3b7c80a670ed7981e02530ca4fc4ff52e46ebe19e6ddaf3fde249d25918da77b

Analysis

max time kernel
599s
max time network
597s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 09:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1222.exe
Size 93KB
Sample240515-ly6tyacc53
SHA256 3b7c80a670ed7981e02530ca4fc4ff52e46ebe19e6ddaf3fde249d25918da77b
MD5 5da76e40362041a920fa8d814cfa941c
SHA1 af686db63394ddd7f9c64270c3940702f40563e8
SHA512 ad2933f4ac0decbe48ea5f5e62a7e14030526a3a17de0422f4bdd317fd5012367b20f853c090576a061c02035399988f346a3144ec15882a73ca5c54105abefc
SSDEEP 1536:HUwC+xhUa9urgOBPRONvM4jEwzGi1dDhDIgS:HUmUa9urgOedGi1dlx
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion ransomware

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3936	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	1222.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\photo_2024-05-14_14-12-27.jpg"	1222.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133602407779819792"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
4212	chrome.exe
4212	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4140	1222.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4140	1222.exe
Token: 33	4140	1222.exe
Token: SeIncBasePriorityPrivilege	4140	1222.exe
Token: 33	4140	1222.exe
Token: SeIncBasePriorityPrivilege	4140	1222.exe
Token: 33	4140	1222.exe
Token: SeIncBasePriorityPrivilege	4140	1222.exe
Token: 33	4140	1222.exe
Token: SeIncBasePriorityPrivilege	4140	1222.exe
Token: 33	4140	1222.exe
Token: SeIncBasePriorityPrivilege	4140	1222.exe
Token: 33	4140	1222.exe
Token: SeIncBasePriorityPrivilege	4140	1222.exe
Token: 33	4140	1222.exe
Token: SeIncBasePriorityPrivilege	4140	1222.exe
Token: 33	4140	1222.exe
Token: SeIncBasePriorityPrivilege	4140	1222.exe
Token: 33	4140	1222.exe
Token: SeIncBasePriorityPrivilege	4140	1222.exe
Token: 33	4140	1222.exe
Token: SeIncBasePriorityPrivilege	4140	1222.exe
Token: 33	4140	1222.exe
Token: SeIncBasePriorityPrivilege	4140	1222.exe
Token: 33	4140	1222.exe
Token: SeIncBasePriorityPrivilege	4140	1222.exe
Token: 33	4140	1222.exe
Token: SeIncBasePriorityPrivilege	4140	1222.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: 33	4140	1222.exe
Token: SeIncBasePriorityPrivilege	4140	1222.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: 33	4140	1222.exe
Token: SeIncBasePriorityPrivilege	4140	1222.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 3936	4140	1222.exe	84
PID 4140 wrote to memory of 3936	4140	1222.exe	84
PID 4140 wrote to memory of 3936	4140	1222.exe	84
PID 4140 wrote to memory of 3548	4140	1222.exe	91
PID 4140 wrote to memory of 3548	4140	1222.exe	91
PID 4140 wrote to memory of 3548	4140	1222.exe	91
PID 3548 wrote to memory of 2452	3548	cmd.exe	93
PID 3548 wrote to memory of 2452	3548	cmd.exe	93
PID 3548 wrote to memory of 2452	3548	cmd.exe	93
PID 2176 wrote to memory of 3136	2176	chrome.exe	99
PID 2176 wrote to memory of 3136	2176	chrome.exe	99
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 2004	2176	chrome.exe	100
PID 2176 wrote to memory of 5012	2176	chrome.exe	101
PID 2176 wrote to memory of 5012	2176	chrome.exe	101
PID 2176 wrote to memory of 2816	2176	chrome.exe	102
PID 2176 wrote to memory of 2816	2176	chrome.exe	102
PID 2176 wrote to memory of 2816	2176	chrome.exe	102
PID 2176 wrote to memory of 2816	2176	chrome.exe	102
PID 2176 wrote to memory of 2816	2176	chrome.exe	102
PID 2176 wrote to memory of 2816	2176	chrome.exe	102
PID 2176 wrote to memory of 2816	2176	chrome.exe	102
PID 2176 wrote to memory of 2816	2176	chrome.exe	102
PID 2176 wrote to memory of 2816	2176	chrome.exe	102
PID 2176 wrote to memory of 2816	2176	chrome.exe	102
PID 2176 wrote to memory of 2816	2176	chrome.exe	102
PID 2176 wrote to memory of 2816	2176	chrome.exe	102
PID 2176 wrote to memory of 2816	2176	chrome.exe	102
PID 2176 wrote to memory of 2816	2176	chrome.exe	102
PID 2176 wrote to memory of 2816	2176	chrome.exe	102
PID 2176 wrote to memory of 2816	2176	chrome.exe	102
PID 2176 wrote to memory of 2816	2176	chrome.exe	102
PID 2176 wrote to memory of 2816	2176	chrome.exe	102
PID 2176 wrote to memory of 2816	2176	chrome.exe	102
PID 2176 wrote to memory of 2816	2176	chrome.exe	102

C:\Users\Admin\AppData\Local\Temp\1222.exe
"C:\Users\Admin\AppData\Local\Temp\1222.exe"
1⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\1222.exe" "1222.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  PID:3936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB2C1.tmp.BAT" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32 USER32.DLL,SwapMouseButton
    3⤵
    PID:2452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9d4fcab58,0x7ff9d4fcab68,0x7ff9d4fcab78
  2⤵
  PID:3136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1980,i,3948178854437056439,7806678302185414365,131072 /prefetch:2
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1556 --field-trial-handle=1980,i,3948178854437056439,7806678302185414365,131072 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2228 --field-trial-handle=1980,i,3948178854437056439,7806678302185414365,131072 /prefetch:8
  2⤵
  PID:2816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3120 --field-trial-handle=1980,i,3948178854437056439,7806678302185414365,131072 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3156 --field-trial-handle=1980,i,3948178854437056439,7806678302185414365,131072 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4284 --field-trial-handle=1980,i,3948178854437056439,7806678302185414365,131072 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4488 --field-trial-handle=1980,i,3948178854437056439,7806678302185414365,131072 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4632 --field-trial-handle=1980,i,3948178854437056439,7806678302185414365,131072 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4748 --field-trial-handle=1980,i,3948178854437056439,7806678302185414365,131072 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4672 --field-trial-handle=1980,i,3948178854437056439,7806678302185414365,131072 /prefetch:8
  2⤵
  PID:548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 --field-trial-handle=1980,i,3948178854437056439,7806678302185414365,131072 /prefetch:8
  2⤵
  PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4848 --field-trial-handle=1980,i,3948178854437056439,7806678302185414365,131072 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3208 --field-trial-handle=1980,i,3948178854437056439,7806678302185414365,131072 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3404 --field-trial-handle=1980,i,3948178854437056439,7806678302185414365,131072 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3348 --field-trial-handle=1980,i,3948178854437056439,7806678302185414365,131072 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4128 --field-trial-handle=1980,i,3948178854437056439,7806678302185414365,131072 /prefetch:8
  2⤵
  PID:1892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3332 --field-trial-handle=1980,i,3948178854437056439,7806678302185414365,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4212

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

f_00001b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b
Size 797KB
SHA256 536fe8c5b1199b1dbd858daaf43a81121d6455cef7e11c1e5ff7c6ed29680680
MD5 c7e843d9eaa6b2130c3caa3ba45fd52d
SHA1 fccb6d8e223457007179918f7898d101ceae8f19
SHA512 95c2224933212ef02bfa644415b3ea4457c89d73da9883589e0c620c918f9dd9519196c0c38e494a4c3117f1d01b8557fcf23653cb977f45c447f09fc8bbe228
SSDEEP 12288:ssRdjYLlYyJ51hjdNcMPuk6nnE1CFgDUv3+bRvDcaYx/2cySiU9pY2vZHtOhj:ssR5eKy7QMPoEgf+bVYx/uYpYAHtOd
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 840B
SHA256 201e9172bfcd198e06b9c6ebe8f7669fd897b7d0bd82adfabdbfc215dd5b3e9d
MD5 cb1022c9d7959041124025c75a76e1b0
SHA1 942c1207b94be422d197da7c168045a6a9aa371f
SHA512 c1abade399eede451f25df1d5d9cdd1d5d9e1449e23d13d25d3d151e55859199cffede9ee59e481092f32271dd385b3bfdfbc5d4de8ba06ae605a84090c350d7
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 816B
SHA256 df336f9a144225680b8a59f3fad2e1eb80f6a48f67f1b14d7aa86210434e5d9c
MD5 6fedce635b4072f375558391e1e53bf8
SHA1 a0ad076cfb4109bc0d89ea727801ed2d80c79c91
SHA512 a76fdb33be33677309b673c6d4e9779b342d4244192984030ea8c02bdf6d4eaf959c6af33214d5795ff26078078b0a398841ea3f716b5c5f97c12a576ccd3908
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 f9822fff9210da67b0db2527719a452db27e82758c92dae65d158e506b687a1c
MD5 7c0986ac91c8c244490903aa927731ee
SHA1 09a87dba9284ef2c4064755f3cc9202e8e7b35e9
SHA512 101f914be7c86daf761bee96ae810f4be18b871be1711acec6a0c615f3bba6a15b32e8aea132e2c2d2996bcafc5dd85677dc6bfe30ea0fd8eec8417db86b6140
SSDEEP 96:+H9H0HDHZHzHpH6L5VHKxHpHdFHXHPH0+HCH6MoHM9H6VCH6rHGbHGpHG0UVHGMu:+H9H0HDHZHzHpH6NVHUHpHzHXHPH9HCk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 6f63f196475211147a6ec1ca32ef060f2fb2cf149abf72cab1061160c32bf41c
MD5 3ef30e447a5e76b79f855662b1bb534b
SHA1 c13d24feeff43943353dd9345d9945b0ae3db55b
SHA512 f862d3c98dd8a6bac28651fbe3f1e4229d91d443ea2cfd8f225167dd5020539863fee524a8a2e4245b4f7e35fca284fe5fc1e59cd9486155c4d7b953787b383c
SSDEEP 96:+H9H0HDHZHzHpH6L5VHKxHpHdFHXHPH02HM9H6VCH6rHGbHGpHG0UVHGMHG7xHGX:+H9H0HDHZHzHpH6NVHUHpHzHXHPHZHiV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 b990f245acaf1edef5ebdc62fa4ed8ebd7265271c8716ab190b688c175622b34
MD5 e3bc94781eeacf773fae90a9c4065d21
SHA1 b1e69b83f332705e813c712c51529972db64a6bd
SHA512 b6fe69f99fb204f3205fbcd94c70490242cab8c2f4748720e58c753d9ab3cf32163889b6c026bf6bf2f3b498e0f9ce4cfae45afb3dc6d0f907a340ea4295a9c4
SSDEEP 96:+H9H0HDHZHzHpH6L5VHKxHpHdFHXHPH0+HuH7HGH6MoHM9H6VCH6rHGbHGpHG0Ui:+H9H0HDHZHzHpH6NVHUHpHzHXHPH9Hu5
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 4b0b929097205e6bc259701128688cc3f6c476a817392566840e38f95eb2acfb
MD5 ab1b293099a17c303fe5c110d110e5d4
SHA1 07db585314ef1aab67ac585b53aefeacaf625082
SHA512 643822b1e795112d033e33f55d85727c4e41f7f6bc2f5ba51b8ddb9154fa090729f4d0d2fdcdaef232f098e8bfd348c710ba97d40166502ba143d0d49954541c
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 717781da66fea9535a4ff54ed80fec9fe2400eb80ec390dc20f32cb98db6d80c
MD5 14f1cd54f9ba05159284ade8102d0109
SHA1 5c8028e736af189329377d03746439d50f77f497
SHA512 dd70c7e9b6d9863a5d0b1d52558653c6f16b005e66edfc3227ce4bc17c13b2eb984e411283ea3b33f88d8ae52fe6307d10f73077d12225524753369ca758dd86
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 1e89c814e6c62b8b50b5ac7cbdfb4a0b630fe6d0bc357c8d30499aac3dc92e0d
MD5 0a24ba9a6e73dd49b7191000d331e97a
SHA1 23bddeb17094d11f6a0b28fa66916d9dc22e3a51
SHA512 51780c679e4b0d3e48b6a05107dcaa695ba6f83124f5aa52b1f6eeca4aa4d4686995e2db54c679a401614e9fd89431d978e044944c6c36c0a9cdba49efdbe5e3
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 836f13801e707f4879c20183f3f83e58cb5e6c744f44a88e8aef1200fffae64b
MD5 4f66cc2b9b717b5b445cf8cda5665d9c
SHA1 60d81a59db173eca6371117c613479ea571567b8
SHA512 15dd37fac9442d5fe0b78ebd47651e39c88e0e4eeff2d2e0d0322ebb093ebcb325decd18c51b46fadd2f3b395fd7213b165bb63e6008559a30b7f76b11e0e282
SSDEEP 192:lMyjHz5aJ+o8uyh+F5HTB1P5tjEsXtScR:lMy7Q+AyqFTBjtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 43b5820cf3af22130c93428b5c799e269545f1049c41e58ebc16745ee99a7183
MD5 e894c0ff1cfdc3c3edbdcc8aa2637609
SHA1 b82fd138fa2b0b54f75b0b909b19b25a6273b978
SHA512 624bbece6759fcf9f8c3bf57f79975706876eac5876fe81cc465d3aef93a59b91bf8ca717e8f053ba8d2a25e620490b26b3cac721b31da7a6f6c1474936c94e1
SSDEEP 96:l8VYJjX3zUNAKIkJXOo8iZRy7Dx+6MSmueqIOOZvJ1L2MEVhYtjEsXt0/cgVup:lMyjHz5aJ+o8syh+F6eB1P5tjEsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 66bb40bfdef3311e2917b7177c12f60b3cc58fbe3e428f1cb4b2f3c3ca225006
MD5 dc27b9639b88b4a36417019664ade4f5
SHA1 59cc170f5598bfc3c0e36a8cd3856ebda1904efd
SHA512 4ec52209dcdec58c3e707432dac98cf7f614c536dddcbe218bb766167c487f7d9e900e829133e1773f76288befab726db4ff65e81a1b9898f1cf6545a740c5b0
SSDEEP 384:O2T9LPLeR/X9f1kXqKf/pUZNCgVLH2Hf9kFrUiAHGi8Bi8o:O09LPLIv9f1kXqKf/pUZNCgVLH2HfqFC
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 1e3aaa8388e9605345ec7b56eaa3bbd380842e135f342c4c8daf6390091abf26
MD5 859330099862888a54ece202e5f6826e
SHA1 e5c485a29be6bebefd9cc46aae98d73d446a5dfc
SHA512 c65f6445703ab67add51d1d4e0eaf0692c359765100b170134e50b8dd100433c4a0eb6c3e1bcfbf8d92670a2286dc02ef08b3e6c95573a770f8f6a9f3ab3001b
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe599021.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe599021.TMP
Size 48B
SHA256 57512688911711b01b491ee901c5b702e3fa4433261485dab0bf6da7f808fb72
MD5 9cf34712ee4be1625fe8d8280f853b3e
SHA1 1844fb7274ccfd4670649e748836876141b4a833
SHA512 ae84167e8cb2068c5d65f477ceaefb17d51a4253d0a60b7582e16f2f8d79e76a0a5a8a26f01a2b49f5f951a97f81ac7f1738ad759a2bed3dfa2c567f37582945
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 257KB
SHA256 74dfa9c7ebe40a0b128dd4c354e8b947386e4611f31fd80b3c0a249f54dc1000
MD5 16f5d9bd1875f67cca71ab80e8a89283
SHA1 e7ab78bfc8ed12b2f7c173af0321f3e81a7bb9ef
SHA512 c2220f009fb1f32a48c1f13e4c590cf41d1ce11e90cf7d09aceaddf22d130a1cdefa486e4eacd546e39d7ae11d97f383fa833910233f874e19ef681a205a54e9
SSDEEP 6144:yrI1Qo5yzkpeXjnJFzXsWpQYRPILxZnhLMJjX0EeGzY2rL2:yEjCkpeXtFbtQ5fnReEFsLL2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 259KB
SHA256 53909a7fdbd9031d81ab36e056341e9f88b13eae4b520e1a7daa29a40b18ae1a
MD5 596d84df601b7023e5118fe162d8d207
SHA1 726dcf3f1f76a68a667ab3fa78de972e304111d0
SHA512 0f2bf17acb13bcbd2d1eeb3f2536b188a127948a48e835f2fca687268278cec3b5c056b3e0d995cec2d39e51dbb6d67d93ddd5fb44274296368ffe02d7e1ce7b
SSDEEP 6144:jdEOixGuLV1NI9UMBsJj6HstWmrI1Qo5yzkpeXjnJFzXsWU:KLEUpMiJft7EjCkpeXtFbA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 259KB
SHA256 5614daa6f3fc4007f9502556f7eeb8cb5210b3a0f8a43018a623164dd0e169c0
MD5 e910d3e05a1328e4b79c6650276e8078
SHA1 9ca95f9a7dafc3b7c6f7246d6c668e44e227b45d
SHA512 5008fdcd5198d1cee179f05fa2d2bce896a92cda7b9d127d83ea974c6848b52146c0bbc40632f8e56adadf88c001d490650c6735638ec6b6b7d137499dadfc7c
SSDEEP 6144:lOixGuLV1NI9UMBsJj6HstWmrI1Qo5yzkpeXjnJFzXsWU:lLEUpMiJft7EjCkpeXtFbA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 92KB
SHA256 d46438623615923f3735a475c0566927cb2d1ae1740ac2ec5ecb52f3348a2cf5
MD5 2f8cc796bc3897f5a24202701871379e
SHA1 bccaa8ae6832bde2e24740acb87dacc53d9427a0
SHA512 7ac02e5dc662eae17c9967ee9371c4bdca70613f1c075a924379887591a46fa715b4f1a09af79105eb75e597f34f404c58d17f536c417f5958a7388bc8dcdc8d
SSDEEP 384:9Fp6HxEQPn/zfJnU+28ebHZ/ep/L+ozEF1WG0xKBNLV4u4b+1ruF9j4EP7RVZz20:9oiQe8b9iNth4v502Kauds
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe5989c8.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5989c8.TMP
Size 89KB
SHA256 abd261bf324a9f92fdbc40e67f7878d477e4d6a98d3a5065a00a11c9f7d2228c
MD5 e015d79d02ca7d487ade4369b6af446f
SHA1 f3939fd11119bfb567004eeaa41c210865fdd2f0
SHA512 23251d7aaed892fd55a9aeb8ea9fe0db7f05ae4d6b8e78c7b9f54b58bb0187e43875cef6d560ebe8ec9fabd3172ed86b569a16e326a27d03c73e1b289c8390e6
SSDEEP 384:HFp6HxEQPn/zfJnU+28ebHZ/ep/L+ozEFaG0xKBNLV4u4b+1ruF9j4o7RVZz2iXR:HoiQe8bLiNth4v502KaudU
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpB2C1.tmp.BAT

Path C:\Users\Admin\AppData\Local\Temp\tmpB2C1.tmp.BAT
Size 67B
SHA256 32c699ebb7394ddb2d56f092ef10fde4d9f4bcf808dbe11bad777e7bc73f7aae
MD5 1cc401169ef8cf1e8977f4e92dfe72c7
SHA1 d04c32295d4e563978fa0abb1b32ba52699cb08d
SHA512 076eb06d9fbf8bf1d6a4c5043d803ee7b5cf0307253de6358f8ea70e0bf240f5ae2208fbe9a44778e782e29c54751936f393ade6e292064d2134ed223506866b
MD5 SHA1 SHA512

Submit Download

memory/4140-0-0x0000000074C72000-0x0000000074C73000-memory.dmp

Download

memory/4140-7-0x0000000074C70000-0x0000000075221000-memory.dmp

Download

memory/4140-6-0x0000000074C70000-0x0000000075221000-memory.dmp

Download

memory/4140-5-0x0000000074C72000-0x0000000074C73000-memory.dmp

Download

memory/4140-4-0x0000000074C70000-0x0000000075221000-memory.dmp

Download

memory/4140-2-0x0000000074C70000-0x0000000075221000-memory.dmp

Download

memory/4140-1-0x0000000074C70000-0x0000000075221000-memory.dmp

Download