"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://github.com

Signatures

Chaos

ransomware chaos

Chaos Ransomware

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Downloads MZ/PE file

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A

Legitimate hosting services abused for malware hosting/C2

Description	Indicator	Process	Target
N/A	raw.githubusercontent.com	N/A	N/A
N/A	raw.githubusercontent.com	N/A	N/A

Enumerates system info in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Modifies data under HKEY_USERS

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133601782522954824"	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\RansomZa3iM.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of SendNotifyMessage

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of WriteProcessMemory

Processes

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8756ab58,0x7ffe8756ab68,0x7ffe8756ab78

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2252 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2968 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2984 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4352 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4608 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4568 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4200 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4872 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4896 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3360 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4704 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5040 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:8

C:\Users\Admin\Downloads\RansomZa3iM.exe

"C:\Users\Admin\Downloads\RansomZa3iM.exe"

C:\Users\Admin\Downloads\RansomZa3iM.exe

"C:\Users\Admin\Downloads\RansomZa3iM.exe"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\Downloads\RansomZa3iM.exe

"C:\Users\Admin\Downloads\RansomZa3iM.exe"

C:\Users\Admin\Downloads\RansomZa3iM.exe

"C:\Users\Admin\Downloads\RansomZa3iM.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4580 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:2

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	github.com	udp
GB	20.26.156.215:80	github.com	tcp
GB	20.26.156.215:80	github.com	tcp
GB	20.26.156.215:443	github.com	tcp
US	8.8.8.8:53	github.githubassets.com	udp
US	8.8.8.8:53	avatars.githubusercontent.com	udp
US	185.199.108.133:443	avatars.githubusercontent.com	tcp
US	8.8.8.8:53	github-cloud.s3.amazonaws.com	udp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	8.8.8.8:53	user-images.githubusercontent.com	udp
US	185.199.108.154:443	github.githubassets.com	tcp
US	8.8.8.8:53	154.239.44.20.in-addr.arpa	udp
US	8.8.8.8:53	215.156.26.20.in-addr.arpa	udp
US	8.8.8.8:53	202.20.217.172.in-addr.arpa	udp
US	8.8.8.8:53	133.108.199.185.in-addr.arpa	udp
US	8.8.8.8:53	154.108.199.185.in-addr.arpa	udp
US	8.8.8.8:53	25.24.18.2.in-addr.arpa	udp
US	8.8.8.8:53	collector.github.com	udp
US	8.8.8.8:53	content-autofill.googleapis.com	udp
US	140.82.112.21:443	collector.github.com	tcp
FR	216.58.214.170:443	content-autofill.googleapis.com	tcp
US	8.8.8.8:53	170.214.58.216.in-addr.arpa	udp
US	8.8.8.8:53	21.112.82.140.in-addr.arpa	udp
US	8.8.8.8:53	api.github.com	udp
GB	20.26.156.210:443	api.github.com	tcp
GB	20.26.156.210:443	api.github.com	tcp
US	8.8.8.8:53	73.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	210.156.26.20.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
NL	23.62.61.56:443	www.bing.com	tcp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
N/A	224.0.0.251:5353		udp
US	8.8.8.8:53	56.61.62.23.in-addr.arpa	udp
NL	23.62.61.56:443	www.bing.com	tcp
US	8.8.8.8:53	97.17.167.52.in-addr.arpa	udp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	21.121.18.2.in-addr.arpa	udp
FR	216.58.214.170:443	content-autofill.googleapis.com	udp
US	8.8.8.8:53	raw.githubusercontent.com	udp
US	185.199.108.133:443	raw.githubusercontent.com	tcp
US	8.8.8.8:53	0.204.248.87.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	200.197.79.204.in-addr.arpa	udp

Files

\??\pipe\crashpad_2408_DNHSGPVRFIUVJTKH

MD5	d41d8cd98f00b204e9800998ecf8427e
SHA1	da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512	cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5	d751713988987e9331980363e24189ce
SHA1	97d170e1550eee4afc0af065b78cda302a97674c
SHA256	4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512	b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5	e1a4b8dfdf86ee9057b5fc7b7fa42b9e
SHA1	a27393a992f58c2e0445b88c217975f30261551a
SHA256	1428878a5c002bd3662da6d19ef606b381bea8612d8cfd9c12d3f8fb541a68e5
SHA512	2789c6f5b935918c449a9a835dcbf8aca44362578db16b13be3fff45b73b482b08782fd54fd87324a004be031f361ad61feb213fb1fd8f6b25f2bdad8615dea4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	5d8f7a98f830fd9c50de4ca8e58b1167
SHA1	84ce01f69485c1bcb97ccdd4fadf042e8494659a
SHA256	187b349693d318b745c7fda4a7eeff94e62af9c831387c5c86498d955f3961de
SHA512	2a15572170f3e0148e72c51e972851a8d628896543195a6464eab2bc3648bbbc4623fe2c49ad9f62f5dfceecf6fe3a6ab43a719dbf9c18c82e9fb094d51e2749

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	d4c722c2dfad6cb0525916fd8054f875
SHA1	2cb4f331c0707b174ab6f90322a073f27dc264fd
SHA256	afa5d1ebe0e54c2e90f78c3733a51b10d6ecc8a29285f2cbd61978c8131167da
SHA512	1bf309623c422e3f72e752b89aa7bbcc81c8dfa394ce337810348d8b758d16bdf76413cb99435cbc37381eadb0751a05491d1ed95488bb378558948a4759917c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5	5331bb057fc582d273687e268ab49ecd
SHA1	9cc9d8233abdb0601ebdabd1a3dfbe5740b2c1b2
SHA256	7632ab1d54360e3baf5572b820c88595776e166eb258b6d31bfbb3d92a6ebc17
SHA512	8f88b828c0972a5783230b100029c82f469e7f361f489ee06a8baa31ec2d3fc58a62968a5dd5db7b545d42d19ddd779cdf44c5efec103137b8dd619f54f1ad04

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	13f0d1d41625caa9de9adc3cbbb63bf7
SHA1	946b5e63c347322a355cf2b5b5cc56a17a7b86c5
SHA256	d49923ae3f728ee6166a8af59115564ad082cffaf434632db9a324f8166fef2d
SHA512	77589ed15f4c9038ed35ead4aea552ed2fc0a1629f89ca715f0bdd46d6a6fbac0f9fb00ae1672e943db091ee529a4ee6bb6c4c92a2c1d4b625f83a9270d5be3f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	17e00a4ef3cc46c97d4e9e8ee8f642db
SHA1	079806a437f55bfcfd7e0da43df0846ae25dc39c
SHA256	eb2fd0f6d23147a38f294b359230717a4d6b4c6c204c66fa570c442c90e2ddac
SHA512	c7e7020bf25ff1b1a43ef6130810952549d13c8f84cde2a14c18fddaa37789c3832185f2be3b308440a5ffe66fb6d8537c4c39ac6613dfd30c7cb0bf0b5f6d99

C:\Users\Admin\Downloads\RansomZa3iM.exe

MD5	2d8036195bf8167fd7d014db58a40849
SHA1	bb6319e4d016082168801afa7cc40ce0e92c62ee
SHA256	a941cb8153a35611cccf3e73640e0a0902d5a16363935002f059785347703a28
SHA512	2477624e7418d610b24a8b1b7a408afd0c6e24c8412463f4cce4a99aaa81ddd03adefa9b3f0394cebcf9dca3712cc793210252a44ba93e4c70b9407546ba5242

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	a4d93417d94023aca882e24a8c2d210f
SHA1	dea7fbe2627ed62112de04f772cbb3adaa5fe36b
SHA256	6a797b10f0911bc9b2fe9dde1affdca42eae92dd3e294156520bc34e831d6899
SHA512	df10232eb911039043839f125ca8797f89cc1fed21132e8e2c12932005175f48fc7c94722fccb852726b00079a745e06cbf67aa8fa4be6dce43d7572db2d0cc1

memory/784-416-0x00007FFE74083000-0x00007FFE74085000-memory.dmp

memory/784-417-0x00000000008B0000-0x0000000000900000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	26a7d0f6dbd4f1575025e399e1384fc2
SHA1	02b6c5b9ec2e5bcaa43fa74fc01b4f034990a765
SHA256	ddee7697e687ff19625b39f20fc7b8fbdd3ecc4493d8dc50bff01d89d0c595a0
SHA512	88cdaa40bb7a702e3d2280b6b7db5c66a66565921313e15db6e01fc57f72e6c63fdd7c25fcc948566aebe1d44a47eb3caf85e78abe891c6d91c0dbc11a862a9d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	38b721571845cc6981b2fbd9f67537b5
SHA1	c913003793b390267e19ad20671efb9fe7a5b891
SHA256	8ba40288d11b0b7f17b382068e275592ef31487cfa8b9f5e4369b57064549e25
SHA512	6244ad1bce370292e65d49b339c0c7ff13a25b8caaf01a54ab19eff2a1511b06615ffac212eaab1c54106d1cb7958bd76de1e69168c6ccd280c16c11314539f8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5856f5.TMP

MD5	cf1adedfac40a322efa2f32774d828f1
SHA1	9b555971211a40d6889adf0d7016085a40ac72d3
SHA256	073efa38a8cddec3105b7969eb697cfc7c2c7b5850efcab448b721e7ce3a6336
SHA512	fd218624f3b2094b2a98eccce07881af465932f39039041daf002ea6b72a1396cac07efc1e894cd26edde7df79b62ac3acf0dda5d007318cf8c5029e4b061162

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5	a0d41053b4ceaf4308e285d3fab3dc12
SHA1	d6bec0937c7191c9727c0af3ba556fea3850febf
SHA256	6937555731e03942223a597e86349a99494436f9d4dd2c809e2cba2e10283eb5
SHA512	1a9e50151b0c2791a62280c084da4a0d6fa04cc542e8f2609ed4d249035191784dce2a4c4eb0e2a01fb6018811ff38550800c6ffc49f8185eaab781915968e68

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5	0ab0defed5192c92f4d40d3b0d94d55c
SHA1	d2c9e7909dae9cc15757d8b27d88cb1177742bab
SHA256	cbde08cf904f0b584a440672b433905d631b1e1a4e86d80a8f29b7e47de1c844
SHA512	509334ec3faac3e28573afeca8f2abc8f23e9b32fa5ae1300918c641a16b8788e32a2a41223b4b5db1c7a812e4ccbda808d05d20911179b1533b5f81a235c601

memory/3392-454-0x00007FFE74080000-0x00007FFE74B41000-memory.dmp

memory/784-455-0x00007FFE74083000-0x00007FFE74085000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	6ce89f6872b66b6064942af4a18439e4
SHA1	f8df966f859729981d05c485399ba221e5a2bdf7
SHA256	5baf55df333083101074f78d4c64aac5231a3bb2a6b2d3cbd2259c555560fa59
SHA512	39e4cf117892dee79b435359069f6ac59336e35ee8c77562ea88fef4fec89e583ee94c7273a253618d1762ff2abe73b1250d1e834a84f581d055fd1d16972c08

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	867441983cbc3e68ae1564ce7aaebf4b
SHA1	ccdd1c5071a61142c2c953c8c656d71baadb515c
SHA256	7705034d9fd317c7c686aab41524e83645c862b0993a5f41c7b03497c6009e47
SHA512	8477398be91c2d8c8767dbdca9c637933ee279b50c29660efb55d800ef0f39127ff09cf75536304c8a3337d059d6b6dbec4683c9d876e60c9fbda251386a3cc3

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RansomZa3iM.exe.log

MD5	28d7fcc2b910da5e67ebb99451a5f598
SHA1	a5bf77a53eda1208f4f37d09d82da0b9915a6747
SHA256	2391511d0a66ed9f84ae54254f51c09e43be01ad685db80da3201ec880abd49c
SHA512	2d8eb65cbf04ca506f4ef3b9ae13ccf05ebefab702269ba70ffd1ce9e6c615db0a3ee3ac0e81a06f546fc3250b7b76155dd51241c41b507a441b658c8e761df6

memory/3392-476-0x00007FFE74080000-0x00007FFE74B41000-memory.dmp

Malware Analysis Report

2024-08-06 15:49

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Sample ID	240514-t4w6paee3t
Target	http://github.com
Tags	chaos ransomware