hxxp://185[.]172[.]128[.]187/Ledger-Live[.]exe

Resubmissions

12-03-2024 21:11

240312-z1n9kada22 8

12-03-2024 21:07

240312-zylqnaag9w 8

Analysis

max time kernel
104s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-03-2024 21:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://185.172.128.187/Ledger-Live.exe

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Ledger-Live.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	Ledger-Live.exe

Executes dropped EXE 1 IoCs

Processes:

Ledger-Live.exe

pid process

2284 Ledger-Live.exe

pid	process
2284	Ledger-Live.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Ledger-Live.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ledger-Live Updater = "C:\\Users\\Admin\\Downloads\\Ledger-Live.exe"	Ledger-Live.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133547512934419991"	chrome.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

5380 PING.EXE

pid	process
5380	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exeLedger-Live.exe

pid	process
1824	chrome.exe
1824	chrome.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe
2284	Ledger-Live.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

taskmgr.exe

pid process

5652 taskmgr.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

chrome.exe

pid process

1824 chrome.exe
1824 chrome.exe
1824 chrome.exe
1824 chrome.exe

pid	process
5652	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exeLedger-Live.exe

description	pid	process
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeDebugPrivilege	2284	Ledger-Live.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exetaskmgr.exe

pid	process
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exetaskmgr.exe

pid	process
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe
5652	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 1824 wrote to memory of 3504	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 3504	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1656	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1908	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 1908	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 3500	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 3500	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 3500	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 3500	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 3500	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 3500	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 3500	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 3500	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 3500	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 3500	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 3500	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 3500	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 3500	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 3500	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 3500	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 3500	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 3500	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 3500	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 3500	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 3500	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 3500	1824	chrome.exe	chrome.exe
PID 1824 wrote to memory of 3500	1824	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://185.172.128.187/Ledger-Live.exe
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb6869758,0x7ffcb6869768,0x7ffcb6869778
2⤵
PID:3504

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 --field-trial-handle=1880,i,7437011553249073639,12026275077284420223,131072 /prefetch:2
2⤵
PID:1656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1880,i,7437011553249073639,12026275077284420223,131072 /prefetch:8
2⤵
PID:1908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 --field-trial-handle=1880,i,7437011553249073639,12026275077284420223,131072 /prefetch:8
2⤵
PID:3500

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2936 --field-trial-handle=1880,i,7437011553249073639,12026275077284420223,131072 /prefetch:1
2⤵
PID:392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2940 --field-trial-handle=1880,i,7437011553249073639,12026275077284420223,131072 /prefetch:1
2⤵
PID:5048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5084 --field-trial-handle=1880,i,7437011553249073639,12026275077284420223,131072 /prefetch:8
2⤵
PID:3720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5236 --field-trial-handle=1880,i,7437011553249073639,12026275077284420223,131072 /prefetch:8
2⤵
PID:2180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 --field-trial-handle=1880,i,7437011553249073639,12026275077284420223,131072 /prefetch:8
2⤵
PID:888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 --field-trial-handle=1880,i,7437011553249073639,12026275077284420223,131072 /prefetch:8
2⤵
PID:2428

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4040 --field-trial-handle=1880,i,7437011553249073639,12026275077284420223,131072 /prefetch:8
2⤵
PID:1088

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5160 --field-trial-handle=1880,i,7437011553249073639,12026275077284420223,131072 /prefetch:8
2⤵
PID:2864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5664 --field-trial-handle=1880,i,7437011553249073639,12026275077284420223,131072 /prefetch:8
2⤵
PID:4052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 --field-trial-handle=1880,i,7437011553249073639,12026275077284420223,131072 /prefetch:8
2⤵
PID:4912

C:\Users\Admin\Downloads\Ledger-Live.exe
"C:\Users\Admin\Downloads\Ledger-Live.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2284

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\Downloads\Ledger-Live.exe
3⤵
PID:5328

C:\Windows\SysWOW64\PING.EXE
ping 2.2.2.2 -n 1 -w 3000
4⤵
- Runs ping.exe
PID:5380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4796 --field-trial-handle=1880,i,7437011553249073639,12026275077284420223,131072 /prefetch:1
2⤵
PID:5764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3508 --field-trial-handle=1880,i,7437011553249073639,12026275077284420223,131072 /prefetch:1
2⤵
PID:5776

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4052 --field-trial-handle=1880,i,7437011553249073639,12026275077284420223,131072 /prefetch:8
2⤵
PID:5992

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4504

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5408

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5652

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
81e0d44a14a39cda8ea3f91137182791

SHA1
3b3a2e1269b9ba8ebb19f35fc93d0fefb78e8f85

SHA256
833814f9850466db64ab2cc19f96fc7b919b29a8702676858d4316873572f7c3

SHA512
7341a3555dcc14d097a71fa4cd355a07ba496b51116da8dae087530a38b01f924bfba24140faa71d85bfa72edf29623911c3fcd2446f3fb896d675c6b42248e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
1c549bddfc0890cc18a1ecde2b96a8f8

SHA1
a37123e40f8298b57f45daa5909156563120b4a0

SHA256
be5bb891054dd51cd57e945c3107687996bda0c54092286bb1192b3866340be8

SHA512
a95cec897e4837731bc796289249207d3bf53e611be7f4f44a99354c8d79f5076c3dfc1c5ff418a9089d8b2a85d2c41abc5272238ce0601623c915bc8226feef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
ac8cf5ecc636e6e83a49a0dbd8e2f429

