Analysis
-
max time kernel
288s -
max time network
300s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
30/05/2024, 14:12
Static task
static1
Behavioral task
behavioral1
Sample
New Text Document.txt
Resource
win10-20240404-en
General
-
Target
New Text Document.txt
-
Size
91B
-
MD5
914c6636a49d8fc86abcd99483dccaf4
-
SHA1
7ea0a22b7563b398157946880c34c303fabfc85e
-
SHA256
2870e26f93e1f447a8f39d6924ddfc95895232a06508a5c5bd67f2e89631bf71
-
SHA512
27460a25ffb640afd04a2a9439ac597d2a5670be9c6097a704f8838d665df242461b2caa15a7952ebf3cd81ce1f4f3891943b11ccd17aa0afec010564cc62625
Malware Config
Signatures
-
Drops file in Program Files directory 14 IoCs
description ioc Process File created C:\Program Files (x86)\hello.bat No Escape.exe File created C:\Program Files (x86)\hello.reg No Escape.exe File created C:\Program Files (x86)\mover.exe No Escape.exe File created C:\Program Files (x86)\mypc.exe No Escape.exe File created C:\Program Files (x86)\shaking.exe No Escape.exe File created C:\Program Files (x86)\ No Escape.exe File created C:\Program Files (x86)\hello.jpg No Escape.exe File created C:\Program Files (x86)\msg.exe No Escape.exe File created C:\Program Files (x86)\date.txt No Escape.exe File opened for modification C:\Program Files (x86)\ No Escape.exe File opened for modification C:\Program Files (x86)\ No Escape.exe File created C:\Program Files (x86)\erode.exe No Escape.exe File created C:\Program Files (x86)\launch.exe No Escape.exe File created C:\Program Files (x86)\ No Escape.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133615519537310647" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies PaintStudio.View.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1" PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History PaintStudio.View.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" PaintStudio.View.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix PaintStudio.View.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" PaintStudio.View.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1" PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache PaintStudio.View.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "51200" PaintStudio.View.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2680 PaintStudio.View.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 192 chrome.exe 192 chrome.exe 5032 mspaint.exe 5032 mspaint.exe 2680 PaintStudio.View.exe 2680 PaintStudio.View.exe 2680 PaintStudio.View.exe 2680 PaintStudio.View.exe 2680 PaintStudio.View.exe 2680 PaintStudio.View.exe 2680 PaintStudio.View.exe 2680 PaintStudio.View.exe 2680 PaintStudio.View.exe 2680 PaintStudio.View.exe 2680 PaintStudio.View.exe 2680 PaintStudio.View.exe 2680 PaintStudio.View.exe 2680 PaintStudio.View.exe 2680 PaintStudio.View.exe 2680 PaintStudio.View.exe 2680 PaintStudio.View.exe 2680 PaintStudio.View.exe 2680 PaintStudio.View.exe 2680 PaintStudio.View.exe 2680 PaintStudio.View.exe 2680 PaintStudio.View.exe 2680 PaintStudio.View.exe 2680 PaintStudio.View.exe 2680 PaintStudio.View.exe 2680 PaintStudio.View.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe Token: SeShutdownPrivilege 192 chrome.exe Token: SeCreatePagefilePrivilege 192 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe 192 chrome.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 5032 mspaint.exe 2680 PaintStudio.View.exe 2680 PaintStudio.View.exe 2080 No Escape.