Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
31/05/2024, 09:09
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://verify.doublecounter.gg/v/01642vla1
Resource
win10v2004-20240426-en
General
-
Target
https://verify.doublecounter.gg/v/01642vla1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133616202328027196" chrome.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 5512 msedge.exe 5512 msedge.exe 4608 msedge.exe 4608 msedge.exe 4388 identity_helper.exe 4388 identity_helper.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 2924 msedge.exe 2924 msedge.exe 2924 msedge.exe 2924 msedge.exe -
Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 656 Process not Found -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
pid Process 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe Token: SeShutdownPrivilege 392 chrome.exe Token: SeCreatePagefilePrivilege 392 chrome.exe -
Suspicious use of FindShellTrayWindow 51 IoCs
pid Process 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 4608 msedge.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe 392 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4608 wrote to memory of 5064 4608 msedge.exe 84 PID 4608 wrote to memory of 5064 4608 msedge.exe 84 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 3596 4608 msedge.exe 85 PID 4608 wrote to memory of 5512 4608 msedge.exe 86 PID 4608 wrote to memory of 5512 4608 msedge.exe 86 PID 4608 wrote to memory of 4780 4608 msedge.exe 87 PID 4608 wrote to memory of 4780 4608 msedge.exe 87 PID 4608 wrote to memory of 4780 4608 msedge.exe 87 PID 4608 wrote to memory of 4780 4608 msedge.exe 87 PID 4608 wrote to memory of 4780 4608 msedge.exe 87 PID 4608 wrote to memory of 4780 4608 msedge.exe 87 PID 4608 wrote to memory of 4780 4608 msedge.exe 87 PID 4608 wrote to memory of 4780 4608 msedge.exe 87 PID 4608 wrote to memory of 4780 4608 msedge.exe 87 PID 4608 wrote to memory of 4780 4608 msedge.exe 87 PID 4608 wrote to memory of 4780 4608 msedge.exe 87 PID 4608 wrote to memory of 4780 4608 msedge.exe 87 PID 4608 wrote to memory of 4780 4608 msedge.exe 87 PID 4608 wrote to memory of 4780 4608 msedge.exe 87 PID 4608 wrote to memory of 4780 4608 msedge.exe 87 PID 4608 wrote to memory of 4780 4608 msedge.exe 87 PID 4608 wrote to memory of 4780 4608 msedge.exe 87 PID 4608 wrote to memory of 4780 4608 msedge.exe 87 PID 4608 wrote to memory of 4780 4608 msedge.exe 87 PID 4608 wrote to memory of 4780 4608 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://verify.doublecounter.gg/v/01642vla11⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a06c46f8,0x7ff9a06c4708,0x7ff9a06c47182⤵PID:5064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,3024100124358007410,1675094026500253642,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:22⤵PID:3596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,3024100124358007410,1675094026500253642,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,3024100124358007410,1675094026500253642,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:82⤵PID:4780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3024100124358007410,1675094026500253642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:12⤵PID:5484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3024100124358007410,1675094026500253642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:12⤵PID:5232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,3024100124358007410,1675094026500253642,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:82⤵PID:3448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,3024100124358007410,1675094026500253642,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3024100124358007410,1675094026500253642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:12⤵PID:1988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3024100124358007410,1675094026500253642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:12⤵PID:3928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3024100124358007410,1675094026500253642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:12⤵PID:2056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3024100124358007410,1675094026500253642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