Analysis
-
max time kernel
37s -
max time network
33s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 11:11
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://drive.google.com/file/d/15q9r0-AsdsD7e68_iUmk4tlfLvGkXtQT/view?usp=sharing
Resource
win10v2004-20240426-en
General
-
Target
https://drive.google.com/file/d/15q9r0-AsdsD7e68_iUmk4tlfLvGkXtQT/view?usp=sharing
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
main.exemain.exemain.exemain.exepid Process 3132 main.exe 2116 main.exe 4944 main.exe 2464 main.exe -
Loads dropped DLL 38 IoCs
Processes:
main.exemain.exepid Process 2116 main.exe 2116 main.exe 2116 main.exe 2116 main.exe 2116 main.exe 2116 main.exe 2116 main.exe 2116 main.exe 2116 main.exe 2116 main.exe 2116 main.exe 2116 main.exe 2116 main.exe 2116 main.exe 2116 main.exe 2116 main.exe 2116 main.exe 2116 main.exe 2116 main.exe 2464 main.exe 2464 main.exe 2464 main.exe 2464 main.exe 2464 main.exe 2464 main.exe 2464 main.exe 2464 main.exe 2464 main.exe 2464 main.exe 2464 main.exe 2464 main.exe 2464 main.exe 2464 main.exe 2464 main.exe 2464 main.exe 2464 main.exe 2464 main.exe 2464 main.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Detects Pyinstaller 1 IoCs
Processes:
resource yara_rule behavioral1/files/0x000700000002344e-105.dat pyinstaller -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133618866970186007" chrome.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
chrome.exetaskmgr.exepid Process 1068 chrome.exe 1068 chrome.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
Processes:
chrome.exepid Process 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exemain.exemain.exedescription pid Process Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeDebugPrivilege 2116 main.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeDebugPrivilege 2464 main.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe -
Suspicious use of FindShellTrayWindow 55 IoCs
Processes:
chrome.exetaskmgr.exepid Process 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe -
Suspicious use of SendNotifyMessage 44 IoCs
Processes:
chrome.exetaskmgr.exepid Process 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid Process procid_target PID 1068 wrote to memory of 4676 1068 chrome.exe 81 PID 1068 wrote to memory of 4676 1068 chrome.exe 81 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 908 1068 chrome.exe 83 PID 1068 wrote to memory of 2760 1068 chrome.exe 84 PID 1068 wrote to memory of 2760 1068 chrome.exe 84 PID 1068 wrote to memory of 4948 1068 chrome.exe 85 PID 1068 wrote to memory of 4948 1068 chrome.exe 85 PID 1068 wrote to memory of 4948 1068 chrome.exe 85 PID 1068 wrote to memory of 4948 1068 chrome.exe 85 PID 1068 wrote to memory of 4948 1068 chrome.exe 85 PID 1068 wrote to memory of 4948 1068 chrome.exe 85 PID 1068 wrote to memory of 4948 1068 chrome.exe 85 PID 1068 wrote to memory of 4948 1068 chrome.exe 85 PID 1068 wrote to memory of 4948 1068 chrome.exe 85 PID 1068 wrote to memory of 4948 1068 chrome.exe 85 PID 1068 wrote to memory of 4948 1068 chrome.exe 85 PID 1068 wrote to memory of 4948 1068 chrome.exe 85 PID 1068 wrote to memory of 4948 1068 