hxxps://cdn[.]discordapp[.]com/attachments/843623892512931864/1191999377565290516/MindFire[.]exe?ex=65a77aed&is=659505ed&hm=f42bdbca4ae1c0aa2bf9c4549b6557f58e92f8dad0755bc1d7825c6f07a4d929&

Analysis

max time kernel
81s
max time network
143s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 00:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/843623892512931864/1191999377565290516/MindFire.exe?ex=65a77aed&is=659505ed&hm=f42bdbca4ae1c0aa2bf9c4549b6557f58e92f8dad0755bc1d7825c6f07a4d929&

Score

8^/10

upx

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1460	MindFire.exe

Loads dropped DLL 1 IoCs

pid	Process
2216	iexplore.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000018ed8-67.dat	upx
behavioral1/files/0x0007000000018fbf-70.dat	upx
behavioral1/files/0x0007000000018fbf-72.dat	upx
behavioral1/files/0x0007000000018fbf-71.dat	upx
behavioral1/memory/1460-73-0x0000000140000000-0x0000000141914000-memory.dmp	upx
behavioral1/memory/1460-76-0x0000000140000000-0x0000000141914000-memory.dmp	upx
behavioral1/memory/1460-86-0x0000000140000000-0x0000000141914000-memory.dmp	upx
behavioral1/memory/1460-87-0x0000000140000000-0x0000000141914000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1460	MindFire.exe
1460	MindFire.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = d008c1ce6c3fda01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{09BB9311-AB60-11EE-87B3-6E1D43634CD3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410575824"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1460	MindFire.exe
1460	MindFire.exe
1460	MindFire.exe
1580	chrome.exe
1580	chrome.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	1460	MindFire.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
2216	iexplore.exe
2216	iexplore.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2216	iexplore.exe
2216	iexplore.exe
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 3008	2216	iexplore.exe	28
PID 2216 wrote to memory of 3008	2216	iexplore.exe	28
PID 2216 wrote to memory of 3008	2216	iexplore.exe	28
PID 2216 wrote to memory of 3008	2216	iexplore.exe	28
PID 2216 wrote to memory of 1460	2216	iexplore.exe	31
PID 2216 wrote to memory of 1460	2216	iexplore.exe	31
PID 2216 wrote to memory of 1460	2216	iexplore.exe	31
PID 1580 wrote to memory of 1912	1580	chrome.exe	34
PID 1580 wrote to memory of 1912	1580	chrome.exe	34
PID 1580 wrote to memory of 1912	1580	chrome.exe	34
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2444	1580	chrome.exe	39
PID 1580 wrote to memory of 2464	1580	chrome.exe	37
PID 1580 wrote to memory of 2464	1580	chrome.exe	37
PID 1580 wrote to memory of 2464	1580	chrome.exe	37
PID 1580 wrote to memory of 1908	1580	chrome.exe	38
PID 1580 wrote to memory of 1908	1580	chrome.exe	38
PID 1580 wrote to memory of 1908	1580	chrome.exe	38
PID 1580 wrote to memory of 1908	1580	chrome.exe	38
PID 1580 wrote to memory of 1908	1580	chrome.exe	38
PID 1580 wrote to memory of 1908	1580	chrome.exe	38
PID 1580 wrote to memory of 1908	1580	chrome.exe	38
PID 1580 wrote to memory of 1908	1580	chrome.exe	38
PID 1580 wrote to memory of 1908	1580	chrome.exe	38
PID 1580 wrote to memory of 1908	1580	chrome.exe	38
PID 1580 wrote to memory of 1908	1580	chrome.exe	38
PID 1580 wrote to memory of 1908	1580	chrome.exe	38

