Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21/02/2024, 21:19
Static task
static1
Behavioral task
behavioral1
Sample
Tool.rar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Tool.rar
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
Tool.rar
Resource
android-x64-20240221-en
General
-
Target
Tool.rar
-
Size
40.0MB
-
MD5
2786bb143ab41d76541f4266176c5b23
-
SHA1
69939ae9721a1a38e201ff11976b4dfdc4d228dd
-
SHA256
5130fdfc53ae6a492561d5357a376a8002b1d47d114be3ef4068d80b574019ba
-
SHA512
6029df8225a32ff5de7024907cdf8bc192a1c4972daf5e87cc1449e84d3893bd01e72e3988b9ac669b70efaacb564b6fe97147190d65173b8bdbde7766706d82
-
SSDEEP
786432:whnm6+faB4iTSOTU5DyalkJ+g6dTTJgKP8gB16jE3SE9xz708u3gyWE:w1Gf5bOwFlLg6dTTJgSVCi16gyF
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies registry class 48 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "2" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3} chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48" chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 200000001a00eebbfe230000100090e24d373f126545916439c4925e467b00000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3" chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2392 chrome.exe 2392 chrome.exe -
Suspicious use of AdjustPrivilegeToken 60 IoCs
description pid Process Token: SeRestorePrivilege 2620 7zFM.exe Token: 35 2620 7zFM.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe -
Suspicious use of FindShellTrayWindow 36 IoCs
pid Process 2620 7zFM.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2164 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1052 wrote to memory of 2620 1052 cmd.exe 29 PID 1052 wrote to memory of 2620 1052 cmd.exe 29 PID 1052 wrote to memory of 2620 1052 cmd.exe 29 PID 2392 wrote to memory of 2404 2392 chrome.exe 33 PID 2392 wrote to memory of 2404 2392 chrome.exe 33 PID 2392 wrote to memory of 2404 2392 chrome.exe 33 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 1852 2392 chrome.exe 35 PID 2392 wrote to memory of 2000 2392 chrome.exe 36 PID 2392 wrote to memory of 2000 2392 chrome.exe 36 PID 2392 wrote to memory of 2000 2392 chrome.exe 36 PID 2392 wrote to memory of 1860 2392 chrome.exe 37 PID 2392 wrote to memory of 1860 2392 chrome.exe 37 PID 2392 wrote to memory of 1860 2392 chrome.exe 37 PID 2392 wrote to memory of 1860 2392 chrome.exe 37 PID 2392 wrote to memory of 1860 2392 chrome.exe 37 PID 2392 wrote to memory of 1860 2392 chrome.exe 37 PID 2392 wrote to memory of 1860 2392 chrome.exe 37 PID 2392 wrote to memory of 1860 2392 chrome.exe 37 PID 2392 wrote to memory of 1860 2392 chrome.exe 37 PID 2392 wrote to memory of 1860 2392 chrome.exe 37 PID 2392 wrote to memory of 1860 2392 chrome.exe 37 PID 2392 wrote to memory of 1860 2392 chrome.exe 37 PID 2392 wrote to memory of 1860 2392 chrome.exe 37 PID 2392 wrote to memory of 1860 2392 chrome.exe 37 PID 2392 wrote to memory of 1860 2392 chrome.exe 37 PID 2392 wrote to memory of 1860 2392 chrome.exe 37
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Tool.rar1⤵
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Tool.rar"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6aa9758,0x7fef6aa9768,0x7fef6aa97782⤵PID:2404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1172 --field-trial-handle=1208,i,749844705493063990,8138242073959354741,131072 /prefetch:22⤵PID:1852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1524 --field-trial-handle=1208,i,749844705493063990,8138242073959354741,131072 /prefetch:82⤵PID:2000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1556 --field-trial-handle=1208,i,749844705493063990,8138242073959354741,131072 /prefetch:82⤵PID:1860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2276 --field-trial-handle=1208,i,749844705493063990,8138242073959354741,131072 /prefetch:12⤵PID:2012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2284 --field-trial-handle=1208,i,749844705493063990,8138242073959354741,131072 /prefetch:12⤵PID:1948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1132 --field-trial-handle=1208,i,749844705493063990,8138242073959354741,131072 /prefetch:22⤵PID:2928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1448 --field-trial-handle=1208,i,749844705493063990,8138242073959354741,131072 /prefetch:12⤵PID:2060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2712 --field-trial-handle=1208,i,749844705493063990,8138242073959354741,131072 /prefetch:82⤵PID:616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3836 --field-trial-handle=1208,i,749844705493063990,8138242073959354741,131072 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3832 --field-trial-handle=1208,i,749844705493063990,8138242073959354741,131072 /prefetch:12⤵PID:2900
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1560
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD56a0d0b7c7a3a7bf16bfa823224105576
SHA15805b1f5caa94ba0d6cbd720b7b5c41ba1d0a46f
SHA256da9bdf501f199e6129fa5a067833a49b9a2fb28ee584e071c9ac53f70fabe3e2
SHA51227a729c9aaab0b443b5e2bbbfa01aa2ac434c24a7583b256dddc6c954bfe172067bd926e2903c83349717506ee84aba5fc93da4f9ddc649bd0a76cba585d6cf3
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
363B
MD530bbd77fcab700a259340c89a70ba0e1
SHA1734c4051d5453408221b7048162770a48f3c4601
SHA25637e35760ad25224e86df723070795091379db8467705e8779395ce49bc98dd1b
SHA51287d01ce0ab4c943eccf4e45acf5a9cf1b49253ccfff9f7fc3e50500d5ceb3f5fe3696b537add8bf8ba671945edb9478bc86a1dc40bdea8da98fbb863608b9866
-
Filesize
4KB
MD5426df63649c18623b3406445312e9d10
SHA162a90b71e3f68ec272f49d0efef7590b885ee58a
SHA256a23ea5cd83b8a792730527ea3902d7067e18470cdfadca1c24bc2c4149792613
SHA5125e1f62735fa281772327b47aad5f3eb25cf877b96990827d05ceba37b0a6c298ce57eb46b7f70e9161d09a52806bf49117e26f306c7d2ddabdd5d8af84fea59d
-
Filesize
4KB
MD5b700274bbbcaf1d7fad4880347f747b7
SHA1ca852a79c726d5fbfb8e43feb2177ac6dc7d23f8
SHA25632e8b167c5e296626d77c5bf73be22a4a5fa61cbddca32cb64bb1bab97c417d8
SHA51225bb9a1d4f7df36ed05d363f872f552a9f72c3a9c025e2c0c79b48155e01da5c4d622367b652b08f25b38b14330e8b114447b1a310adf48b32eb45bfb470a8c4
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
256KB
MD51ff6fb12158430485d493d690e5617b7
SHA12145ea2ccd492444b122d6c734d7e08ec7f3fa30
SHA2569f17ce124fe33c137763a597263eee9027fc5f156ad06bf8e14422ea681945aa
SHA5122da827ff14a2d246de48b731d92b941753ccb4365370542f5097b8aa5f8960baf031b2abb5a26e53c2b6dfd95a803bda51a7830d5e0cd15a1537bb9d89916146
-
Filesize
256KB
MD573ad205adf227654f8be844af7fdb535
SHA17643f17bd05c998d488cdf7f85d3954ad4d8eab9
SHA256589fcaf5b4b698b9fc7f970793b219f66c2edaad308f482c48c72f8b8580f475
SHA5124e97274cd15e92db5e608d72955e76461ec7e0648db7424f5bb5dd62baa6fcad5be5e10675c7cbf932acf8ad6928d7047647116f2ee08e3fd3543d8faaf5e48b