chrome.exe 85 PID 1068 wrote to memory of 4948 1068 chrome.exe 85 PID 1068 wrote to memory of 4948 1068 chrome.exe 85 PID 1068 wrote to memory of 4948 1068 chrome.exe 85 PID 1068 wrote to memory of 4948 1068 chrome.exe 85 PID 1068 wrote to memory of 4948 1068 chrome.exe 85 PID 1068 wrote to memory of 4948 1068 chrome.exe 85 PID 1068 wrote to memory of 4948 1068 chrome.exe 85 PID 1068 wrote to memory of 4948 1068 chrome.exe 85 PID 1068 wrote to memory of 4948 1068 chrome.exe 85 PID 1068 wrote to memory of 4948 1068 chrome.exe 85 PID 1068 wrote to memory of 4948 1068 chrome.exe 85 PID 1068 wrote to memory of 4948 1068 chrome.exe 85 PID 1068 wrote to memory of 4948 1068 chrome.exe 85 PID 1068 wrote to memory of 4948 1068 chrome.exe 85 PID 1068 wrote to memory of 4948 1068 chrome.exe 85 PID 1068 wrote to memory of 4948 1068 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/15q9r0-AsdsD7e68_iUmk4tlfLvGkXtQT/view?usp=sharing1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab507ab58,0x7ffab507ab68,0x7ffab507ab782⤵PID:4676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1944,i,6666809361100439184,4957424958047764281,131072 /prefetch:22⤵PID:908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1944,i,6666809361100439184,4957424958047764281,131072 /prefetch:82⤵PID:2760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2264 --field-trial-handle=1944,i,6666809361100439184,4957424958047764281,131072 /prefetch:82⤵PID:4948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3016 --field-trial-handle=1944,i,6666809361100439184,4957424958047764281,131072 /prefetch:12⤵PID:2172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3024 --field-trial-handle=1944,i,6666809361100439184,4957424958047764281,131072 /prefetch:12⤵PID:5716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4512 --field-trial-handle=1944,i,6666809361100439184,4957424958047764281,131072 /prefetch:12⤵PID:5528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 --field-trial-handle=1944,i,6666809361100439184,4957424958047764281,131072 /prefetch:82⤵PID:4248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 --field-trial-handle=1944,i,6666809361100439184,4957424958047764281,131072 /prefetch:82⤵PID:1896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4956 --field-trial-handle=1944,i,6666809361100439184,4957424958047764281,131072 /prefetch:12⤵PID:5076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4716 --field-trial-handle=1944,i,6666809361100439184,4957424958047764281,131072 /prefetch:12⤵PID:312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 --field-trial-handle=1944,i,6666809361100439184,4957424958047764281,131072 /prefetch:82⤵PID:5416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5460 --field-trial-handle=1944,i,6666809361100439184,4957424958047764281,131072 /prefetch:82⤵PID:6084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5508 --field-trial-handle=1944,i,6666809361100439184,4957424958047764281,131072 /prefetch:82⤵PID:4324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 --field-trial-handle=1944,i,6666809361100439184,4957424958047764281,131072 /prefetch:82⤵PID:3172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5544 --field-trial-handle=1944,i,6666809361100439184,4957424958047764281,131072 /prefetch:82⤵PID:2828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4064 --field-trial-handle=1944,i,6666809361100439184,4957424958047764281,131072 /prefetch:82⤵PID:1864
