Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
19/03/2024, 10:46
240319-mvcmcsah4t 1018/03/2024, 12:09
240318-pbenqagc97 1017/03/2024, 13:27
240317-qqh55afc93 1017/03/2024, 02:17
240317-cqtd7scf2x 10Analysis
-
max time kernel
66s -
max time network
70s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19/03/2024, 10:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d4bd84ab6a80420dd229e9607fb50c088667fdd38e2d8bf7a583269effa68278.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
14 signatures
1800 seconds
General
-
Target
d4bd84ab6a80420dd229e9607fb50c088667fdd38e2d8bf7a583269effa68278.exe
-
Size
209KB
-
MD5
2cb4d9235c8edfaeeedf9258177cec57
-
SHA1
401520c963a302e4df292c032416febec06e5666
-
SHA256
d4bd84ab6a80420dd229e9607fb50c088667fdd38e2d8bf7a583269effa68278
-
SHA512
5d1059c1618e8cf1645a7775da743b02ef387d249c6b263e20ade68362ee06e43548293c1bb224719014618458b6bb6b00c7664fbea97b2414976ce980a8d950
-
SSDEEP
3072:M4GZjvkqp4C/Khv97mrvw1F0Dz1yL9w1RBeg8+/yGYV:nGlvkqp4RSTwQwkRBeA
Score
10/10
Malware Config
Extracted
Family
smokeloader
Version
2022
C2
http://selebration17io.io/index.php
http://vacantion18ffeu.cc/index.php
http://valarioulinity1.net/index.php
http://buriatiarutuhuob.net/index.php
http://cassiosssionunu.me/index.php
http://sulugilioiu19.net/index.php
http://goodfooggooftool.net/index.php
rc4.i32
rc4.i32
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 3408 Process not Found -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d4bd84ab6a80420dd229e9607fb50c088667fdd38e2d8bf7a583269effa68278.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d4bd84ab6a80420dd229e9607fb50c088667fdd38e2d8bf7a583269effa68278.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d4bd84ab6a80420dd229e9607fb50c088667fdd38e2d8bf7a583269effa68278.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133553188642912836" chrome.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5100 d4bd84ab6a80420dd229e9607fb50c088667fdd38e2d8bf7a583269effa68278.exe 5100 d4bd84ab6a80420dd229e9607fb50c088667fdd38e2d8bf7a583269effa68278.exe 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found 3408 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3408 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 5100 d4bd84ab6a80420dd229e9607fb50c088667fdd38e2d8bf7a583269effa68278.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3408 Process not Found Token: SeCreatePagefilePrivilege 3408 Process not Found Token: SeShutdownPrivilege 3408 Process not Found Token: SeCreatePagefilePrivilege 3408 Process not Found Token: SeShutdownPrivilege 3408 Process not Found Token: SeCreatePagefilePrivilege 3408 Process not Found Token: SeShutdownPrivilege 3408 Process not Found Token: SeCreatePagefilePrivilege 3408 Process not Found Token: SeDebugPrivilege 3876 taskmgr.exe Token: SeSystemProfilePrivilege 3876 taskmgr.exe Token: SeCreateGlobalPrivilege 3876 taskmgr.exe Token: SeShutdownPrivilege 3408 Process not Found Token: SeCreatePagefilePrivilege 3408 Process not Found Token: SeShutdownPrivilege 3408 Process not Found Token: SeCreatePagefilePrivilege 3408 Process not Found Token: SeShutdownPrivilege 3408 Process not Found Token: SeCreatePagefilePrivilege 3408 Process not Found Token: SeShutdownPrivilege 3408 Process not Found Token: SeCreatePagefilePrivilege 3408 Process not Found Token: SeShutdownPrivilege 3408 Process not Found Token: SeCreatePagefilePrivilege 3408 Process not Found Token: 33 3876 taskmgr.exe Token: SeIncBasePriorityPrivilege 3876 taskmgr.exe Token: SeShutdownPrivilege 3408 Process not Found Token: SeCreatePagefilePrivilege 3408 Process not Found Token: SeShutdownPrivilege 3408 Process not Found Token: SeCreatePagefilePrivilege 3408 