SHA1
27f3c18041b684d070425698f221f82a5acb9dce

SHA256
767f4b735101c73f79f082f74c03dec37f1fde1bf747922cd2eaa61a757a0169

SHA512
e7cc121ff00618df499b1d1243f7df9c677b040bbba3b4cbf90a9427b384ce81193df930b9c19ccb97e5f524ae9d42abb1a149f71172e40a703def89834792cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
2b67832d296870642df39e70aa4be514

SHA1
f940c28e73d9f786bdad14b5bdd4175818a923ee

SHA256
24dcd87d69f566c7cfeecfea42a3e16caab2ec691438f9384403b6ae96bc5c2a

SHA512
d4e44f193da48e243a8f0d81c7c089a1029eeea03f78cc6795b6c5f9c377ec1c63b18486ddf0a508120e1bb146790bfb3e16d05f87981f70fa0d60ed372ec06b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
128KB

MD5
87937eea6625b06dd5a81581f4ba89d2

SHA1
0509415776d7e71e243f8f232ac825d61f921c1a

SHA256
925410ba03110aac2c7434ebfc2c5f389a8a3d9b562a7811195e8317a7f17a99

SHA512
7d0971724b1e694da22013615345e724d2d1f933875b8bffcb95fd2a4297d8de5a060b7a3985e45b8697401280c00f4961212042a9718a943a5bcd65c317446d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
128KB

MD5
0e268d7194778745d124449df00dbaaa

SHA1
e4289b704a1f303a47d1b6ff053f046d846fccad

SHA256
0fd452eb76da6cee001e74f5a70dd6676d870f5055b54ded66e61a48e3433c6a

SHA512
0fcd878b9aeaaa287abf4499f0fdc25deb46c3126a5db06dd2b64d045c9b0ad669d9a77d12f2dd7f812d3d4fddea2a989b73941f23950b752ee1abd87fe685e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
110KB

MD5
559611d34659ed2e2f0a1e1d7261b5e9

SHA1
f01622fca0a8194753eb3536cc5d28d3591089e2

SHA256
b036225683892dce66f0b31be51951c8d254485692bf7392d9f43278bb518ca1

SHA512
9925a73e60c1c15eb56bf7bc3739891190bd94a69863aa29cfc9fc374adb03cb50fd7610ae6919c1006b2ad4b84bc967ff3e6f848a333b60674e3bfd3e874727

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
114KB

MD5
1a54d7f425d68cf20e6c784caa1b1d3d

SHA1
79ca34f0655eae0b56bf6682344585a82a9cc8df

SHA256
ff5cf369b834d61ce5329dbdfe5f7c820ccd7cdfea53066d7e2566fac74b8dc5

SHA512
afac27d83cd9f12ed1591fd46e7c4a66c7e8de998169ed2d80f7e2af22cd28628eb7eae819157ae6c25a1a7c94dbbfa554132d804e9c3c635af28f3e740c18ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57c7e4.TMP
Filesize
103KB

MD5
59400afe93fc8c87a5f858b95ec85642

SHA1
a442726e309ba47b2725bc29281cbb733ea19e6b

SHA256
cd10ed9422c96c89b744c983da1e7c71792232fea86a9d16a6365dafe97b3b4d

SHA512
15e19fb7158b83bffd88966cf34d683f44202f5ca50aa1f238b52a32d2f83d02ede9bde71b86f29cc122c88d326ff7113a8849e3a73f8023ccc94265ccb626d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 194086.crdownload
Filesize
101KB

MD5
42b838cf8bdf67400525e128d917f6e0

SHA1
a578f6faec738912dba8c41e7abe1502c46d0cae

SHA256
0e4ffba62ce9a464aa1b7ff9f1e55ace8f51ff1e15102d856f801a81f8b4607d

SHA512
f64b39d885375251ab7db72c57dc5b5095f0c6412169f1035d1f6a25b8415a2a01004d06bfa0267cf683ef7dea7a9f969ad43fde5a4376f1fcb65a57403433c0

Download Submit
\??\pipe\crashpad_1824_OAFOPPFRPIPNVOHJ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2284-61-0x0000000075000000-0x00000000757B0000-memory.dmp

Filesize
7.7MB

Download
memory/2284-110-0x0000000075000000-0x00000000757B0000-memory.dmp

Filesize
7.7MB

Download
memory/2284-111-0x0000000004C60000-0x0000000004C70000-memory.dmp

Filesize
64KB

Download
memory/2284-62-0x0000000004C60000-0x0000000004C70000-memory.dmp

Filesize
64KB

Download
memory/2284-60-0x00000000003E0000-0x00000000003FE000-memory.dmp

Filesize
120KB

Download
memory/5652-127-0x0000024276550000-0x0000024276551000-memory.dmp

Filesize
4KB

Download
memory/5652-123-0x0000024276550000-0x0000024276551000-memory.dmp

Filesize
4KB

Download
memory/5652-122-0x0000024276550000-0x0000024276551000-memory.dmp

Filesize
4KB

Download
memory/5652-129-0x0000024276550000-0x0000024276551000-memory.dmp

Filesize
4KB

Download
memory/5652-128-0x0000024276550000-0x0000024276551000-memory.dmp

Filesize
4KB

Download
memory/5652-130-0x0000024276550000-0x0000024276551000-memory.dmp

Filesize
4KB

Download
memory/5652-131-0x0000024276550000-0x0000024276551000-memory.dmp

Filesize
4KB

Download
memory/5652-132-0x0000024276550000-0x0000024276551000-memory.dmp

Filesize
4KB

Download
memory/5652-133-0x0000024276550000-0x0000024276551000-memory.dmp

Filesize
4KB

Download
memory/5652-121-0x0000024276550000-0x0000024276551000-memory.dmp

Filesize
4KB

Download