-
-
C:\Users\Admin\Downloads\main.exe"C:\Users\Admin\Downloads\main.exe"2⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\Downloads\main.exe"C:\Users\Admin\Downloads\main.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2116
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 --field-trial-handle=1944,i,6666809361100439184,4957424958047764281,131072 /prefetch:82⤵PID:3052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 --field-trial-handle=1944,i,6666809361100439184,4957424958047764281,131072 /prefetch:82⤵PID:4496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 --field-trial-handle=1944,i,6666809361100439184,4957424958047764281,131072 /prefetch:82⤵PID:2240
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:1964
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3568
-
C:\Users\Admin\Downloads\main.exe"C:\Users\Admin\Downloads\main.exe"1⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\Downloads\main.exe"C:\Users\Admin\Downloads\main.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2464
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264B
MD5cbb08d6fcb1c85521c4dfae5be1e86fc
SHA1053561a72aa7755b30383a6d25bb558d44753099
SHA256fdcc715b0fc32fe230bb841e3208dd7bcc75a2956061fb2e0eca12768951fe98
SHA5123f2f4a2a6c5289aa5c94beab5e26d22f0ee7df84c2e6335d8e04ecab3403db3e4a8aeb11875159dff546c73f1df28cf8809042c1239c5141ca9ce6adbb08f5c8
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
857B
MD56d92a5d8e82ca8c734a128e923801a6f
SHA1acaee614f5140246c6b750ca1575df7d05087d14
SHA256231857fa61f135a18d1e267f493dc12dd2a6693e482dfead6ab7906f3f5913cc
SHA512b1beb65796a568e4417a413f8217a8f005347f003349b29937b1032681009c8b68dd3170412c417a8e08c7961de991741d5dc1c06d4a21277627eea19c7078ed
-
Filesize
7KB
MD5785045994431f9cb89afadb42cd8eec9
SHA15dd9b43a03c86e43c15277ad5e6fb8564bf93903
SHA2563b2fdeb649aeed3f35f958d03e0ce3d28aebc48ae291623c7f16a1faebe15b2c
SHA512e70d8a2fe8b6ae2ad73ece5ce7ea74e7c20f0f11c6d0ad3f51f9220b15e4764372c624a1d04ab5943c2b69317310eed0a70da69bc08cafd03bef21ce3a0ca344
-
Filesize
7KB
MD5d9b274e857eda0923cc2caedde825d2d
SHA1402df97322c9e25e0737947a63e2a683dfdd6ed1
SHA2566ac673e1419b0fa8dafaa89a41a83acc16bf563191b75211a8e2df299b439279
SHA51265f78d4c9f9f235f7fb0dc09d07bec572d8d7f94ef0c3d5e468a1b4229461c8b1bfa4b0907cfcaa34263d9ab6ea8238321d7da679b82719fe47ea6bf16a2a1e5
-
Filesize
7KB
MD5d74e8fe2666ab02dd1b061149bc7f43e
SHA1bbfbee436a4202c2156d893c3c40e8f07c09d4dd
SHA256ce1cf143b996871ace751c5b5cff10ed664b015c8f26dd273cad4d6d73dfa86e
SHA51271ae17db687c5c0826eb21f25d324184c099926100643cd6243d8f32936c9bce6844338b89a157af5b8ee3cfbe1f8a3fcdafffcf482394134c99423b1b2dffd9
-
Filesize
131KB
MD55b0568d6a5b4b92a07d479ead8bab831
SHA1608e0efbb0a380f662637d1c32b4f1f7c5c8953e
SHA256cd5484cb332ebb4cbf531f2f23063437d81b98a09c899c77da74cc3622106b30
SHA512dc8409f936fa24f97ff0d5698c9e7967416482b4a28e22fa064dc92f5bd004f452239d416763108c5e6422725a3e5084e3b3f629391228e8111bb5f6b3774478
-
Filesize
132KB
MD515aebff15e1ccd3259d20d4062c2d70d
SHA1bbbaba5613865db6a2de3996a2238b629586cd66
SHA256c158f7b717c77002676d0fbf932c7c03dfc9fc67f8fd4e6e994e30bdc9709e9a
SHA51210094f89def3c8b4d6366f2119d17f72b089f0258884bea23cb97905ae9825aac8b9c5649389871c494900bf886a2ae0a5f3ca3eaa2e6ef41ad828ddd3bd9f89
-
Filesize
132KB
MD56813c71d5df2c3d2e059ce5f8b6e1c36
SHA1072db61a5a3373f4ef595955a4111f28252c8e30
SHA2561200d3bfaa8e32ff2e0646db6557e42df64e689cc9b71d687984a48ada61ce7c
SHA512a45d3a8ab7a738a06c8ad6f139924ed4cb29e81d19a9cb59f2d17f988145bb73267a11bfb37d3cd97de531be8bc94c0a678f8d78e6f8fc3a402914c648d53a23
-
Filesize
116KB
MD5be8dbe2dc77ebe7f88f910c61aec691a
SHA1a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA2564d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA5120da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
-
Filesize
48KB
MD5f8dfa78045620cf8a732e67d1b1eb53d
SHA1ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA256a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
SHA512ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371
-
Filesize
83KB
MD5223fd6748cae86e8c2d5618085c768ac
SHA1dcb589f2265728fe97156814cbe6ff3303cd05d3
SHA256f81dc49eac5ecc528e628175add2ff6bda695a93ea76671d7187155aa6326abb
SHA5129c22c178417b82e68f71e5b7fe7c0c0a77184ee12bd0dc049373eace7fa66c89458164d124a9167ae760ff9d384b78ca91001e5c151a51ad80c824066b8ecce6
-
Filesize
122KB
MD5bbd5533fc875a4a075097a7c6aba865e
SHA1ab91e62c6d02d211a1c0683cb6c5b0bdd17cbf00
SHA256be9828a877e412b48d75addc4553d2d2a60ae762a3551f9731b50cae7d65b570
SHA51223ef351941f459dee7ed2cebbae21969e97b61c0d877cfe15e401c36369d2a2491ca886be789b1a0c5066d6a8835fd06db28b5b28fb6e9df84c2d0b0d8e9850e
-
Filesize
245KB
MD53055edf761508190b576e9bf904003aa
SHA1f0dc8d882b5cd7955cc6dfc8f9834f70a83c7890
SHA256e4104e47399d3f635a14d649f61250e9fd37f7e65c81ffe11f099923f8532577
SHA51287538fe20bd2c1150a8fefd0478ffd32e2a9c59d22290464bf5dfb917f6ac7ec874f8b1c70d643a4dc3dd32cbe17e7ea40c0be3ea9dd07039d94ab316f752248
-
Filesize
64KB
MD5eedb6d834d96a3dffffb1f65b5f7e5be
SHA1ed6735cfdd0d1ec21c7568a9923eb377e54b308d
SHA25679c4cde23397b9a35b54a3c2298b3c7a844454f4387cb0693f15e4facd227dd2
SHA512527bd7bb2f4031416762595f4ce24cbc6254a50eaf2cc160b930950c4f2b3f5e245a486972148c535f8cd80c78ec6fa8c9a062085d60db8f23d4b21e8ae4c0ad
-
Filesize
156KB
MD505e8b2c429aff98b3ae6adc842fb56a3
SHA1834ddbced68db4fe17c283ab63b2faa2e4163824
SHA256a6e2a5bb7a33ad9054f178786a031a46ea560faeef1fb96259331500aae9154c
SHA512badeb99795b89bc7c1f0c36becc7a0b2ce99ecfd6f6bb493bda24b8e57e6712e23f4c509c96a28bc05200910beddc9f1536416bbc922331cae698e813cbb50b3
-
Filesize
81KB
MD5dc06f8d5508be059eae9e29d5ba7e9ec
SHA1d666c88979075d3b0c6fd3be7c595e83e0cb4e82
SHA2567daff6aa3851a913ed97995702a5dfb8a27cb7cf00fb496597be777228d7564a
SHA51257eb36bc1e9be20c85c34b0a535b2349cb13405d60e752016e23603c4648939f1150e4dbebc01ec7b43eb1a6947c182ccb8a806e7e72167ad2e9d98d1fd94ab3
-
Filesize
24KB
MD5353e11301ea38261e6b1cb261a81e0fe
SHA1607c5ebe67e29eabc61978fb52e4ec23b9a3348e
SHA256d132f754471bd8a6f6d7816453c2e542f250a4d8089b657392fe61a500ae7899