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 192 wrote to memory of 2984 192 chrome.exe 75 PID 192 wrote to memory of 2984 192 chrome.exe 75 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 4240 192 chrome.exe 77 PID 192 wrote to memory of 3088 192 chrome.exe 78 PID 192 wrote to memory of 3088 192 chrome.exe 78 PID 192 wrote to memory of 2620 192 chrome.exe 79 PID 192 wrote to memory of 2620 192 chrome.exe 79 PID 192 wrote to memory of 2620 192 chrome.exe 79 PID 192 wrote to memory of 2620 192 chrome.exe 79 PID 192 wrote to memory of 2620 192 chrome.exe 79 PID 192 wrote to memory of 2620 192 chrome.exe 79 PID 192 wrote to memory of 2620 192 chrome.exe 79 PID 192 wrote to memory of 2620 192 chrome.exe 79 PID 192 wrote to memory of 2620 192 chrome.exe 79 PID 192 wrote to memory of 2620 192 chrome.exe 79 PID 192 wrote to memory of 2620 192 chrome.exe 79 PID 192 wrote to memory of 2620 192 chrome.exe 79 PID 192 wrote to memory of 2620 192 chrome.exe 79 PID 192 wrote to memory of 2620 192 chrome.exe 79 PID 192 wrote to memory of 2620 192 chrome.exe 79 PID 192 wrote to memory of 2620 192 chrome.exe 79 PID 192 wrote to memory of 2620 192 chrome.exe 79 PID 192 wrote to memory of 2620 192 chrome.exe 79 PID 192 wrote to memory of 2620 192 chrome.exe 79 PID 192 wrote to memory of 2620 192 chrome.exe 79 PID 192 wrote to memory of 2620 192 chrome.exe 79 PID 192 wrote to memory of 2620 192 chrome.exe 79
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\New Text Document.txt"1⤵PID:1368
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:192 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffcb6319758,0x7ffcb6319768,0x7ffcb63197782⤵PID:2984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1544 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:22⤵PID:4240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1844 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:82⤵PID:3088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2120 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:82⤵PID:2620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2920 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:12⤵PID:1276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2928 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:12⤵PID:1660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3648 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:12⤵PID:4408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4444 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:82⤵PID:4524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4616 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:82⤵PID:712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4744 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:12⤵PID:5116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3212 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:82⤵PID:3636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:82⤵PID:2084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5352 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:82⤵PID:3544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5636 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:12⤵PID:4968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5708 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:12⤵PID:4912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3156 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:82⤵PID:5096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5828 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:82⤵PID:5088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3232 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:12⤵PID:2612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4604 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:82⤵PID:3188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:82⤵PID:4732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4712 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:82⤵PID:2688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:82⤵PID:5084