Process not Found Token: SeShutdownPrivilege 3408 Process not Found Token: SeCreatePagefilePrivilege 3408 Process not Found Token: SeShutdownPrivilege 3408 Process not Found Token: SeCreatePagefilePrivilege 3408 Process not Found Token: SeShutdownPrivilege 3408 Process not Found Token: SeCreatePagefilePrivilege 3408 Process not Found Token: SeShutdownPrivilege 3408 Process not Found Token: SeCreatePagefilePrivilege 3408 Process not Found Token: SeShutdownPrivilege 3408 Process not Found Token: SeCreatePagefilePrivilege 3408 Process not Found Token: SeShutdownPrivilege 4424 chrome.exe Token: SeCreatePagefilePrivilege 4424 chrome.exe Token: SeShutdownPrivilege 4424 chrome.exe Token: SeCreatePagefilePrivilege 4424 chrome.exe Token: SeShutdownPrivilege 3408 Process not Found Token: SeCreatePagefilePrivilege 3408 Process not Found Token: SeShutdownPrivilege 4424 chrome.exe Token: SeCreatePagefilePrivilege 4424 chrome.exe Token: SeShutdownPrivilege 4424 chrome.exe Token: SeCreatePagefilePrivilege 4424 chrome.exe Token: SeShutdownPrivilege 3408 Process not Found Token: SeCreatePagefilePrivilege 3408 Process not Found Token: SeShutdownPrivilege 3408 Process not Found Token: SeCreatePagefilePrivilege 3408 Process not Found Token: SeDebugPrivilege 1068 taskmgr.exe Token: SeSystemProfilePrivilege 1068 taskmgr.exe Token: SeCreateGlobalPrivilege 1068 taskmgr.exe Token: SeShutdownPrivilege 4424 chrome.exe Token: SeCreatePagefilePrivilege 4424 chrome.exe Token: SeShutdownPrivilege 4424 chrome.exe Token: SeCreatePagefilePrivilege 4424 chrome.exe Token: SeShutdownPrivilege 4424 chrome.exe Token: SeCreatePagefilePrivilege 4424 chrome.exe Token: SeShutdownPrivilege 4424 chrome.exe Token: SeCreatePagefilePrivilege 4424 chrome.exe Token: SeShutdownPrivilege 4424 chrome.exe Token: SeCreatePagefilePrivilege 4424 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3408 Process not Found 3408 Process not Found 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3408 Process not Found 3408 Process not Found 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 3876 taskmgr.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 4424 chrome.exe 3408 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3408 wrote to memory of 3876 3408 Process not Found 94 PID 3408 wrote to memory of 3876 3408 Process not Found 94 PID 3408 wrote to memory of 4424 3408 Process not Found 103 PID 3408 wrote to memory of 4424 3408 Process not Found 103 PID 4424 wrote to memory of 1552 4424 chrome.exe 105 PID 4424 wrote to memory of 1552 4424 chrome.exe 105 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 3780 4424 chrome.exe 106 PID 4424 wrote to memory of 1612 4424 chrome.exe 107 PID 4424 wrote to memory of 1612 4424 chrome.exe 107 PID 4424 wrote to memory of 4408 4424 chrome.exe 108 PID 4424 wrote to memory of 4408 4424 chrome.exe 108 PID 4424 wrote to memory of 4408 4424 chrome.exe 108 PID 4424 wrote to memory of 4408 4424 chrome.exe 108 PID 4424 wrote to memory of 4408 4424 chrome.exe 108 PID 4424 wrote to memory of 4408 4424 chrome.exe 108 PID 4424 wrote to memory of 4408 4424 chrome.exe 108 PID 4424 wrote to memory of 4408 4424 chrome.exe 108 PID 4424 wrote to memory of 4408 4424 chrome.exe 108 PID 4424 wrote to memory of 4408 4424 chrome.exe 108 PID 4424 wrote to memory of 4408 4424 chrome.exe 108 PID 4424 wrote to memory of 4408 4424 chrome.exe 108 PID 4424 wrote to memory of 4408 4424 chrome.exe 108 PID 4424 wrote to memory of 4408 4424 chrome.exe 108 PID 4424 wrote to memory of 4408 4424 chrome.exe 108 PID 4424 wrote to memory of 4408 4424 chrome.exe 108 PID 4424 wrote to memory of 4408 4424 chrome.exe 108 PID 4424 wrote to memory of 4408 4424 chrome.exe 108 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4bd84ab6a80420dd229e9607fb50c088667fdd38e2d8bf7a583269effa68278.exe"C:\Users\Admin\AppData\Local\Temp\d4bd84ab6a80420dd229e9607fb50c088667fdd38e2d8bf7a583269effa68278.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5100
