Overview
overview
10Static
static
3LastMoonSetup.exe
windows7-x64
7LastMoonSetup.exe
windows10-2004-x64
10$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Epsilon.exe
windows7-x64
10Epsilon.exe
windows10-2004-x64
10LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1resources/...dex.js
windows7-x64
1resources/...dex.js
windows10-2004-x64
1resources/....2.bat
windows7-x64
7resources/....2.bat
windows10-2004-x64
7resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1swiftshade...GL.dll
windows7-x64
1swiftshade...GL.dll
windows10-2004-x64
1swiftshade...v2.dll
windows7-x64
1swiftshade...v2.dll
windows10-2004-x64
1vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...7z.dll
windows7-x64
3Analysis
-
max time kernel
155s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2024 12:10
Static task
static1
Behavioral task
behavioral1
Sample
LastMoonSetup.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
LastMoonSetup.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Epsilon.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Epsilon.exe
Resource
win10v2004-20240319-en
Behavioral task
behavioral9
Sample
LICENSES.chromium.html
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
LICENSES.chromium.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral12
Sample
ffmpeg.dll
Resource
win7-20240221-en
Behavioral task
behavioral13
Sample
ffmpeg.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral14
Sample
libEGL.dll
Resource
win7-20240221-en
Behavioral task
behavioral15
Sample
libEGL.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral16
Sample
libGLESv2.dll
Resource
win7-20240221-en
Behavioral task
behavioral17
Sample
libGLESv2.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral18
Sample
resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/index.js
Resource
win7-20240221-en
Behavioral task
behavioral19
Sample
resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/index.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral20
Sample
resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Resource
win7-20240215-en
Behavioral task
behavioral21
Sample
resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral22
Sample
resources/elevate.exe
Resource
win7-20231129-en
Behavioral task
behavioral23
Sample
resources/elevate.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral24
Sample
swiftshader/libEGL.dll
Resource
win7-20240221-en
Behavioral task
behavioral25
Sample
swiftshader/libEGL.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral26
Sample
swiftshader/libGLESv2.dll
Resource
win7-20240221-en
Behavioral task
behavioral27
Sample
swiftshader/libGLESv2.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral28
Sample
vk_swiftshader.dll
Resource
win7-20240319-en
Behavioral task
behavioral29
Sample
vk_swiftshader.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral30
Sample
vulkan-1.dll
Resource
win7-20240221-en
Behavioral task
behavioral31
Sample
vulkan-1.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20240221-en
General
-
Target
Epsilon.exe
-
Size
134.3MB
-
MD5
128d442c123dbbeefecbffea681b591b
-
SHA1
88eaf983ab17105eab1e399794f84f50f0ce6d43
-
SHA256
a12809190b023bc9ea27d62ef20c705ecdfc59e93c081ee5af996c5b484c325b
-
SHA512
779f1b557de61fbf9dad1fe04149c18c26a1cabf8beb2c57c2dd57a1a4be3a88187ffbef8657bcd948a0a6d40ea0f09c3381b290fd597210f039b854dec41eb1
-
SSDEEP
1572864:XicLgaO9p7sMMcmhRhgBx/CyhwGKsME1:khTRsJE1
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Epsilon.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation Epsilon.exe -
Loads dropped DLL 2 IoCs
Processes:
Epsilon.exepid Process 2536 Epsilon.exe 2536 Epsilon.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsBootManager = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\0\\WindowsBootManager.exe" reg.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 38 ipinfo.io 39 ipinfo.io -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Enumerates processes with tasklist 1 TTPs 2 IoCs
Processes:
tasklist.exetasklist.exepid Process 3176 tasklist.exe 3260 tasklist.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid Process 4604 taskkill.exe 2864 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