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2480
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4036
-
C:\Users\Admin\Desktop\dnSpy.exe"C:\Users\Admin\Desktop\dnSpy.exe"1⤵PID:4016
-
C:\Users\Admin\Desktop\No Escape.exe"C:\Users\Admin\Desktop\No Escape.exe"2⤵
- Drops file in Program Files directory
PID:1404 -
C:\Windows\System32\wscript.exe"C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\F090.tmp\F091.tmp\F092.vbs //Nologo3⤵PID:5084
-
-
-
C:\Users\Admin\Desktop\dnSpy.Console.exe"C:\Users\Admin\Desktop\dnSpy.Console.exe"1⤵PID:3320
-
C:\Users\Admin\Desktop\dnSpy.Console.exe"C:\Users\Admin\Desktop\dnSpy.Console.exe"1⤵PID:2780
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\ReadTest.jfif" /ForceBootstrapPaint3D1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5032
-
C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe"C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe" -ServerName:Microsoft.MSPaint.AppX437q68k2qc2asvaagas2prv9tjej6ja9.mca1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2680
-
C:\Users\Admin\Desktop\No Escape.exe"C:\Users\Admin\Desktop\No Escape.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2080 -
C:\Windows\System32\wscript.exe"C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\C37B.tmp\C37C.tmp\C37D.vbs //Nologo2⤵PID:200
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120B
MD5255a8e245b6ad378558b90cbe3dbc3d0
SHA16eb73f9f2034c113a2a6b1aab9a440a21928cfc2
SHA256d3195bde888f9b8a71f2eb840222f1586b652d0ede9f39841a180ead03633ca9
SHA51267e03d7bffa0dec32535b6da46d5b7f38d94a7c9a231aa2fa625b81485d41c1ecac95b08fe5b7a605fcfe1c7e37c55ee716c9045df90ea6e030b86e52ec09edf
-
Filesize
10KB
MD5918e75eccb1e25e1d73994b975ef252c
SHA122b2a0823c0e8109323a405906bd5abe1df7319b
SHA256cba73a620b7d4143830320f0878a473d1195d2c8aeee65f0aeee235a689de48c
SHA512333208195dc4dba0abb357a53d77593f9818822187f7da86db1dda423e02d4d68fd77044b21d18808bd8acfae4e93d7c41bf34f1c29f78e5ba5d642cd6587147
-
Filesize
1KB
MD5b86fddd2b764f079615be5d4dc3e158d
SHA12510479054db1fe52cc2dcd3c7033d91204cb367
SHA2562b2114784d15b0b0d5475256851b4d0d4da7181198c2a93a304ecedb98eaf091
SHA512915363bc9f6e665358c8d25f5f5f51d64c53cb755be999013217162b126705ce641ea809047bc84511db7e3e383b848ec3932924baa8926d51a51d0037a5ca63
-
Filesize
110KB
MD5057ea45c364eb2994808a47b118556a2
SHA11d48c9c15ea5548af1475b5a369a4f7b8db42858
SHA2566e1115188aa00fb5ff031899100bacb0d34819707e069bca3eb53935ebb39836
SHA512582c7ecf2d0c33c8706ff3f39aa926780aa8f0dc0ff5d563905a5100254b81b89def22206abee0871ab339a3d463de9e6ec1782d92198e8f386f173654b6e760
-
Filesize
3KB
MD581427e9d5d10657b9edffd22e7b405bb
SHA1f27ab62f77f827dbb32c66a35ac48006c47f4374
SHA256bb21001c1c468e6e372d836952c3efb7fbdc98e9a20a1bfdcc4beb1b7a1e7f83
SHA512b0ee65bcef13be7c17db6e06b96cd44774fcebe6f4a411b0073493ff53f795e3b7c49e921c3bd2e41256638bc161f5218d1c51b589c3e10164f8f2c0d1db1592
-
Filesize
92KB
MD5b4acc41d0e55b299ffeec11a8a20cf08
SHA1bbee20882bdd9dcd24b54b6af6c48cf5efc8c6fa
SHA25634bc0d5b6029a74b9cda56b72434ec1b55b6742ff5ef832d36027a987a63cd42
SHA512d4fa9900d703ea12d508929718433f97581a23b63458e5070ff7749871a7f60889db45098ec2972687b864ba97ab4fc307e8c80c4450dee79c0a5738818d2794
-
Filesize
514KB
