nitro | b346bd42d2892de01d3d271994d425617e4712c5d08a8637046f1406ab6f1ba1

Analysis

max time kernel
189s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 22:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

New Text Document.txt
Size

45B
MD5

23a1a78d0b5351de1748875c282f8496
SHA1

ac6bfb0816ab0e6fa0195fce7d3d3fd4362715eb
SHA256

b346bd42d2892de01d3d271994d425617e4712c5d08a8637046f1406ab6f1ba1
SHA512

46d46751ee80eaa6f12e5ffd410e6687f54354cd23a947597e6a38daf1e67e545d517dc1114cbdc6c5a0d8e6a03beb0c67e2598126a413b8cbb0b7ea4a4c1ca0

Score

10^/10

nitro persistence ransomware spyware stealer

Malware Config

Signatures

Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
ransomware nitro
Renames multiple (96) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Executes dropped EXE 1 IoCs

Processes:

Msi.exe

pid process

5492 Msi.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
5492	Msi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Msi.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Msi.exe\""	Msi.exe

Drops desktop.ini file(s) 8 IoCs

Processes:

Msi.exe

description	ioc	process
File created	C:\Users\Admin\Documents\desktop.ini	Msi.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	Msi.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	Msi.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	Msi.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	Msi.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	Msi.exe
File created	C:\Users\Admin\Pictures\desktop.ini	Msi.exe
File created	C:\Users\Admin\Desktop\desktop.ini	Msi.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service
T1102

Processes:

flow ioc

125 discord.com
78 discord.com
79 discord.com
84 discord.com
85 discord.com
89 discord.com
100 discord.com
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

76 api.ipify.org
77 api.ipify.org

flow	ioc
125	discord.com
78	discord.com
79	discord.com
84	discord.com
85	discord.com
89	discord.com
100	discord.com

flow	ioc
76	api.ipify.org
77	api.ipify.org

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

Msi.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png"	Msi.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133612380075858031"	chrome.exe

Modifies registry class 1 IoCs

Processes:

chrome.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

chrome.exeMsi.exetaskmgr.exechrome.exe

pid	process
4492	chrome.exe
4492	chrome.exe
5492	Msi.exe
5492	Msi.exe
5492	Msi.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
4452	chrome.exe
4452	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

chrome.exe

pid process

4492 chrome.exe
4492 chrome.exe
4492 chrome.exe
4492 chrome.exe
4492 chrome.exe
4492 chrome.exe
4492 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe7zG.exeMsi.exeWMIC.exe

description	pid	process
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeRestorePrivilege	5412	7zG.exe
Token: 35	5412	7zG.exe
Token: SeSecurityPrivilege	5412	7zG.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeSecurityPrivilege	5412	7zG.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeDebugPrivilege	5492	Msi.exe
Token: SeIncreaseQuotaPrivilege	5612	WMIC.exe
Token: SeSecurityPrivilege	5612	WMIC.exe
Token: SeTakeOwnershipPrivilege	5612	WMIC.exe
Token: SeLoadDriverPrivilege	5612	WMIC.exe
Token: SeSystemProfilePrivilege	5612	WMIC.exe
Token: SeSystemtimePrivilege	5612	WMIC.exe
Token: SeProfSingleProcessPrivilege	5612	WMIC.exe
Token: SeIncBasePriorityPrivilege	5612	WMIC.exe
Token: SeCreatePagefilePrivilege	5612	WMIC.exe
Token: SeBackupPrivilege	5612	WMIC.exe
Token: SeRestorePrivilege	5612	WMIC.exe
Token: SeShutdownPrivilege	5612	WMIC.exe
Token: SeDebugPrivilege	5612	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5612	WMIC.exe
Token: SeRemoteShutdownPrivilege	5612	WMIC.exe
Token: SeUndockPrivilege	5612	WMIC.exe
Token: SeManageVolumePrivilege	5612	WMIC.exe
Token: 33	5612	WMIC.exe
Token: 34	5612	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe7zG.exetaskmgr.exe

pid	process
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
5412	7zG.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe

Suspicious use of SendNotifyMessage 57 IoCs

Processes:

chrome.exetaskmgr.exe

pid	process
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe
3116	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4492 wrote to memory of 1912	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1912	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 2184	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 3608	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 3608	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1124	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1124	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1124	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1124	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1124	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1124	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1124	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1124	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1124	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1124	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1124	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1124	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1124	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1124	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1124	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1124	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1124	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1124	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1124	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1124	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1124	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1124	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1124	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1124	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1124	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1124	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1124	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1124	4492	chrome.exe	chrome.exe
PID 4492 wrote to memory of 1124	4492	chrome.exe	chrome.exe

