote to memory of 632 1644 chrome.exe 37 PID 1644 wrote to memory of 632 1644 chrome.exe 37 PID 1644 wrote to memory of 632 1644 chrome.exe 37 PID 1644 wrote to memory of 632 1644 chrome.exe 37 PID 1644 wrote to memory of 632 1644 chrome.exe 37 PID 1644 wrote to memory of 632 1644 chrome.exe 37 PID 1644 wrote to memory of 632 1644 chrome.exe 37
Processes
-
C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXEC:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE /eml "C:\Users\Admin\AppData\Local\Temp\89e8997a-d12f-45b2-c4f3-08dbe1425971\806b4744-3a94-8651-7451-6026a58222a2.eml"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1856
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6ba9758,0x7fef6ba9768,0x7fef6ba97782⤵PID:2404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1156 --field-trial-handle=1196,i,7449899119810183549,1367573327611087964,131072 /prefetch:22⤵PID:1440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1584 --field-trial-handle=1196,i,7449899119810183549,1367573327611087964,131072 /prefetch:82⤵PID:632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1500 --field-trial-handle=1196,i,7449899119810183549,1367573327611087964,131072 /prefetch:82⤵PID:1704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2148 --field-trial-handle=1196,i,7449899119810183549,1367573327611087964,131072 /prefetch:12⤵PID:2652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2160 --field-trial-handle=1196,i,7449899119810183549,1367573327611087964,131072 /prefetch:12⤵PID:2656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3244 --field-trial-handle=1196,i,7449899119810183549,1367573327611087964,131072 /prefetch:22⤵PID:2848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1152 --field-trial-handle=1196,i,7449899119810183549,1367573327611087964,131072 /prefetch:12⤵PID:2016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1436 --field-trial-handle=1196,i,7449899119810183549,1367573327611087964,131072 /prefetch:82⤵PID:1860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3580 --field-trial-handle=1196,i,7449899119810183549,1367573327611087964,131072 /prefetch:82⤵PID:2184
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level2⤵PID:2568
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f9a7688,0x13f9a7698,0x13f9a76a83⤵PID:332
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3872 --field-trial-handle=1196,i,7449899119810183549,1367573327611087964,131072 /prefetch:82⤵PID:1288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2752 --field-trial-handle=1196,i,7449899119810183549,1367573327611087964,131072 /prefetch:12⤵PID:2944
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2792
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
363B
MD58c55c2d76c7e9c60e4452d48baebf922
SHA1d1ec2b7355396232ed958bd93cb1d2dea29974d5
SHA25616d4d9aadc23fcc02200f5410d7b161fc54aede07d26ac0b3526139abc915cf7
SHA512ed1b12d352bf1e7e273b13008a5f99ca99c5d58ac887498610c281188ade735e9d3b4ef07807ee1e7f9627aa70ebf06e505c2599070d5b8afe5c3db4ab14e284
-
Filesize
4KB
MD57ad5ba59fe891f004bace8f6f51a2c06
SHA102c234657f32d0729f7e5f474e7441352000a505
SHA2568fd3022ae2a3dcde0d4f3c01db05392d5215f8c90fecf34343baedf4f3100c79
SHA51234736da4f21be7fa2f60fdf601d2551e8c954db0836225060bf8508ca47d345bdebce39b38c8d419123b355a34ca8c41bb632e85aee62bc0bf073ad6e66e358c
-
Filesize
4KB
MD5a8d47ab39083659670e75f83982cdbdc
SHA1169d67f87d7a5a0b07097179d5c65d3813dedb15
SHA2563b5cb2bc4208f172f1646a3bdabb75e77c1db231f74226aeb0da13f5b4e95808
SHA51200a157fd8df05c25aa04384f32ab497d69b13efb531970cfaa7d48b3f3164c27589c3e84c3cd7f750cbd5e9183aa3b23fcccd517a3dd4a6c744b371f4feb07fc
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
240KB
MD5808c7d3efb06e702ec4941eedba3d6e9
SHA1e9cdf3b4c16acb254e7e475573d3829dc44a09b0
SHA2560d20ea1c40e8c9e3aba03e1008844351e8addab0d3d469374c9dc531f4fbe769
SHA512454eaf9e45b39a56df915091b069e59178db74e4d208e1396cd43db7a5498071c7e8ad5c152cfa750bd5ac41449d53cfb974f5bdb868ac8bc5f2185ad94dc194
-
Filesize
710B
MD593dc1e7e8e4dc4762538a84b135b355d
SHA1bb5653cf46ca6b9dcf6925ed5bd9b7f75dc997b6
SHA256fbaf3df6ac17055ec9d5da6aadd6377d3f1651157107aeb86f5a9d51419b673c
SHA5124516d55e32320c75e448724430afc4d723a5db0edd5279acd013195c59f993f9f0c0306099295bd3f8173d63822aad1de4d89a589e086234e8217ba439c70b5e
-
Filesize
1KB
MD548dd6cae43ce26b992c35799fcd76898
SHA18e600544df0250da7d634599ce6ee50da11c0355
SHA2567bfe1f3691e2b4fb4d61fbf5e9f7782fbe49da1342dbd32201c2cc8e540dbd1a
SHA512c1b9322c900f5be0ad166ddcfec9146918fb2589a17607d61490fd816602123f3af310a3e6d98a37d16000d4acbbcd599236f03c3c7f9376aeba7a489b329f31
-
Filesize
6KB
MD5adf3db405fe75820ba7ddc92dc3c54fb
SHA1af664360e136fd5af829fd7f297eb493a2928d60
SHA2564c73525d8b563d65a16dee49c4fd6af4a52852d3e8f579c0fb2f9bb1da83e476
SHA51269de07622b0422d86f7960579b15b3f2e4d4b4e92c6e5fcc7e7e0b8c64075c3609aa6e5152beec13f9950ed68330939f6827df26525fc6520628226f598b7a72
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84