Overview
overview
7Static
static
3TankuumSetup.exe
windows7-x64
7TankuumSetup.exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1TankuumSetup.exe
windows7-x64
7TankuumSetup.exe
windows10-2004-x64
7d3dcompiler_47.dll
windows7-x64
1d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1swiftshade...GL.dll
windows7-x64
1swiftshade...GL.dll
windows10-2004-x64
1swiftshade...v2.dll
windows7-x64
1swiftshade...v2.dll
windows10-2004-x64
1vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...7z.dll
windows7-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3Analysis
- max time kernel
155s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
23/01/2024, 15:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
TankuumSetup.exe
Resource
win7-20231215-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
TankuumSetup.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
TankuumSetup.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral10
Sample
TankuumSetup.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral11
Sample
d3dcompiler_47.dll
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
d3dcompiler_47.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
ffmpeg.dll
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
ffmpeg.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
libEGL.dll
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
libEGL.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
libGLESv2.dll
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
libGLESv2.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
resources/elevate.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
resources/elevate.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
swiftshader/libEGL.dll
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
swiftshader/libEGL.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
swiftshader/libGLESv2.dll
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
swiftshader/libGLESv2.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
vk_swiftshader.dll
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
vk_swiftshader.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
vulkan-1.dll
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
vulkan-1.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral30
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target TankuumSetup.exe
- Size 140.1MB
- Sample240123-tddxesbgdl
- SHA256 1b638d5797c7091be2404509fa9933cfb24a01b40ad74626193d277e234057ad
- MD5 d34b73aed1fda7213774fc21abc71fb4
- SHA1 68c7fe89033a29a67808e6fadb241fa202265ae9
- SHA512 5b83eec2f885f2b4dc7dc456eeb3b9d8076462c100c244add1fbb9d21df08243d1f49ad813371afb1a5285af8391127f7505846a979543149a7f70c4bcd0ade0
- SSDEEP 1572864:A2Cm7gJKfVjsPawuFHNwczWTeMkF7ZEk8bCkKbj:XaodJFek8+k
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation TankuumSetup.exe Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation TankuumSetup.exe - Loads dropped DLL 2 IoCs
pid Process 1888 TankuumSetup.exe 1888 TankuumSetup.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsBootManager = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\0\\WindowsBootManager.exe" reg.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 16 ipinfo.io 15 ipinfo.io - Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TankuumSetup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TankuumSetup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString TankuumSetup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 TankuumSetup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz TankuumSetup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString TankuumSetup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 TankuumSetup.exe - Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 4888 WMIC.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 4440 tasklist.exe - Kills process with taskkill 1 IoCs