Epsilon.exeEpsilon.exepid Process 3380 Epsilon.exe 3380 Epsilon.exe 764 Epsilon.exe 764 Epsilon.exe 764 Epsilon.exe 764 Epsilon.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exetaskkill.exetaskkill.exetasklist.exeWMIC.exedescription pid Process Token: SeIncreaseQuotaPrivilege 3960 WMIC.exe Token: SeSecurityPrivilege 3960 WMIC.exe Token: SeTakeOwnershipPrivilege 3960 WMIC.exe Token: SeLoadDriverPrivilege 3960 WMIC.exe Token: SeSystemProfilePrivilege 3960 WMIC.exe Token: SeSystemtimePrivilege 3960 WMIC.exe Token: SeProfSingleProcessPrivilege 3960 WMIC.exe Token: SeIncBasePriorityPrivilege 3960 WMIC.exe Token: SeCreatePagefilePrivilege 3960 WMIC.exe Token: SeBackupPrivilege 3960 WMIC.exe Token: SeRestorePrivilege 3960 WMIC.exe Token: SeShutdownPrivilege 3960 WMIC.exe Token: SeDebugPrivilege 3960 WMIC.exe Token: SeSystemEnvironmentPrivilege 3960 WMIC.exe Token: SeRemoteShutdownPrivilege 3960 WMIC.exe Token: SeUndockPrivilege 3960 WMIC.exe Token: SeManageVolumePrivilege 3960 WMIC.exe Token: 33 3960 WMIC.exe Token: 34 3960 WMIC.exe Token: 35 3960 WMIC.exe Token: 36 3960 WMIC.exe Token: SeIncreaseQuotaPrivilege 3960 WMIC.exe Token: SeSecurityPrivilege 3960 WMIC.exe Token: SeTakeOwnershipPrivilege 3960 WMIC.exe Token: SeLoadDriverPrivilege 3960 WMIC.exe Token: SeSystemProfilePrivilege 3960 WMIC.exe Token: SeSystemtimePrivilege 3960 WMIC.exe Token: SeProfSingleProcessPrivilege 3960 WMIC.exe Token: SeIncBasePriorityPrivilege 3960 WMIC.exe Token: SeCreatePagefilePrivilege 3960 WMIC.exe Token: SeBackupPrivilege 3960 WMIC.exe Token: SeRestorePrivilege 3960 WMIC.exe Token: SeShutdownPrivilege 3960 WMIC.exe Token: SeDebugPrivilege 3960 WMIC.exe Token: SeSystemEnvironmentPrivilege 3960 WMIC.exe Token: SeRemoteShutdownPrivilege 3960 WMIC.exe Token: SeUndockPrivilege 3960 WMIC.exe Token: SeManageVolumePrivilege 3960 WMIC.exe Token: 33 3960 WMIC.exe Token: 34 3960 WMIC.exe Token: 35 3960 WMIC.exe Token: 36 3960 WMIC.exe Token: SeDebugPrivilege 4604 taskkill.exe Token: SeDebugPrivilege 2864 taskkill.exe Token: SeDebugPrivilege 3176 tasklist.exe Token: SeIncreaseQuotaPrivilege 4644 WMIC.exe Token: SeSecurityPrivilege 4644 WMIC.exe Token: SeTakeOwnershipPrivilege 4644 WMIC.exe Token: SeLoadDriverPrivilege 4644 WMIC.exe Token: SeSystemProfilePrivilege 4644 WMIC.exe Token: SeSystemtimePrivilege 4644 WMIC.exe Token: SeProfSingleProcessPrivilege 4644 WMIC.exe Token: SeIncBasePriorityPrivilege 4644 WMIC.exe Token: SeCreatePagefilePrivilege 4644 WMIC.exe Token: SeBackupPrivilege 4644 WMIC.exe Token: SeRestorePrivilege 4644 WMIC.exe Token: SeShutdownPrivilege 4644 WMIC.exe Token: SeDebugPrivilege 4644 WMIC.exe Token: SeSystemEnvironmentPrivilege 4644 WMIC.exe Token: SeRemoteShutdownPrivilege 4644 WMIC.exe Token: SeUndockPrivilege 4644 WMIC.exe Token: SeManageVolumePrivilege 4644 WMIC.exe Token: 33 4644 WMIC.exe Token: 34 4644 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Epsilon.execmd.execmd.execmd.execmd.execmd.exedescription pid Process procid_target PID 2536 wrote to memory of 1136 2536 Epsilon.exe 98 PID 2536 wrote to memory of 1136 2536 Epsilon.exe 98 PID 1136 wrote to memory of 3960 1136 cmd.exe 100 PID 1136 wrote to memory of 3960 1136 cmd.exe 100 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 840 2536 Epsilon.exe 101 PID 2536 wrote to memory of 3380 2536 Epsilon.exe 102 PID 2536 wrote to memory of 3380 2536 Epsilon.exe 102 PID 2536 wrote to memory of 972 2536 Epsilon.exe 106 PID 2536 wrote to memory of 972 2536 Epsilon.exe 106 PID 972 wrote to memory of 4604 972 cmd.exe 108 PID 972 wrote to memory of 4604 972 cmd.exe 108 PID 2536 wrote to memory of 4056 2536 Epsilon.exe 109 PID 2536 wrote to memory of 4056 2536 Epsilon.exe 109 PID 4056 wrote to memory of 2864 4056 cmd.exe 111 PID 4056 wrote to memory of 2864 4056 cmd.exe 111 PID 2536 wrote to memory of 1768 2536 Epsilon.exe 112 PID 2536 wrote to memory of 1768 2536 Epsilon.exe 112 PID 2536 wrote to memory of 4624 2536 Epsilon.exe 113 PID 2536 wrote to memory of 4624 2536 Epsilon.exe 113 PID 2536 wrote to memory of 3564 2536 Epsilon.exe 115 PID 2536 wrote to memory of 3564 2536 Epsilon.exe 115 PID 1768 wrote to memory of 4852 1768 cmd.exe 118 PID 1768 wrote to memory of 4852 1768 cmd.exe 118 PID 4624 wrote to memory of 5092 4624 cmd.exe 119 PID 4624 wrote to memory of 5092 4624 cmd.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\Epsilon.exe"C:\Users\Admin\AppData\Local\Temp\Epsilon.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic CsProduct Get UUID"2⤵
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\System32\Wbem\WMIC.exewmic CsProduct Get UUID3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3960
-
-
-