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3876
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffed2e69758,0x7ffed2e69768,0x7ffed2e697782⤵PID:1552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1760,i,12532792639342473703,1234061620840526890,131072 /prefetch:22⤵PID:3780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1760,i,12532792639342473703,1234061620840526890,131072 /prefetch:82⤵PID:1612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 --field-trial-handle=1760,i,12532792639342473703,1234061620840526890,131072 /prefetch:82⤵PID:4408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3076 --field-trial-handle=1760,i,12532792639342473703,1234061620840526890,131072 /prefetch:12⤵PID:996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3104 --field-trial-handle=1760,i,12532792639342473703,1234061620840526890,131072 /prefetch:12⤵PID:2796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4188 --field-trial-handle=1760,i,12532792639342473703,1234061620840526890,131072 /prefetch:12⤵PID:3844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 --field-trial-handle=1760,i,12532792639342473703,1234061620840526890,131072 /prefetch:82⤵PID:3952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 --field-trial-handle=1760,i,12532792639342473703,1234061620840526890,131072 /prefetch:82⤵PID:3640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4140 --field-trial-handle=1760,i,12532792639342473703,1234061620840526890,131072 /prefetch:82⤵PID:2292
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4860
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1068
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5d2fb266b97caff2086bf0fa74eddb6b2
SHA12f0061ce9c51b5b4fbab76b37fc6a540be7f805d
SHA256b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a
SHA512c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8
-
Filesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
Filesize
944B
MD56bd369f7c74a28194c991ed1404da30f
SHA10f8e3f8ab822c9374409fe399b6bfe5d68cbd643
SHA256878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d
SHA5128fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93
-
Filesize
371B
MD5de03e12ed26b954c5d71bbeeed852bf6
SHA1e43ec7ebd156c2c7b50f44e0c631fa2b978c582d
SHA256a9ba8b9cc59a9113d9ef0e7b60cbab721be7059a5c633f0f31b0db164dbe910d
SHA512d8d13551eeb38aa01672a26758b5c9cac9290824e871b48e95507bddc5d781c103a188aa90f9281072d7e18d0c1d54b8947f0a76202f5e20cb2f929933ad9536
-
Filesize
6KB
MD552887fa184f10338884de2547be1f010
SHA14b90e115679fb031623185cb2453de10d636ddb1
SHA256b099f202d0eb11400bbf66dbff2a7a15ce99e7f75fec56169260eb54908ac9ea
SHA51203c79ceb90d56ba2c2abb3f161246084ccb15a9be45207584cfa7f5c0e0406797879cee880f2d2d84734c8b388dc2a01a46542c0b1be48bb9f38c79cf2216ef6
-
Filesize
15KB
MD5f76d951b03147f9ad965e8bcbdf23958
SHA1ce798116662a6173461b813f289b8a353a17361c
SHA256f388d0b90211fb1e026e9d682d569e50c00d1e791f7b00b08d10c412cb199992
SHA51278dbfd72c0874bcf2f8471043d0ceeda8f0726b165bbb78c2d3e07e4a6ad07f82f068338fef7a568a909b2429f2cb84cbef53054e96c2a91bc3acfe3480b9964
-
Filesize
258KB
MD5081073a0a2bce445578007f857a7fe4e
SHA154a36dd74a0a809daf1d0b47eca530c38d683c95
SHA256e97981eeac991cc4458d1918d3698dfcd8756e30cab8762f7a8eb556196277c8
SHA512883c007571d427856c78216f3a988028afdce2db5fdf992ed814a635596fe1391e20e795a5bfe60793cf02608dae09dfacc2ec7b96f9dc7aacf0c53fbb1d8652
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd