Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
170s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 05:34
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://drive.google.com/file/d/1-m_JuUMXABmwUlM2EEwmLDxWJBn17WTD/view
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
https://drive.google.com/file/d/1-m_JuUMXABmwUlM2EEwmLDxWJBn17WTD/view
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
https://drive.google.com/file/d/1-m_JuUMXABmwUlM2EEwmLDxWJBn17WTD/view
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
https://drive.google.com/file/d/1-m_JuUMXABmwUlM2EEwmLDxWJBn17WTD/view
Resource
win11-20240426-en
General
-
Target
https://drive.google.com/file/d/1-m_JuUMXABmwUlM2EEwmLDxWJBn17WTD/view
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
flow pid Process 131 1360 msiexec.exe 133 1360 msiexec.exe 136 4088 powershell.exe 137 4088 powershell.exe -
Loads dropped DLL 6 IoCs
pid Process 4904 MsiExec.exe 4904 MsiExec.exe 4904 MsiExec.exe 4904 MsiExec.exe 4904 MsiExec.exe 4904 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 2 drive.google.com 4 drive.google.com 5 drive.google.com -
Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI9CD.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB07.tmp msiexec.exe File created C:\Windows\Installer\e590620.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI7D6.tmp msiexec.exe File created C:\Windows\Installer\e590624.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI1C8D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8F0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAA9.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\e590620.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI95F.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{2E67F7BB-C4ED-4EB2-B18A-C07C9C672006} msiexec.exe -
pid Process 4088 powershell.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133601384760339141" chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings chrome.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 1216 chrome.exe 1216 chrome.exe 1692 msiexec.exe 1692 msiexec.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe -
Suspicious use of FindShellTrayWindow 42 IoCs
pid Process 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 3880 7zG.exe 3628 7zG.exe 1360 msiexec.exe 1360 msiexec.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1452 wrote to memory of 3596 1452 chrome.exe 81 PID 1452 wrote to memory of 3596 1452 chrome.exe 81 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 1616 1452 chrome.exe 83 PID 1452 wrote to memory of 4328 1452 chrome.exe 84 PID 1452 wrote to memory of 4328 1452 chrome.exe 84 PID 1452 wrote to memory of 2460 1452 chrome.exe 85 PID 1452 wrote to memory of 2460 1452 chrome.exe 85 PID 1452 wrote to memory of 2460 1452 chrome.exe 85 PID 1452 wrote to memory of 2460 1452 chrome.exe 85 PID 1452 wrote to memory of 2460 1452 chrome.exe 85 PID 1452 wrote to memory of 2460 1452 chrome.exe 85 PID 1452 wrote to memory of 2460 1452 chrome.exe 85 PID 1452 wrote to memory of 2460 1452 chrome.exe 85 PID 1452 wrote to memory of 2460 1452 chrome.exe 85 PID 1452 wrote to memory of 2460 1452 chrome.exe 85 PID 1452 wrote to memory of 2460 1452 chrome.exe 85 PID 1452 wrote to memory of 2460 1452 chrome.exe 85 PID 1452 wrote to memory of 2460 1452 chrome.exe 85 PID 1452 wrote to memory of 2460 1452 chrome.exe 85 PID 1452 wrote to memory of 2460 1452 chrome.exe 85 PID 1452 wrote to memory of 