MD5ddcf5d5ce2600c1137445019ed8b465b
SHA149ed7183e91d362fff023ccb51af9a1ea86d9b95
SHA256bfbc70655122e7f6d11ec954d8e2836771ad6aec78e70a5564d03202de4f07a3
SHA51215b3f91cf370b6742041a5dcec4395193ed0f45546a9bd7109f9e699be8c133472630f8193e5c7e97566048e66478e99fdbc10af077d6f9212dfbd6ad0839d69
-
Filesize
9KB
MD5331a0667b11e02330357565427dc1175
SHA1d84c1ae0bf2c8ca1f433f0086ca86e07f61204c2
SHA256fc7174e44a1d34040c3bc05ce24e648742a38a3accce22e8300d7059e4d12431
SHA5121c47f0438dce58d473d93c10f233650df3e86d7e762a08b3a933da37683e76a079d275db4a1b4028d903f7e43f487173ba8bb25c4cff6f3e1161d0a5b2b18cec
-
Filesize
10KB
MD53cf9a7a431df42a5758133da6236ea8c
SHA1fffc40f796107f69c367d9381bb45d0902459f5e
SHA256bf21063cbd788f2dcd06b5fe925e9a2bc5f26fdd6869c6260464e8cc6e0cfb60
SHA51220909c792d5ba7a0f2b86f7e5fe6d7d91d5674be5108378cd26c11fb5688d5ceeee0a960e72f7b59d6db80f693f637af6c19b89491b97ea918e996ff200d76bb
-
Filesize
10KB
MD5414b8d5fe6f1884a9c7d2091b03f8057
SHA1cd9ebd4dde7f57386d1cf74799a09bca6c42d4a1
SHA256993bb01dbdea38e63ff38b27907d0955e45a9cb340fd2e3f335e928b5e051172
SHA512d8ec34e14f00403341fcb7ee3b3ba6ea2e400fac3cd6258d6de1180ddd21fd3d5efaf1b0d43ca3172e9e4b7735d4ba36964253bc9992924a9cf9f24a7f1be7d8
-
Filesize
2KB
MD54743f1d652cf490ba84528b86c8bb0fe
SHA15924713021cc692a58fc7addebb8ec3dfbbdb6e3
SHA2568d094f37e8ef846cca39841a6651906a7089d3be817386fa7e1fbaac9d9f4b50
SHA512230484082eb79cf5015ce11ae921f3aaf9eee340512da846866d5f0c1ad550a0dc72f814c12dc2556d99a2dd597327875a78d6550e2c29969b13adad8fe33d98
-
Filesize
264KB
MD5672243ce3ceb7937f9cb2cf639bf5d1a
SHA17581253e6e141a3067be79aad72b5a140a6a465c
SHA256eaf127a759d70e3aa058c44027457892195d9c7dc5005f8e6c103bb71d477438
SHA51275fdea3edc9d359daf7f95b8bc1bf95bfc5df05df050c6c72e981af2ae082fce3ec9d48eab02995b992574f3371fa211fdd1411577c280c96ec2d765101e0b7a
-
Filesize
1KB
MD536434d4f33b3e74535a4ec27c9165841
SHA1ee7fc4e89eb7f546390cdb80c28739881c8b3523
SHA25619488f4dab722d120859e1f43f351dbef27f195b529d9efc04baabf1355621b4
SHA512e1a4202071b5462ebedd4848fa218736cec049321c36c892e15a49dec4346d358ac5039252694a6dd07d41ee8e652a403fc7d4e70bd216f30f598ddd413624cb
-
Filesize
2KB
MD5b396ec8a983ecefff0789d55d1afc619
SHA19b83b7b3266886162c6b416d2c2b4eacf25f1219
SHA25686ebc8a8daeea4903b293035aaf59b0d5e575569a514d5f06d6626db5ef14e2e
SHA5127f39de9c96f8092867e88306fd257841095626353003fc4892d7894db7b6ebc7cf599dd25d62b00e8a787931c2910d857b3ee96bbcdcd277540a2d1dd2bc1759
-
Filesize
1KB
MD58301c335c4a9db22059722cf30a5e752
SHA1dca59b2cbf22b5687a0b7de19fac976cfb3eed4d
SHA256c392c1cf087c38c686c1fae50f062395272da6791c964e43bf3a05d6a236e124
SHA5125a36182ab10b2b4535be7c2d0c18e4b7c018175faf183c20130e79547e03fc4db6229c3f952f7002ff211fa8ee4af51644037ce3a3427c6feac6dfd132a8680b
-
Filesize
1KB
MD5eb35cefeeb25c85f34767189388a953e
SHA158250e239ef9049a250d3d3ad01ceedd1a7856b4
SHA256c8d4ef2e55a90435a86438cfc126d0f101898d8f1263778d97a0a7646f52705a
SHA51210a21975bda9cf6afd7fc3849adf41df4569e7f9643a5b19d45a79160334cd4feb57bbe9075ae18683ccbc15dc7cb32a55ca05f6fd44a6cc56a1d4fea27c8cae
-
Filesize
6KB
MD532b06a5e05326d12c0edca589dc64044
SHA11462285936632cd753fda69938ef0840f7ebc8ab
SHA256c6d900c2427a63ddf9f9ce3f4434e429a41bdc1ce604a687739666ff61a1b04d
SHA5124a61fc5d3f91ab35ac2a15e40f0a711395b2495ecd8aa8b8aa94d270f8a81d86c1ae46d046a63b3cdf0c49b2db1dbdd1a1f928b59ecced3413e6af6301c0988c
-
Filesize
6KB
MD50c26bb7bc4709e45c6cb3a08f01d8541
SHA199dcd3f409d646636d70e20178968594fd984818
SHA256c53c3e00d8609adc1068a3f5f5eb98de5c70eb4c1be10186ff82e11810cb4313
SHA5126170d84f419468962d4f5c7c9d964cd740f6986c6d09afc4447f6af0561f5372bf42dfabea671e6998bb7b68d33b027b29e42cd40334f6c74eff581be9557f2c