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://cdn.discordapp.com/attachments/843623892512931864/1191999377565290516/MindFire.exe?ex=65a77aed&is=659505ed&hm=f42bdbca4ae1c0aa2bf9c4549b6557f58e92f8dad0755bc1d7825c6f07a4d929&
1⤵
- Loads dropped DLL
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2216 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3008
- C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OQSRAP3S\MindFire.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OQSRAP3S\MindFire.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6039758,0x7fef6039768,0x7fef6039778
1⤵
PID:1912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1536 --field-trial-handle=1272,i,9647866363348990019,157614519653351342,131072 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 --field-trial-handle=1272,i,9647866363348990019,157614519653351342,131072 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1144 --field-trial-handle=1272,i,9647866363348990019,157614519653351342,131072 /prefetch:2
  2⤵
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2340 --field-trial-handle=1272,i,9647866363348990019,157614519653351342,131072 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1604 --field-trial-handle=1272,i,9647866363348990019,157614519653351342,131072 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1144 --field-trial-handle=1272,i,9647866363348990019,157614519653351342,131072 /prefetch:2
  2⤵
  PID:1968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3372 --field-trial-handle=1272,i,9647866363348990019,157614519653351342,131072 /prefetch:1
  2⤵
  PID:584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3512 --field-trial-handle=1272,i,9647866363348990019,157614519653351342,131072 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3196 --field-trial-handle=1272,i,9647866363348990019,157614519653351342,131072 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3720 --field-trial-handle=1272,i,9647866363348990019,157614519653351342,131072 /prefetch:8
  2⤵
  PID:1260

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
bf73bec657b4310ad8738e0ff6c04098

SHA1
e34d07aaf68b31be8a918f477da11b30c849a5dd

SHA256
f96a60b506ab6433ab6d4dd07c7f30da7d4faba7d6810b9df632491b0e3556b1

SHA512
3e98d36f74a41b826f9dfb6e68fc946ae46db4401d749cfffeb7ffb8b28e00dce29aab96f0651157260af19492d68ef94a2c33706f680ab7b0ff4f2842cc3e4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
832f48b7f21847fee847025468a426b0

SHA1
05c3d4fce19db3c9050147be389473690dc4fc73

SHA256
dc6a549563bbcf8e9446cb20f2ce121962cc9dcbb67edd556ed5a8763b81072d

SHA512
764631d032abdb17087c9c82f1c47d7168ab4e85af2381c1ec37e93aecfcd803db61c65c57fcd0cd62659ea4faa54bfbd097235d481f2a832480ae42cd53c88c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b4f53cb0a0ae64067f49fe96e050aa1

SHA1
4f363092fdb6305c15c2a13699318473e77d7a8a

SHA256
5d944d1353d9f0dec18d96bc6079c49aa18a6133603b4c7f2f11764667d7de01

SHA512
7a5e84c19e19e8bfab2315229bcb8655dc3d438168af9131f909a7c88daa886b49588cf203c8ac6911ca1bc525dd8ef7a1b4d69cec7e8d588cb5f94c53442f3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d91a05fddd3c099d4b1b7776a1d58f10

SHA1
c008e3fcd118f4bdd76c28cbbf05bdf16d875e1e

SHA256
615213424cd1904cf4ac399a521719e603f5f5062e273ea73b2de58a1c46e1b9

SHA512
c672ca275dc87fe1da926f6378cdac5576a5dd9487c4362f575c3dc1d3f16e0c3f5df45200e66f6de2ab5ebb61ce3de8a2e2a2d21f1eab090d81b11d89bc78c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4bf85debdc874d68b8b08b119dd7ce9

SHA1
294bffede7ebcf9510ab193930764b24bd76a8d6

SHA256
30fbe45d498ddf574a2ac104a5a536f363b0c1527defebe21a132f8f4dc40c8a

SHA512
d00141adc950da3e8a1367da111420806c7126f6016789e855134a2f79ba89a65181aa3a5e2dee821267f37b7f23b24f09978623bb8fa2fb05ff0103d32d3d80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
fdbbcf82a8177b2e00406971be0a6e1f

SHA1
79dbe33f2248f642288ba99a03c5486965796693

SHA256
514bb41a9569a6d5ad51e68af866f63dda40e0f28c4f7ef2f9ad876d3d11672e

SHA512
8ef1c5ee34cef7118862104f26c990e684f79a57533ce417e53595b98669f1d21573ed9e01b3cdcf713be381de9c1d3c55242f74ca3d7bf5cc2c1fe62a2032fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
b0195f2e2e2e45df36ab5b4f8699b6dc

SHA1
c9d45bd385486c4f9bd8dbbfa1384a711a6589c1

SHA256
8348fea7f92ba44b26504b98f2b8800ec1aceea9ff63d2f2c538930107b71549

SHA512
ed78a5eae6fef65ae8327e4df2668897a908f61f04816560b57ace4be289eeab0fe65d19b03f44f43fb022170f0401672e7ff0df8bbfe1bf58683bc3f4f5d78f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
adee469b49e99c833821f92498d42a3a