2460 1452 chrome.exe 85 PID 1452 wrote to memory of 2460 1452 chrome.exe 85 PID 1452 wrote to memory of 2460 1452 chrome.exe 85 PID 1452 wrote to memory of 2460 1452 chrome.exe 85 PID 1452 wrote to memory of 2460 1452 chrome.exe 85 PID 1452 wrote to memory of 2460 1452 chrome.exe 85 PID 1452 wrote to memory of 2460 1452 chrome.exe 85 PID 1452 wrote to memory of 2460 1452 chrome.exe 85 PID 1452 wrote to memory of 2460 1452 chrome.exe 85 PID 1452 wrote to memory of 2460 1452 chrome.exe 85 PID 1452 wrote to memory of 2460 1452 chrome.exe 85 PID 1452 wrote to memory of 2460 1452 chrome.exe 85 PID 1452 wrote to memory of 2460 1452 chrome.exe 85 PID 1452 wrote to memory of 2460 1452 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1-m_JuUMXABmwUlM2EEwmLDxWJBn17WTD/view1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff89e86ab58,0x7ff89e86ab68,0x7ff89e86ab782⤵PID:3596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1896,i,14820269579115958389,5704733496246161751,131072 /prefetch:22⤵PID:1616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1896,i,14820269579115958389,5704733496246161751,131072 /prefetch:82⤵PID:4328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2220 --field-trial-handle=1896,i,14820269579115958389,5704733496246161751,131072 /prefetch:82⤵PID:2460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2908 --field-trial-handle=1896,i,14820269579115958389,5704733496246161751,131072 /prefetch:12⤵PID:644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2928 --field-trial-handle=1896,i,14820269579115958389,5704733496246161751,131072 /prefetch:12⤵PID:1364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4404 --field-trial-handle=1896,i,14820269579115958389,5704733496246161751,131072 /prefetch:12⤵PID:3360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3876 --field-trial-handle=1896,i,14820269579115958389,5704733496246161751,131072 /prefetch:82⤵PID:888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 --field-trial-handle=1896,i,14820269579115958389,5704733496246161751,131072 /prefetch:82⤵PID:4740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4296 --field-trial-handle=1896,i,14820269579115958389,5704733496246161751,131072 /prefetch:82⤵PID:4948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 --field-trial-handle=1896,i,14820269579115958389,5704733496246161751,131072 /prefetch:82⤵PID:5024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3876 --field-trial-handle=1896,i,14820269579115958389,5704733496246161751,131072 /prefetch:82⤵PID:2788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=1592 --field-trial-handle=1896,i,14820269579115958389,5704733496246161751,131072 /prefetch:12⤵PID:3556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 --field-trial-handle=1896,i,14820269579115958389,5704733496246161751,131072 /prefetch:82⤵PID:2232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 --field-trial-handle=1896,i,14820269579115958389,5704733496246161751,131072 /prefetch:82⤵PID:4740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 --field-trial-handle=1896,i,14820269579115958389,5704733496246161751,131072 /prefetch:82⤵PID:964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5404 --field-trial-handle=1896,i,14820269579115958389,5704733496246161751,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1216
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3036
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2200
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\x64__x32__installer\" -spe -an -ai#7zMap2153:100:7zEvent77201⤵
- Suspicious use of FindShellTrayWindow
PID:3880
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\x64__x32__installer\x64__x32___setup\" -spe -an -ai#7zMap30625:134:7zEvent65951⤵
- Suspicious use of FindShellTrayWindow
PID:3628
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\x64__x32__installer\x64__x32___setup\setup.msi"1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:1360
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1692 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 54B4E3B87F5C3A226EF4889F175E72E42⤵
- Loads dropped DLL
PID:4904 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssBB1.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiBAE.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrBAF.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrBB0.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4088
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD53e19a37fdc2e5df38c61fe01c1078d7f
SHA1b61e92b78fcdfef953cd1f2bf1ebd6556c0ab28d
SHA2560f4f7a5647d23d7edea1f4e238d04c4728a4cd700e5c991e2f0189af2dd7435e
SHA51261c2eacacfbeff4f042937a870bb9601dedf2692939f914ab761d0cd8b889ff695de0df01918e5f0120fbddc5306e5c7b97c7d9de082f4e45b4d753c00af8bfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_E049417E5C2A0ECD64032982D0A31504
Filesize1KB
MD56a0c915e0ee5ff3db84eb375030739c5
SHA1d638ff795f2147fa4cd8cdc649013b2b4a174810
SHA2567eadd98967b02f303690248011d482e0ba0b67a931d5baecf2ee5712298776fe
SHA5128812953b9cbc7e4dc3246f705ecdf564ca782553cd74d1230e174cda30676f69eb213af805f7e5ba773054a89abcd25a56181b552ea32eb9cc78d3f7651000e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Filesize1KB
MD5589ace9e8fa1dd726240d1bd66bfb6a0
SHA1a6891b944a1878203e96a66d3d31cc8d608a65db
SHA2563f1f65ba754da72f158d3923be71aac270c4cfc25cb5fca35c1afd2602ab9012
SHA51245185f7f578bc4c403a235edd65f00d0696b2bfc91225a2f1a2b1b288e3ab1439d97304b2ad4049212c2c5410b4a90bbb7ec21a405cd9cf829fd6d54b6fda58c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_E049417E5C2A0ECD64032982D0A31504
Filesize536B
MD5d5022d2b3e6acd6fc05a4ed8be8dc618
SHA1aa01e7b26f12cbeb7c121ece13dcb7d5b68dc855
SHA2563152e9a7375a85e69a0867d728eb91a9487c7693f239618c8223c132d9ae214a
SHA512acd1fe6337944e5e0712e80b01dfb223d8d06908968b6c7b188a6b3d8feca8155e81fe0a00e13fbd25061b20386b25ea5c316e104f38388ce5c30fa800aab5ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Filesize536B
MD517bc8e99e89eec0491598c921591b689
SHA120ca1affefc144676bdf4be5588afcdd0d5bacac
SHA2569dc181a71a46aa3d6e30907091aa3fd9362954b6055f8e1f8e6b42e68ceeca5e
SHA5124428cddf0117d9a4445412254c04b24296ffddd066b90696480e1787ff324a25b7f42f6d946da73eb7eda5b957beabf2b1ca92c66244d6aae60edcf2559f1985
-
Filesize
288B
MD5c8ccd361399eb1c1c6dc1966a8a4efd3
SHA16a5a6287ded0dfc06c2bcf3f8740ca2787518a2a
SHA25653df53ab2ffd1de9cbbee3deb0b0a007b60382fb8f7c605b866b7747c1f137b9
SHA512f7201eed9c933c2147b8e578fa100de0c75d5039832cad63251475e2ef46be039e55154a338a79c65b1310b5793f478548139c90dcd35fbdc2aedff45cf0da43
-
Filesize
3KB
MD53f4d939471f639be4db36628de30e478
SHA18f9914d418c16bd44f9d23f44474f5db2cd214b3
SHA256ac725811637064b04d822267bfad70db962b45940dc9566ac5fcc8d2426cbb06
SHA51253ffa74969bb1a859b88c2a0039880a4c8c544231df833c21859fcfd0dd10ab87b5dfba5a2ee9eff46d1e484d1324ee01a044b7d4ebcaa736b96ef8395fd0865
-
Filesize
4KB
MD59b7e88ebb5db5e54786f5ddf5855a24f
SHA1f841d58b32beb29a362cd85494a6aa21bb1e71d8