C:\Users\Admin\AppData\Local\Temp\Epsilon.exe"C:\Users\Admin\AppData\Local\Temp\Epsilon.exe" --type=gpu-process --field-trial-handle=1660,17441358116975432013,10653387638185122891,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --user-data-dir="C:\Users\Admin\AppData\Roaming\Epsilon" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 /prefetch:22⤵PID:840
-
-
C:\Users\Admin\AppData\Local\Temp\Epsilon.exe"C:\Users\Admin\AppData\Local\Temp\Epsilon.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1660,17441358116975432013,10653387638185122891,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Epsilon" --mojo-platform-channel-handle=1972 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3380
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F"2⤵
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\system32\taskkill.exetaskkill /IM chrome.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4604
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM msedge.exe /F"2⤵
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\system32\taskkill.exetaskkill /IM msedge.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2864
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""2⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"3⤵PID:4852
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"2⤵
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath3⤵PID:5092
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:3564
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3176
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"2⤵PID:972
-
C:\Windows\System32\Wbem\WMIC.exewmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4644
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:1896
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
PID:2860
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"2⤵PID:4588
-
C:\Windows\system32\cmd.execmd /c chcp 650013⤵PID:4564
-
C:\Windows\system32\chcp.comchcp 650014⤵PID:652
-
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles3⤵PID:1600
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsBootManager /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe /f"2⤵PID:4684
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsBootManager /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe /f3⤵
- Adds Run key to start application
PID:2028
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4900
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:3260
-
-
-
C:\Users\Admin\AppData\Local\Temp\Epsilon.exe"C:\Users\Admin\AppData\Local\Temp\Epsilon.exe" --type=gpu-process --field-trial-handle=1660,17441358116975432013,10653387638185122891,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Epsilon" --gpu-preferences=UAAAAAAAAADoAAAIAAAAAAAAAAAAAAAAAABgAAAIAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=724 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:764
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3508
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5dfd9fc878f9ba46103152b652f6d9a5b
SHA1ab91f928efeea38b2cffb3bedccd7b5bf36d0a5e
SHA25615e367a1de229135c65b6099dc5e1f0022d7bac833f8594d04beff5b7d37de3a
SHA5121749bb2a8e7f8c8057c47067c71c1b27500e1f8a01f8f08c02c41f94b2b17846f4a67741c6401332ec445f667169b3220c4a23a58e8f2d2168d4001328f8fc1b
-
Filesize
652KB
MD523d27ff28c534e279752e78228ea7c86
SHA1dffb31b6af27de08bebe66b6cd2a4cbc785c123a
SHA256713479673dfb53cd041ed377ae4fb9e06ad2c897de4e9de49e4d5d79d76361fe
SHA5125f89ef8cd837e713c160ed5f04eef7f19d998abc100c499aa946a1ea615bc1aee526d3055917c6bf16d0e2e487d38269fb832c186880978b1ef6d75723092538
-
Filesize
240B
MD5810ae82f863a5ffae14d3b3944252a4e
SHA15393e27113753191436b14f0cafa8acabcfe6b2a
SHA256453478914b72d9056472fb1e44c69606c62331452f47a1f3c02190f26501785c
SHA5122421a397dd2ebb17947167addacd3117f666ddab388e3678168075f58dc8eee15bb49a4aac2290140ae5102924852d27b538740a859d0b35245f505b20f29112
-
Filesize
273B
MD576b15962038ddc53a535e77abeed6928
SHA1b2225b888132fec7fbe1cb004c27804d339dbdeb
SHA25612c86c7f376d7fc4d14af18418043e84bde83d7a48cd7f4468dc976e230537c6
SHA51277ac68c8a671d098777ddbbd0ac6c3c1740b2425d27f246c983a3d93c41d2fe5f8582651c3c3287c166cd3f374c52f29c7263c3ec6f675177b2de9ba304fd497
-
Filesize
231B
MD5dec2be4f1ec3592cea668aa279e7cc9b
SHA1327cf8ab0c895e10674e00ea7f437784bb11d718
SHA256753b99d2b4e8c58bfd10995d0c2c19255fe9c8f53703bb27d1b6f76f1f4e83cc
SHA51281728e3d31b72905b3a09c79d1e307c4e8e79d436fcfe7560a8046b46ca4ae994fdfaeb1bc2328e35f418b8128f2e7239289e84350e142146df9cde86b20bb66