SHA1
a0e722cb6586f92369734789c7a277c037dfacaa

SHA256
67569028b7a8f16810bbe0c818091fc9491bb060d5c13b29aad916912dacc627

SHA512
d812368b131810b2c5dfa1a5e68c1b0cf9105a92c824e1edaab70602d7bcbf690781a502bf0c0a5030c13a605e538158c789c99a1e58b156bf8bafa36bbf8c8d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8QVLR7L7\MindFire[1].exe

Filesize
2.9MB

MD5
dd921be983c759aec73edb7162d08c5f

SHA1
af4c27cc18e53c4331778518afb65f74c95ecedc

SHA256
62457ec701c871b2c1f87abe8bcbf3f9e27fe3c34b819150bae9c940c50dcce6

SHA512
f25f57b7b07a416cb3d57b1dbef570146e1c31e5d651a98aead9054b04c4798e950bc6f406da153a6e55c98e0402792b8fabaf9e79e5874ff869f9883b02c46f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OQSRAP3S\MindFire.exe

Filesize
813KB

MD5
a087305e24ce17785d8db4c69169cd53

SHA1
24bfde466f792572ad7184704ab6aeecf399c54b

SHA256
70bbb2533259ca7ecff394e53d1b1295593988ea1ede237a336ab242cd52114c

SHA512
41079a3048fce275a55e811729bd16f2e53fb4ea98e88921ebfb9c831d0215da8b231a5089d640af9ac7df9b654ab5b64876f8585474b4a6d6bd25770e8b90fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OQSRAP3S\MindFire.exe.85kewfq.partial

Filesize
2.7MB

MD5
d3544fff7c3cb7bf7f3dc9da82e107f1

SHA1
d9541f1b207941ee44ec19374d527c56c5be3c47

SHA256
78551e87023a66e67fdb965d500d724b48d136461568010306bfb0180b2bb67b

SHA512
c02de4356d41a085a5ba91e90f74db7e341107619d857a06d63e5bf04bcebfba42e35f80839dc9f610634b45092a01627f9a49bfa578063b65b38681f7ce0251

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E20.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OQSRAP3S\MindFire.exe

Filesize
834KB

MD5
b43681c48562e481b375b28c45177c4d

SHA1
ef454e5e9ca22b66d6741878bccdc627f2191bc4

SHA256
68e1448e83dfc6fc687a8b89e895a1a7f6532fa1692f408a76ef5351ba486e91

SHA512
dcfbb98d52d02811354393623c44e9787c9444feaa2d31402349c3dc5456805dbfad6d664c669c52a8d2ebfbed0c5003204e63f2a91c12f98a91c4cb46a2e907

Download Submit
memory/1460-76-0x0000000140000000-0x0000000141914000-memory.dmp

Filesize
25.1MB

Download
memory/1460-90-0x0000000077070000-0x0000000077219000-memory.dmp

Filesize
1.7MB

Download
memory/1460-88-0x0000000077070000-0x0000000077219000-memory.dmp

Filesize
1.7MB

Download
memory/1460-87-0x0000000140000000-0x0000000141914000-memory.dmp

Filesize
25.1MB

Download
memory/1460-77-0x0000000077220000-0x0000000077222000-memory.dmp

Filesize
8KB

Download
memory/1460-86-0x0000000140000000-0x0000000141914000-memory.dmp

Filesize
25.1MB

Download
memory/1460-80-0x0000000077230000-0x0000000077232000-memory.dmp

Filesize
8KB

Download
memory/1460-81-0x0000000077070000-0x0000000077219000-memory.dmp

Filesize
1.7MB

Download
memory/1460-85-0x0000000077230000-0x0000000077232000-memory.dmp

Filesize
8KB

Download
memory/1460-83-0x0000000077230000-0x0000000077232000-memory.dmp

Filesize
8KB

Download
memory/1460-79-0x0000000077220000-0x0000000077222000-memory.dmp

Filesize
8KB

Download
memory/1460-74-0x0000000077220000-0x0000000077222000-memory.dmp

Filesize
8KB

Download
memory/1460-73-0x0000000140000000-0x0000000141914000-memory.dmp

Filesize
25.1MB

Download