pid Process 3204 taskkill.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4776 TankuumSetup.exe 4776 TankuumSetup.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5016 WMIC.exe Token: SeSecurityPrivilege 5016 WMIC.exe Token: SeTakeOwnershipPrivilege 5016 WMIC.exe Token: SeLoadDriverPrivilege 5016 WMIC.exe Token: SeSystemProfilePrivilege 5016 WMIC.exe Token: SeSystemtimePrivilege 5016 WMIC.exe Token: SeProfSingleProcessPrivilege 5016 WMIC.exe Token: SeIncBasePriorityPrivilege 5016 WMIC.exe Token: SeCreatePagefilePrivilege 5016 WMIC.exe Token: SeBackupPrivilege 5016 WMIC.exe Token: SeRestorePrivilege 5016 WMIC.exe Token: SeShutdownPrivilege 5016 WMIC.exe Token: SeDebugPrivilege 5016 WMIC.exe Token: SeSystemEnvironmentPrivilege 5016 WMIC.exe Token: SeRemoteShutdownPrivilege 5016 WMIC.exe Token: SeUndockPrivilege 5016 WMIC.exe Token: SeManageVolumePrivilege 5016 WMIC.exe Token: 33 5016 WMIC.exe Token: 34 5016 WMIC.exe Token: 35 5016 WMIC.exe Token: 36 5016 WMIC.exe Token: SeIncreaseQuotaPrivilege 5016 WMIC.exe Token: SeSecurityPrivilege 5016 WMIC.exe Token: SeTakeOwnershipPrivilege 5016 WMIC.exe Token: SeLoadDriverPrivilege 5016 WMIC.exe Token: SeSystemProfilePrivilege 5016 WMIC.exe Token: SeSystemtimePrivilege 5016 WMIC.exe Token: SeProfSingleProcessPrivilege 5016 WMIC.exe Token: SeIncBasePriorityPrivilege 5016 WMIC.exe Token: SeCreatePagefilePrivilege 5016 WMIC.exe Token: SeBackupPrivilege 5016 WMIC.exe Token: SeRestorePrivilege 5016 WMIC.exe Token: SeShutdownPrivilege 5016 WMIC.exe Token: SeDebugPrivilege 5016 WMIC.exe Token: SeSystemEnvironmentPrivilege 5016 WMIC.exe Token: SeRemoteShutdownPrivilege 5016 WMIC.exe Token: SeUndockPrivilege 5016 WMIC.exe Token: SeManageVolumePrivilege 5016 WMIC.exe Token: 33 5016 WMIC.exe Token: 34 5016 WMIC.exe Token: 35 5016 WMIC.exe Token: 36 5016 WMIC.exe Token: SeShutdownPrivilege 1888 TankuumSetup.exe Token: SeCreatePagefilePrivilege 1888 TankuumSetup.exe Token: SeIncreaseQuotaPrivilege 4888 WMIC.exe Token: SeSecurityPrivilege 4888 WMIC.exe Token: SeTakeOwnershipPrivilege 4888 WMIC.exe Token: SeLoadDriverPrivilege 4888 WMIC.exe Token: SeSystemProfilePrivilege 4888 WMIC.exe Token: SeSystemtimePrivilege 4888 WMIC.exe Token: SeProfSingleProcessPrivilege 4888 WMIC.exe Token: SeIncBasePriorityPrivilege 4888 WMIC.exe Token: SeCreatePagefilePrivilege 4888 WMIC.exe Token: SeBackupPrivilege 4888 WMIC.exe Token: SeRestorePrivilege 4888 WMIC.exe Token: SeShutdownPrivilege 4888 WMIC.exe Token: SeDebugPrivilege 4888 WMIC.exe Token: SeSystemEnvironmentPrivilege 4888 WMIC.exe Token: SeRemoteShutdownPrivilege 4888 WMIC.exe Token: SeUndockPrivilege 4888 WMIC.exe Token: SeManageVolumePrivilege 4888 WMIC.exe Token: 33 4888 WMIC.exe Token: 34 4888 WMIC.exe Token: 35 4888 WMIC.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1888 TankuumSetup.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 1648 1888 TankuumSetup.exe 91 PID 1888 wrote to memory of 2508 1888 TankuumSetup.exe 92 PID 1888 wrote to memory of 2508 1888 TankuumSetup.exe 92 PID 1888 wrote to memory of 1088 1888 TankuumSetup.exe 93 PID 1888 wrote to memory of 1088 1888 TankuumSetup.exe 93 PID 1888 wrote to memory of 1088 1888 TankuumSetup.exe 93 PID 1888 wrote to memory of 1088 1888 TankuumSetup.exe 93 PID 1888 wrote to memory of 1088 1888 TankuumSetup.exe 93 PID 1888 wrote to memory of 1088 1888 TankuumSetup.exe 93 PID 1888 wrote to memory of 1088 1888 TankuumSetup.exe 93 PID 1888 wrote to memory of 1088 1888 TankuumSetup.exe 93 PID 1888 wrote to memory of 1088 1888 TankuumSetup.exe 93 PID 1888 wrote to memory of 1088 1888 TankuumSetup.exe 93 PID 1888 wrote to memory of 1088 1888 TankuumSetup.exe 93 PID 1888 wrote to memory of 1088 1888 TankuumSetup.exe 93 PID 1888 wrote to memory of 1088 1888 TankuumSetup.exe 93 PID 1888 wrote to memory of 1088 1888 TankuumSetup.exe 93 PID 1888 wrote to memory of 1088 1888 TankuumSetup.exe 93 PID 1888 wrote to memory of 1088 1888 TankuumSetup.exe 93 PID 1888 wrote to memory of 1088 1888 TankuumSetup.exe 93 PID 1888 wrote to memory of 1088 1888 TankuumSetup.exe 93 PID 1888 wrote to memory of 1088 1888 TankuumSetup.exe 93 PID 1888 wrote to memory of 1088 1888 TankuumSetup.exe 93 PID 1888 wrote to memory of 1088 1888 TankuumSetup.exe 93 PID 1888 wrote to memory of 1088 1888 TankuumSetup.exe 93 PID 1888 wrote to memory of 1088 1888 TankuumSetup.exe 93 PID 1888 wrote to memory of 1088 1888 TankuumSetup.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\TankuumSetup.exe"C:\Users\Admin\AppData\Local\Temp\TankuumSetup.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\TankuumSetup.exe"C:\Users\Admin\AppData\Local\Temp\TankuumSetup.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\TankuumSetup is a game" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1844,i,14394014285603725567,7224484899948558089,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:1648
-
-
C:\Users\Admin\AppData\Local\Temp\TankuumSetup.exe"C:\Users\Admin\AppData\Local\Temp\TankuumSetup.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\TankuumSetup is a game" --mojo-platform-channel-handle=2160 --field-trial-handle=1844,i,14394014285603725567,7224484899948558089,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵PID:2508
-
-
C:\Users\Admin\AppData\Local\Temp\TankuumSetup.exe"C:\Users\Admin\AppData\Local\Temp\TankuumSetup.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\TankuumSetup is a game" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2404 --field-trial-handle=1844,i,14394014285603725567,7224484899948558089,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:12⤵
- Checks computer location settings
PID:1088
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"2⤵PID:4364
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath3⤵PID:3260
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"2⤵PID:2420
-
C:\Windows\System32\Wbem\WMIC.exewmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5016
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""2⤵PID:404
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"3⤵PID:832
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:4824
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:4888
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"2⤵PID:892
-
C:\Windows\system32\cmd.execmd /c chcp 650013⤵PID:2484
-
C:\Windows\system32\chcp.comchcp 650014⤵PID:2388
-
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles3⤵PID:220
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F"2⤵PID:3892
-
C:\Windows\system32\taskkill.exetaskkill /IM chrome.exe /F3⤵
- Kills process with taskkill
PID:3204
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsBootManager /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe /f"2⤵PID:1800
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsBootManager /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe /f3⤵
- Adds Run key to start application
PID:3132
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4872
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:4440
-
-
-
C:\Users\Admin\AppData\Local\Temp\TankuumSetup.exe"C:\Users\Admin\AppData\Local\Temp\TankuumSetup.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\TankuumSetup is a game" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=732 --field-trial-handle=1844,i,14394014285603725567,7224484899948558089,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4776
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\dc1147d0-811b-496b-a1a7-263d66cde794.tmp.node
- Size 2.7MB
- SHA256 d868ca7a24ce77b9ed0d78ce2e75e85f7c342888def0b8d65a9a965b81d3e1ab
- MD5 34338c8a774bc30c223f228b3ef394bb
- SHA1 98ae6592b53d35261b1a122d5b60bea7a8d8fb96
- SHA512 b728b18adc32111c53210282dae660fea7bab66e6dee4ae62f8761e5e8cb1ff4db3420a04d861a60949221d8611b0fa0d02d4963ae1a3d338d0f7f4af20a90f7
- SSDEEP 49152:2FwRlaqbFuuf8DsBMV0Ijnkv4SvkNgkEHexTdoU:juuG08SahTTdo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\e82f8ddb-b9a3-44e3-ac4f-b08e449e6648.tmp.node
- Size 641KB
- SHA256 07e3c56c257c03dcad4c32dc14215a4180b598a3cef956114731e6d4dd5db4d1
- MD5 73771feea598b6bbeb3ca4aa05f8042e
- SHA1 442e20097c660a8c911b24522c6826a043ff25b4
- SHA512 755f27a9aeeb1ef964a5d92f5a4d66325dd3d6e7547df6e39db42a3bc8ac30c12b0325e698b2110216be37cd8bea9bc33f11ef1061e0a700909197aeb100dd08
- SSDEEP 6144:NHGjzaCzoBWkh1p6IhLrcb7vxKR8r1A+zYlwRFC9PGvgj:Z2zaCeWqX6ILG7vx+8hATlGkG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\AutoFill Data\All Autofill Data.txt
- Size 249B
- SHA256 1b6d3f6ad849e115bf20175985bed9bcfc6ec206e288b97ac14c3a23b5d28a4b
- MD5 cf7e4a12f932a3fddddacc8b10e1f1b0
- SHA1 db6f9bc2be5e0905086b7b7b07109ef8d67b24ee
- SHA512 fab79f26c1841310cc61e2f8336ca05281a9252a34a3c240e500c8775840374edb0a42094c64aa38a29ca79e1cafa114d6f1bbe3009060d32f8c1df9f088c12c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\Passwords\All Passwords.txt
- Size 231B
- SHA256 753b99d2b4e8c58bfd10995d0c2c19255fe9c8f53703bb27d1b6f76f1f4e83cc
- MD5 dec2be4f1ec3592cea668aa279e7cc9b
- SHA1 327cf8ab0c895e10674e00ea7f437784bb11d718
- SHA512 81728e3d31b72905b3a09c79d1e307c4e8e79d436fcfe7560a8046b46ca4ae994fdfaeb1bc2328e35f418b8128f2e7239289e84350e142146df9cde86b20bb66
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\TankuumSetup is a game\Network\Network Persistent State
- Size 296B
- SHA256 6d4a95ef467b5f0dffa3493df02948e8be2340ba49fb525f2b103de4dbcfcecc
- MD5 b32f46a6ba5296d345de7fa2d7b5bd74
- SHA1 3c24a123409ad38d77624618b588cdb4780c38d7
- SHA512 df11800db4ec3475cb490d1735a93a2bda4f1d272c147cdcc4eead22e516e4cf2e3e05732a543f7a5aaa63d53eecc03e7e3669ba1e0e7fd55b10357ad1d683be
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\TankuumSetup is a game\Network\Network Persistent State~RFe58db96.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- MD5 SHA1 SHA512