SHA256ecc082e198d49ff276342b2ff0ba90308288d0a8159e9957e98bf4cf6886b54d
SHA512bb102799cd3df2df24633a60f9d7d45367cd0de47a8719db57787fe5718dc9d3e0cefeaf35eb7933029351b8aeda88bfb400c30a5ef3e9a021924b4bfb03d574
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD52fd5c9ea9af5698af2cea0efe4e5fc5f
SHA14b54910f904da45b132d2393e5f2a2db1b2ac260
SHA256c0e70c4c627b3ea7f435740216ae989583a9c8fe7ca19b58c809a990d6cfc307
SHA5120dbca7d944548de22b75749e86b6eb32c049f028c2cd82e594e68ae2b78a45f5f17108136e248e5e8eda16f273330092b6ce0ee774c2a0190b0986eea5315ec7
-
Filesize
7KB
MD5b4bb3f588e82de7ec3c99f4e3857e4a6
SHA1d1ea0be8c632cc9bbbfabea66e49957b4be5f41e
SHA256b6ac35103f0c1a020a522f4a2c5a506f62551025ade739d00c341eb4cbe8468b
SHA512dab405fbc5efb13b3837d72a6992a7d50332568fba2b2ab93fb7ebd5270829dd8db8f33ec5f5b53af41bb47765f4f3bc698f802feebb33670c44748f4e3d7816
-
Filesize
7KB
MD5adedde04cc190285dc0515ae2c489b54
SHA19a700b55fbe8b6e20095526892add4e913e2a2c4
SHA2560060845b7015bc439cc90c7e1628beefbedb60c96715ab88c69280294c749fc0
SHA51288611fe94302d5270597a701a448160827abba3f9415cd401c5aea2c3f168d15704259cda325618a71afa37924443c0bc66394de1300b3486286791d6740b597
-
Filesize
7KB
MD597c2bec5509b1d9e3e86676db78d55d6
SHA1349a390885833ea2ccdfbd071bccb39ddc9ca63e
SHA256a541577643968767896dec938ac9aa74ec8b68abdc40f8deae31063fe3db9328
SHA512fb6ff486b3196f38dbeedaf3664fb7603085ddb54780d7e5b25f928a1a5834ef23ba1d6a83d1d21378633827d13274abd2b3e7c72a178cc370f3c00680b36792
-
Filesize
257KB
MD579b0356c5935bc10b646948c76bb3325
SHA1bb292fd148abef56bb9f2798a341f691af4ef1e3
SHA2561d4e9fc9d05d1f27a612318d80b63826917a438562821ff2449bb87435d127b1
SHA51286344f02fce9ca42f6950d2b43989fcfa203e5da31c403ef7425962679bb25a2eafcaba6ed2a539907fe99bf1d57c513468504cb9c7cb171af9f133b4e283b8a
-
Filesize
257KB
MD5b294f475dc2c77288cc92169a763c528
SHA1a9f1e9f096bc92950d5e8871cfe64698c3d171bf
SHA2565914b1dd6eb792a2973f134189e65ad2cb0d6e0d1f53f5ef9c9d439563cfdacf
SHA512aafce2febe832f78d33c67f410cc48b0d8ca620b4232d9c2b55208957a022ae7633a9caadd5cf8b195623c88c40692dec862145e4ae3bc7da68254430bdd6bc2
-
Filesize
257KB
MD5c86e47a4dc2fb791a4b2a02688f3794e
SHA1890a435e488637aefdc50902140b7654ff3fcd96
SHA256c0e14f2e2877a588e1d718e75cfaa082c043b2afd80b422069898eecfaa996bf
SHA51230cb04425c90b6b7f6f14c26fa0f158b4c69d17c38d90c5ec44148da7850df151aba6fc54c37427d0f43021bcb476dbbb4457d8a3a888d17bf153ea2d1480bc8
-
Filesize
277KB
MD5e685846d69bac77ed0ba84c9a79e8f51
SHA1569dd62a50f8561d9a37f0090231ef9f0c291f65
SHA2561fac50d40400c8a773ccdf4df8611b32bc95508108b2b856cfeb88281464c628
SHA512c027f492f41ac34f71d6fe1dc10e426d6350c0390e70c801e7334b7261d80e2a2291f3465924b346523976f047ad2c4ef6df90207920c78034387166768a9cec
-
Filesize
257KB
MD5f225ba688b796867453dcad9f1c072e2
SHA15e389f01f8e90bf03fb424b830bd1291751867d6
SHA256e459989c903c629d2e9968c80293b05b5802f9054b9b3e66fe97aee65c48c446
SHA5120aa83720ba03b3aa2d3934c392b60bcd01aeaca5d246413bdbf738f948c03b30e5af62ff7cf830350a25f32c94f235785f8f36ebab3fa18229a6421e27abce4a
-
Filesize
101KB
MD5a8ca4e38720e8e0b6a80e12e5da2a064
SHA1c7488157ab38b99eef1966231796fcde60fd9210
SHA2561ed6bfb034a6c21103b356a627db0213355cb74dab8fd0b44dfd40a23372147f
SHA5125eadc2d5a4b00a4ffdbf9597db3c16bb0b0349c682840460e274b0395053252470ae951ca4d5474619c158374a2ce575cce764359d019036dcbb662028d35c01
-
Filesize
91KB
MD514ec6e3b7dfa3058d6000e30d23679d4
SHA16eecf429c707b7ab17270c6f55d1a13d5a6b3efb
SHA256c0f3cc573e7ae5b439a6eaa11be4e6783e95560ba478a4851716f39f8ccf00b8