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\New Text Document.txt"
1⤵
PID:2544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x104,0x108,0x10c,0x78,0x110,0x7ffafd4dab58,0x7ffafd4dab68,0x7ffafd4dab78
  2⤵
  PID:1912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1940,i,15587081253974486287,9366865205994239756,131072 /prefetch:2
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1940,i,15587081253974486287,9366865205994239756,131072 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2288 --field-trial-handle=1940,i,15587081253974486287,9366865205994239756,131072 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2984 --field-trial-handle=1940,i,15587081253974486287,9366865205994239756,131072 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3016 --field-trial-handle=1940,i,15587081253974486287,9366865205994239756,131072 /prefetch:1
  2⤵
  PID:472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3612 --field-trial-handle=1940,i,15587081253974486287,9366865205994239756,131072 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4456 --field-trial-handle=1940,i,15587081253974486287,9366865205994239756,131072 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4608 --field-trial-handle=1940,i,15587081253974486287,9366865205994239756,131072 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4768 --field-trial-handle=1940,i,15587081253974486287,9366865205994239756,131072 /prefetch:8
  2⤵
  PID:1288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4084 --field-trial-handle=1940,i,15587081253974486287,9366865205994239756,131072 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3164 --field-trial-handle=1940,i,15587081253974486287,9366865205994239756,131072 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3332 --field-trial-handle=1940,i,15587081253974486287,9366865205994239756,131072 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5308 --field-trial-handle=1940,i,15587081253974486287,9366865205994239756,131072 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 --field-trial-handle=1940,i,15587081253974486287,9366865205994239756,131072 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 --field-trial-handle=1940,i,15587081253974486287,9366865205994239756,131072 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 --field-trial-handle=1940,i,15587081253974486287,9366865205994239756,131072 /prefetch:8
  2⤵
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4444 --field-trial-handle=1940,i,15587081253974486287,9366865205994239756,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4452

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4280

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5304

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\26-05-2024_M7LTf6GHV14Jgch\" -ad -an -ai#7zMap9930:114:7zEvent14523
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5412

C:\Users\Admin\Downloads\26-05-2024_M7LTf6GHV14Jgch\Msi.exe
"C:\Users\Admin\Downloads\26-05-2024_M7LTf6GHV14Jgch\Msi.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5492
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe"
  2⤵
  PID:5548
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5612

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3116

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\bef10113511d428995fcafdc935ae1bd /t 5496 /p 5492
1⤵
PID:628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
261fb64c7ef96e391f480dd42cc55ffb

SHA1
09719cea36ae3cab472969fe3714231f28b9c557

SHA256
5ec7a4b9463c13fa2449964112dd4f6f7c17faba841d6652ff10174495217fb7

SHA512
5bf81be35ec39253a31fc6fe9890258c13bad85d945c50f917b9e269b2557dd7bbbc057075677964fbd318311c75506fc08f8417ead5f908ce62e4455734a974

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
88b07642f5a07f891410f8b1698bcdfa

SHA1
a858393c416e3dcf6c6b5675ef64c5d7c172944d

SHA256
1c4eeeb1a935a6a22c03623d2984aa892a7820316781c66f855e4d47da7be9ab

SHA512
e2a2db9009e95c4d66dce5a6fe16229e4e5eb94fdb31bc10e89c4269ee32a0430868aa3007b51c43eff0db77eb324e4bc6f2a7faf831a86fe00e6175fbad51d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
691B

MD5
3e86fb4b704df4c72176095276988f5f

SHA1
c105150872846097b03556954d2d0a0500972fae

SHA256
4f399fe4e5d31064213f7014edebaf757b05b37576833a7e38e372ee8b0ed547

SHA512
9bbae294de25f37374e8d5dc12fbacfeed8172ce134a15d91a4ddb016cb29ae24a941b52bce4014351106f3028af20a260bc507dffbacdb2cff85161b0ed5ae0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
9f173d4be5300c661c32934b2180e745

SHA1
aa493660129cbdbfb732db911f7b1123361ba2eb

SHA256
015f2f21258a31aa7317ced36e8a46b44ad6b51d26c4781de2ffbfec2d9b47b1

SHA512
65d38ff6a4a2d7160e7a2ec5c7541fab3929097fe4d06bd2bbdaec5dc166f6fb8568b8265d80114ee4737c6e307d178cba4e368b0ba4ef5f278680dd8fd69c68