:12⤵PID:5020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3024100124358007410,1675094026500253642,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:12⤵PID:4200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3024100124358007410,1675094026500253642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:12⤵PID:3012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3024100124358007410,1675094026500253642,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:12⤵PID:2992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,3024100124358007410,1675094026500253642,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2924
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5504
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3460
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:392 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x120,0x124,0xf8,0x128,0x7ff98c49ab58,0x7ff98c49ab68,0x7ff98c49ab782⤵PID:4580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1960,i,6116583289925354889,4301360662143174749,131072 /prefetch:22⤵PID:1288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1960,i,6116583289925354889,4301360662143174749,131072 /prefetch:82⤵PID:4748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2252 --field-trial-handle=1960,i,6116583289925354889,4301360662143174749,131072 /prefetch:82⤵PID:3216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3092 --field-trial-handle=1960,i,6116583289925354889,4301360662143174749,131072 /prefetch:12⤵PID:928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3132 --field-trial-handle=1960,i,6116583289925354889,4301360662143174749,131072 /prefetch:12⤵PID:3452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4324 --field-trial-handle=1960,i,6116583289925354889,4301360662143174749,131072 /prefetch:12⤵PID:1880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4508 --field-trial-handle=1960,i,6116583289925354889,4301360662143174749,131072 /prefetch:82⤵PID:3972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4540 --field-trial-handle=1960,i,6116583289925354889,4301360662143174749,131072 /prefetch:82⤵PID:4976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 --field-trial-handle=1960,i,6116583289925354889,4301360662143174749,131072 /prefetch:82⤵PID:4516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 --field-trial-handle=1960,i,6116583289925354889,4301360662143174749,131072 /prefetch:82⤵PID:4308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4888 --field-trial-handle=1960,i,6116583289925354889,4301360662143174749,131072 /prefetch:82⤵PID:3972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 --field-trial-handle=1960,i,6116583289925354889,4301360662143174749,131072 /prefetch:82⤵PID:5504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 --field-trial-handle=1960,i,6116583289925354889,4301360662143174749,131072 /prefetch:82⤵PID:5060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4548 --field-trial-handle=1960,i,6116583289925354889,4301360662143174749,131072 /prefetch:82⤵PID:1840
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:1984
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57b4f3e951ecea6a0c9509c8e456cf8cf
SHA1ecb150f03892c1f859880846690182aebe34ac37
SHA256df28c0b7ff66b17af7ac9e1e4753c924451cc73363030a3d06b2bf9d63fe3484
SHA5126fdbdcf6506435a476a79ab7f5e2fb39b0691bf6d4c2278f2cb7426d3f2046901e1b25a7c5b303722094194f4e3555141be646735457685f122e605ce1b31917
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
356B
MD55bd397b0e2d73ebe85cdfa9980d6c870
SHA1dd841968dbc79ec8835c31aa18f4f4b9264de0c9
SHA2563ce07c5e90288ceaf8f3ffe26fb06775835f3c3a2b38e0c93e6fd902cee8f8ea
SHA512ef6489c337130d7b67fcf2eedbb5ee4eefbd6937c5eb2204351c6d1ff0fafe791c3b4265a8048400663d9f0fd86252587cb0d8c5180bbd9acf4f24b3d5cccfae
-
Filesize
7KB
MD54215319ce9d28df850d578c6c45b4ece
SHA14bf73c2fd86a5b82385301afd44fc136be81aff7
SHA25622d2cc54225aa9563c8d189dc6ca58f7a3c5e4befda02600c7551eef7e272966
SHA512ea0d0e083aad006fdf45cc973741a75ffd7dbb066747a12a2c975d66cfc2b411434306ddb28b6e7bc89e23bd03ba8f6c000d186b4a27814d386dc4f493aabd44
-
Filesize
16KB
MD557c02490b7644a10748299524805d462
SHA1c6cb7aa12237db3feefe8394a627246c6124a152
SHA256906160cc02ed58e0d517b4c78b202aa4a3ee9143b65676e01056bfe78a8e91c5