-
Filesize
5KB
MD525a032c33b74ee11c7819effab118b1d
SHA123f11bc50c7f5f1516eef06f3c5f4b60d263c27b
SHA256f33c77cc997c04633278a5a55e58bc9230d6fe9935544005f7a1c6383be33c25
SHA51204d58eb6f34b1c1bb9ecf7773e309711b1bf5a26175775f2fd9d1301119fa2297517977e169c1d69fc671cb0e6ead84335720159b8026e63adb978c4b7ccef84
-
Filesize
5KB
MD590502bbb28b805a355487a578f826227
SHA1e644baf33d0bb712273ac41cf1937e823a6482d8
SHA25683a2b1698e8803d0cc3e1ef9e77104124a48bfeeb305674a16ad0ce4ecd63b9e
SHA51214b33494b05b5cc861e51586748be7508c48650b7d3bbcab994f0e8c27fc500395094540e677918bff15864e25f213fb056ad1b765e15cab6e79434ff408b7c4
-
Filesize
12KB
MD5d5eda6f7bc8d35da4f0d14baebe36f5f
SHA1a637c548698edf66feecd8d8ae696e855f048278
SHA25660cfe7f177baaf3e797ee2fb9e12380e1db70bf82d5eb20c4ceb86a2556d4a8c
SHA512e93ea4c574745c54ea38dc33603b12c6503d8f41ad450eea410b089e8bfc8ab79cce52e7b434c19167db3bdf995cb9aff52d7ee99cf1a0de814dfc8843e6a900
-
Filesize
277KB
MD566a60a681141a5bff9a5ac393055b27f
SHA155bc1fe0fec29491c64f4daf06e9a647b284265e
SHA2563de6b39041b742b0567a1ccb53b8863f41c9160564340f5b84c9144f7b8565f1
SHA5123163935d9eedfb0cd7aee0ccc818fb1bb01a4b45bf802043fe04877849679f5578ee75b0bd9d1d84591b89073e2cda04e277ee212a58ea06c4efeec2c42f8fbf
-
Filesize
278KB
MD508c88b5426e2c8afc21c5f9bbbed8173
SHA1ad8501208effe94440e032396d884ed1b783465a
SHA2566d152c6cb9208beee78e41c9a812277190fecd3210f21980b49d058615b4ef9a
SHA5123e0b28dfe6b1cbc21230912c68f94b7411e421e7b6b5fe13ad02724b17e817a21cdb27d1e611e4a1a2bf85a346960b66e397573e618bb326249cfa72bf4fb6dd
-
Filesize
98KB
MD5c8034626e49ce89c653bb2971f37a65e
SHA17afbd21d54ee65f6820b6b888d0f6f8d7bc3c959
SHA256e04bc7de1f01e6ada9de0b238c0169c73bef03031ade70b6feefadc797ff5f70
SHA5129b457cf048ba694161ffbd44a571bacad0bad42251ee3183847a8903a0d749d2bed021b4f25225c84b6e6d8b4ccccfae83f06ef8a707b4a676c55442923eee26
-
Filesize
105KB
MD5939bbacc9101e87e62b3c058eb90f0e6
SHA18a794f8a8cd71c2d5ef05b0adb8cb92d1e933ff4
SHA2566b3a8b4b34b7c5365fe8d6f00324b62548750ac24af183f05b083468049ac361
SHA512e2f945ff7ae1cf8c24bff793411e2f508d55f9b9e7314820648837154448e403fa88670350f963de74f0181a53d05067b0bf1db8b9baf478ab2b11132b5f7779
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json
Filesize2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json
Filesize233B
MD58a905436e93b70cb2d01a128bb958829
SHA1d8275216e7de3489a3414f842375003829421687
SHA256aa3cea12a708e640b12d87d7f3d91ba54f7f654f34c2b6659a509f311f647b92
SHA512a8c3e1ee8481a3dc0e5464b50670551398d74f94eff5e97ca82fcee2bcadfe144ae98537fd15c9a3951b154a3fe9da43c87d1b88ed56ae01d6e76d5989572b64
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\cloudCommunitySettings.json
Filesize2KB
MD5404a3ec24e3ebf45be65e77f75990825
SHA11e05647cf0a74cedfdeabfa3e8ee33b919780a61
SHA256cc45905af3aaa62601a69c748a06a2fa48eca3b28d44d8ec18764a7e8e4c3da2
SHA512a55382b72267375821b0a229d3529ed54cef0f295f550d1e95661bafccec606aa1cd72e059d37d78e7d2927ae72e2919941251d233152f5eeb32ffdfc96023e5
-
Filesize
588B
MD567706bca9ceaba11530e05d351487003
SHA13a5ed77f81b14093a5f18c4d46895bc7ea770fee
SHA256190a0d994512ed000cf74bd40fb0502988c2ac48855b23a73fd905c0305fc30f
SHA512902ac91678d85801a779acbc212c75beba72f8da996b0ed1b148a326c2dd635b88210f9a503fbbffa5271335483eae972e6a00acbc01ec013cf355c080444598
-
Filesize
732KB
MD59172731ba3f16b578bcb14000ccbccd4
SHA1e7ab716661ed88ecf060dc5d53720877b141eac9
SHA256ce0a32e35b7c79e7e2ffe7bd3c7566a6fb843341268ad50f4a594e56e17a5110
SHA5123a35995b6dadf408ca69699220120bba5f70fb3c2a850165ab11dad03821c8ce316bf7e9662f8976e0bf659cdb9adf0c8d0d7beca22b59480e4830dc5e02666c