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d638b1c0-1f10-4d1c-b95d-d4de745fe8f1.tmp

Filesize
16KB

MD5
d494ea87878c6c0e94644abd64508def

SHA1
ced3f38d329f15694bc7a09ce6f2f4d62b6ea021

SHA256
9cc9398164460b092a40a548f07ba90820883331fdaf84c357772fc4c4d8c12f

SHA512
20d9ea169c65aa841b6d34e19e70a09eacb3a555b10938c2997d6c51b49f9e4dc8f2a5a16e637b86bd34cb873a6e1b3cd5685f1adde4e68f803e2f3b9aec65c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
260KB

MD5
0b75d1447295501002f0bae2782d16ab

SHA1
8a45500ba8aacb76ed59bd4ee1d157fc1a3ec2d1

SHA256
24e72b922f886774f4f01949e11b7106dbd368a419897eba0bfd64db85ed3fec

SHA512
536acb85df54aec9e8b7841d2e0e976cca33c5b4af0692c379b1eedc6cf382d71f51355d65a19e171c1be612a368b9656f594cab803bc68a345aefa85adbf3c3

Download Submit
C:\Users\Admin\Downloads\26-05-2024_M7LTf6GHV14Jgch.rar

Filesize
24KB

MD5
efe2f1578c6779d4daba80cba0b9dd9d

SHA1
5ff1bec7115c0a91193ae0c43d3ac6d84e489e37

SHA256
8e6d12932b06191809b1fbda068c7b5fe1158b2307a91ba62ffa4d1d61f86abd

SHA512
2b49e3a2e8a55f6d80773a32f9b127ec93e835f83cf4aa6f2aef2d893ee6757e405ee19c8999e6028173182a869da8da8784071ffeaf609d4f90872617554f02

Download Submit
C:\Users\Admin\Downloads\26-05-2024_M7LTf6GHV14Jgch\Msi.exe

Filesize
61KB

MD5
40275c0688b75036545aaf92509906fd

SHA1
9e55b69bfd0120e5bdb90b3ac41c0ae70a692105

SHA256
23be32b33c90d78f59cee0106c85c6ccef2949ce2382ed0282a5ea7b4a25e8a7

SHA512
56d8711393e7d2319e7561adf61d0c00959a4f84dadf5c18f7419e2d06f1330818b371ab1e1f0d1779c8fa3813a57f40676539d8ffff6e8c4e868426ffb79778

Download Submit
\??\pipe\crashpad_4492_WPSPTAXZDYPVCKNA

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3116-294-0x0000018EC0100000-0x0000018EC0101000-memory.dmp

Filesize
4KB

Download
memory/3116-292-0x0000018EC0100000-0x0000018EC0101000-memory.dmp

Filesize
4KB

Download
memory/3116-291-0x0000018EC0100000-0x0000018EC0101000-memory.dmp

Filesize
4KB

Download
memory/3116-293-0x0000018EC0100000-0x0000018EC0101000-memory.dmp

Filesize
4KB

Download
memory/3116-285-0x0000018EC0100000-0x0000018EC0101000-memory.dmp

Filesize
4KB

Download
memory/3116-286-0x0000018EC0100000-0x0000018EC0101000-memory.dmp

Filesize
4KB

Download
memory/3116-287-0x0000018EC0100000-0x0000018EC0101000-memory.dmp

Filesize
4KB

Download
memory/3116-295-0x0000018EC0100000-0x0000018EC0101000-memory.dmp

Filesize
4KB

Download
memory/3116-296-0x0000018EC0100000-0x0000018EC0101000-memory.dmp

Filesize
4KB

Download
memory/3116-297-0x0000018EC0100000-0x0000018EC0101000-memory.dmp

Filesize
4KB

Download
memory/5492-133-0x0000000000EB0000-0x0000000000EC6000-memory.dmp

Filesize
88KB

Download
memory/5492-135-0x00000000057A0000-0x0000000005832000-memory.dmp

Filesize
584KB

Download
memory/5492-134-0x0000000005C70000-0x0000000006214000-memory.dmp

Filesize
5.6MB

Download
memory/5492-270-0x00000000064D0000-0x00000000064DA000-memory.dmp

Filesize
40KB

Download