SHA512476d24f6024b9a76d964aad75ace8d638be570b0c777ed8c22c1bc0c84d5a1385c5cf4708d7784b4956ed1f6860933acf90f73ed2232a04691cf7dc506abd9f4
-
Filesize
283KB
MD518375958a099bce748b4de7af76deede
SHA131662f5cf3d4bdbe833e4bff0120b2b696bc03b6
SHA256f49297062c488acb72daef7a85ae3ae6415694caa26c6404e19fb557d6c07ca8
SHA512328b01b548c318884b2267939256b52609d728c57381f8a4f232011a4969c908a0c6741a442886e3b6c3d4fc702f80057eaf2e17772645b57cf0895edc823f79
-
Filesize
262KB
MD504132a907daeeb2af6f78be28d93d050
SHA13637e81288ea5e04f2a61f036bff9300b54bc8af
SHA256764bff439eca3db37a56bcbb3973561ad97217b59ed84c168a815444727ecb55
SHA51236cac6c716c0009e48c78ffc4bcbb5b4496e13249c5847fda2278bb1e37b3ce7d9a8543f126e06c980aff9b3fb1687d682011d9518643f004bcb27ca2825d4a7
-
Filesize
131KB
MD5395fafdd4ce1646ae303af095ac02999
SHA154f582e0dde75699d2c9e457fbc557de59de8485
SHA25615226eefeb3b995bebb4c3ed963703d9187e8c5f7e987cb04f6dd5fbbe140990
SHA512c0f1a779f7c69b6098a9470255c55a07bb20eec17ca72b29becb0b8bfba77729926bb087b27a1b392ee74718e3ea63320717283198e2f5efb8a9cd8593845356
-
Filesize
263KB
MD576421760a89728d31d9fb979da3ff955
SHA199cf34fe89b891308a1428f6506850878be79058
SHA256003c7e8a877d4444c303d41004ba5706cdd89fb552d1af3f42b5d21c3b2e21df
SHA5121c66624bdfd7465571774cb35296b3fd9b722ee670ba14fe5b4aed6907a18d25e1ab6ccb00630f6ced91a4658b06b470c2db96d3eeffba56d4ace0455c345314
-
Filesize
92KB
MD57bae98f63f121f852c43af09c2203ea7
SHA17eac1ce47b40b1ceb1311c157dde66a2c58ce114
SHA256752aaa81b5b0528edecea8a2616646552f440a2a3e07e78a09502dab31d396e9
SHA51212c94b1b33d0120f926cbbee10030b4e28f1d916f51cf25c20613ada9d21adc5dd298833dc6d7b04acd590eac52918dc2a259c53b454f086f157cf65e7ade779
-
Filesize
89KB
MD5393d759f3c5e1a0fdef0ae06ae1b6022
SHA1a71f3c51c71476c0f704613b68a373ee1f934c4e
SHA256dbd03ff343cdfabf86ee554193ed2796223435f28b4216d33045811ed2503097
SHA5126d9bbc3f9d093c3bd9f709ad96e2e22d9ec2f31416f0f629540953cfcf4aafde0c19407b932b6ad162dbff9786330320c7ec433621699dcf3fdcad4885379ff3
-
Filesize
152B
MD5ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA2565009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
SHA512e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
-
Filesize
152B
MD5f53207a5ca2ef5c7e976cbb3cb26d870
SHA149a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA25619ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
SHA512be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize288B
MD59c556c1273e6e660648cf780710faa0b
SHA1455aae3753a38c5be04fbd51704b260db5a2029f
SHA2567eadfabfcedaa01f4b4f3ac09d6985fc6b47b4589fbd0df0e97e591f2fe44c25
SHA51211b680992fcf789dd39f1c0846fe4ccc12f0d77b7a4e6ffa070c187a0d7d69cb9367012c1267ed58946b17af59c10f7d2680ba12d1e11b994ec73d45dff486df
-
Filesize
2KB
MD5388a1e4bb4aaf612b8f23e1ff31b88f1
SHA14c697a0480a05ee208ecb2312979a459f118d5e4
SHA256f73a46e2d84b23b475e420b73d13dbfec1ccd3b3b56e0cbeb3d5bbe3bd845ab2
SHA51214915978a745f3503eab3de3c492802e93e06f3f794ac7abda173fd7af5935478a49bce6e74f31ad9a0fad17fd4446b7aaa2211938fa3712621c565ab665c099
-
Filesize
5KB
MD507c527e0f424f479ee2535cd26c0a58e
SHA1ac59081c683b0ad6032b43770c77d7b41b1e68c0
SHA256c6e1be3144ed6ffb00a5c4551c2c8bfb5fd4a4c329531972443eac53960c3262
SHA5120744ffb797b4c2bdddb24a707fb123838dc89bf1e48b91d57cc06428267e64ea9f7806e2a2c706dbc02f2b59f0646e9f4c7e068a6968d2a51e9325997c449ac0
-
Filesize
7KB
MD5af5c1c373badef043f5a5f5aaeaba55f
SHA1ec10cc2131cf3c24a796ced5e1e3576a7eca9e91
SHA25651dc5356109a142b563f2b809bc08ad8604d5bcc80ba1f96935edd431c8d0315
SHA512fa3569e512f8c24efdcea31729023e7f40d49e98d3fdcc44b456eb6f04c9b4092adc887ba50c4eb2f7632f7ef3cef49740ec7d8ad749e87dc3431e82c64c8560
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5c1551209d919a66fd6cdd0427da3e29f
SHA136c56b2ac2b1ed54c59bda1d4822a8ccccc86462
SHA256af108c392a10fcee7e48f0195403f17b1d8fc21df924a19bd45ebe75aff9efeb
SHA512cdffd831dbdd72c214e2963a8092f80ea4d1d9711e81e7559e5095ea243116b87ce7f5ef0239165cc421948a1681f5a882da63f825a27c2cb34300fe3d44df00
-
Filesize
11KB
MD54e460d1863dee391eaa0c7d800ba5846
SHA1e9d062d499780e499ea1c07c827a883463e829c9
SHA2566798b6785f05920ac9757bb8e5cf4b5199aa262fc0964de277ba958d77f89517
SHA5123e31cceee8f52308d7291707de290c0e1402a95ac2e917df325f3e2b4a751eb28d6650c6c6ca18bd11b799bf1793eb22c9848931bbef9bf90f76cc83020fea7c