SHA51225f297d966d8e66fd80ea9f5f64278937874e14e6b86692c87c62838d9f7dece6f75575e0f21a653f1e0b88562c4ea468e08dbb9eab71b30ac22d3666255bd90
-
Filesize
97KB
MD5f0bad1e2f029af818e661396bf62b6a1
SHA1a261d8250f1ef43b19f9803bcb2a862667adefc8
SHA2563308b35670596ba965ac929f0603dd0264b7e1dddcc423a3aac65faec8d77172
SHA512fa8e46d745ada1fc79523cf55e7088b483dc20527fc991078ba5353a48ae8ac7f0f1ac012ac252be0a2dc0b56812a09695c73dc0b3294101f4df286a1c5f6049
-
Filesize
88KB
MD521c234964290b6c1ff75b725cee01463
SHA12414073c25e4ba4c492a2cb231c3198d73c09611
SHA2566b2960c7989d6c31233dc014f35262705c01dca4d55870de2fddcfee95747c21
SHA512301b49dffdd43ad8c450deeaf7b4775945f23002ee54d1f1c9e849e94ae3b065ca3dfad9110cdb54e6e65dcf365d22c9163c9e5b0fb8265939101d2b8fbf0f66
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
54B
MD5db420131f396adc6189eb74ccab4ef61
SHA1f7a0653289e00ae8a37836e4bb0c484a5434f4db
SHA25620712a091c0903c153ec0394f349e4e687fc16980c77434fab8af6c768b4de22
SHA5128f29ec5eae268faa330bc71859bada8e36b6f53e27d819dff04451de2cb644307c80f64f71b5768906a6c5eb28e5e77f4a1b23dde01bbfa0e6b9575c4fd92f73
-
Filesize
6KB
MD530c30ef2cb47e35101d13402b5661179
SHA125696b2aab86a9233f19017539e2dd83b2f75d4e
SHA25653094df6fa4e57a3265ff04bc1e970c10bcdb3d4094ad6dd610c05b7a8b79e0f
SHA512882be2768138bb75ff7dde7d5ca4c2e024699398baacd0ce1d4619902402e054297e4f464d8cb3c22b2f35d3dabc408122c207facad64ec8014f2c54834cf458
-
Filesize
558B
MD532aaf95e81f7c25950c11c53615c753a
SHA1603ae202e859261d2ea09ac44f84d98a44007316
SHA256e523cdefc4d381fd0bb040f80f8ebcba9a022c7b731d1e3fba27ef0ad8643a58
SHA5124076c6b5a77ebc5c5e02c28269cf4751644a508c9661806e7560664e9c9379c808ca8c0860e6efd4ea3c837edbcbc4b20060413012e5f446f17a44efcef517db
-
Filesize
975KB
MD524dac6152c216a1b7b1afef7c36e2b65
SHA1a832467931f07b3f41772d89feb194a90be4119b
SHA256784af4a0d287a6611d5ee4fda32e31d7b3d5afcd14bca75d2564bb9f0045b449
SHA512b4da7fe3e32fe1dc89197ec4f0a84c1cb38ff4d872f842f4692d1520e2b39efd2d7e3b928a8e225d2504aadf72a923ed7ee7e3552988c6365b9b30358912d6ce
-
Filesize
36.3MB
MD59e6bbfff1e770efdbe71020ff09732ae
SHA1a38f07325cc3e2ab5d297c24365100e1f1058eff
SHA2566555de8b241917104e0bc51ed9d4f7dbe255018568ce8973e7e6f5b180f5a19b
SHA512792ff5dbfce1e1c414acb0e4c74964571bf24638b67b5227f2f5224f6ef3f4f89bb819bfe9e48e8fe657b0522bc44fe96b3730711297330361a5eda8503e0e9e
-
Filesize
36.3MB
MD588b66087c9eaac29881962be4b715086
SHA1551145170293df218158121851c0e4ab88d26b98
SHA25620955d369d2fdd099fbffef2860d77734b1d68bfe88734bff0ae34f26005f2fe
SHA512c14516a76b88ea020772f626d8017c09858b5326656511983e8992180240e672d907827d4fc34c33199e7ec87b0e92bd2cd3f1369068bf9c8fa2f5947b22e1e9
-
Filesize
35.0MB
MD5f21f1b608d45926927f6178511bdd579
SHA1a1a251359d7cea7dfeb52d1314bc460144533eca
SHA256b089485a125e744a166fc05cef1ec2ed5eeaa51b12f3b8e8d0adc73e7579cc5a
SHA51266521db47efc6a6f82693330af0e612886e7f0f13c7737da6459c0abb937ad1cbcd1376dc9fbddd6d78af551bc38913871e2e21e48e8d5ed630377b523e8f276
-
Filesize
738KB
MD5b158d8d605571ea47a238df5ab43dfaa
SHA1bb91ae1f2f7142b9099e3cc285f4f5b84de568e4
SHA256ca763693cc25d316f14a9ebad80ebf00590329550c45adb7e5205486533c2504
SHA51256aef59c198acf2fcd0d95ea6e32ce1c706e5098a0800feff13ddb427bfb4d538de1c415a5cb5496b09a5825155e3abb1c13c8c37dc31549604bd4d63cb70591
-
Filesize
758KB
MD5fb4665320c9da54598321c59cc5ed623
SHA189e87b3cc569edd26b5805244cfacb2f9c892bc7
SHA2569fb3156c665211a0081b189142c1d1ab18cda601ee54d5f5d8883ecfa4177a59
SHA512b205552a3cfbaa2202e6ef7e39e229af167b2342a7dc4a2f4cadfe4d05000966cf19e9e208e44d6bb0fd6a56f4283caeed9c13f523e5b301b87f79febb1840cf