SHA512fa990b3e9619d59ae3ad0aeffca7a3513ab143bfd0ac9277e711519010f7c453258a4b041be86a275f3c365e980fc857c23563f3b393d1e3a223973a673e88c5
-
Filesize
35KB
MD57ec3fc12c75268972078b1c50c133e9b
SHA173f9cf237fe773178a997ad8ec6cd3ac0757c71e
SHA2561a105311a5ed88a31472b141b4b6daa388a1cd359fe705d9a7a4aba793c5749f
SHA512441f18e8ce07498bc65575e1ae86c1636e1ceb126af937e2547710131376be7b4cb0792403409a81b5c6d897b239f26ec9f36388069e324249778a052746795e
-
Filesize
1.3MB
MD58dad91add129dca41dd17a332a64d593
SHA170a4ec5a17ed63caf2407bd76dc116aca7765c0d
SHA2568de4f013bfecb9431aabaa97bb084fb7de127b365b9478d6f7610959bf0d2783
SHA5122163414bc01fc30d47d1de763a8332afe96ea7b296665b1a0840d5197b7e56f4963938e69de35cd2bf89158e5e2240a1650d00d86634ac2a5e2ad825455a2d50
-
Filesize
5.0MB
MD5e547cf6d296a88f5b1c352c116df7c0c
SHA1cafa14e0367f7c13ad140fd556f10f320a039783
SHA25605fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
SHA5129f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d
-
Filesize
38KB
MD50f8e4992ca92baaf54cc0b43aaccce21
SHA1c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA5126e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
-
Filesize
65KB
MD53cba71b6bc59c26518dc865241add80a
SHA17e9c609790b1de110328bbbcbb4cd09b7150e5bd
SHA256e10b73d6e13a5ae2624630f3d8535c5091ef403db6a00a2798f30874938ee996
SHA5123ef7e20e382d51d93c707be930e12781636433650d0a2c27e109ebebeba1f30ea3e7b09af985f87f67f6b9d2ac6a7a717435f94b9d1585a9eb093a83771b43f2
-
Filesize
66KB
MD579b02450d6ca4852165036c8d4eaed1f
SHA1ce9ff1b302426d4c94a2d3ea81531d3cb9e583e4
SHA256d2e348e615a5d3b08b0bac29b91f79b32f0c1d0be48976450042462466b51123
SHA51247044d18db3a4dd58a93b43034f4fafa66821d157dcfefb85fca2122795f4591dc69a82eb2e0ebd9183075184368850e4caf9c9fea0cfe6f766c73a60ffdf416
-
Filesize
6.6MB
MD53c388ce47c0d9117d2a50b3fa5ac981d
SHA1038484ff7460d03d1d36c23f0de4874cbaea2c48
SHA256c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb
SHA512e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35
-
Filesize
131KB
MD526d752c8896b324ffd12827a5e4b2808
SHA1447979fa03f78cb7210a4e4ba365085ab2f42c22
SHA256bd33548dbdbb178873be92901b282bad9c6817e3eac154ca50a666d5753fd7ec
SHA51299c87ab9920e79a03169b29a2f838d568ca4d4056b54a67bc51caf5c0ff5a4897ed02533ba504f884c6f983ebc400743e6ad52ac451821385b1e25c3b1ebcee0
-
Filesize
29KB
MD592b440ca45447ec33e884752e4c65b07
SHA15477e21bb511cc33c988140521a4f8c11a427bcc
SHA256680df34fb908c49410ac5f68a8c05d92858acd111e62d1194d15bdce520bd6c3
SHA51240e60e1d1445592c5e8eb352a4052db28b1739a29e16b884b0ba15917b058e66196988214ce473ba158704837b101a13195d5e48cb1dc2f07262dfecfe8d8191
-
Filesize
1.1MB
MD516be9a6f941f1a2cb6b5fca766309b2c
SHA117b23ae0e6a11d5b8159c748073e36a936f3316a
SHA25610ffd5207eeff5a836b330b237d766365d746c30e01abf0fd01f78548d1f1b04
SHA51264b7ecc58ae7cf128f03a0d5d5428aaa0d4ad4ae7e7d19be0ea819bbbf99503836bfe4946df8ee3ab8a92331fdd002ab9a9de5146af3e86fef789ce46810796b
-
Filesize
130KB
MD53a80fea23a007b42cef8e375fc73ad40
SHA104319f7552ea968e2421c3936c3a9ee6f9cf30b2
SHA256b70d69d25204381f19378e1bb35cc2b8c8430aa80a983f8d0e8e837050bb06ef
SHA512a63bed03f05396b967858902e922b2fbfb4cf517712f91cfaa096ff0539cf300d6b9c659ffee6bf11c28e79e23115fd6b9c0b1aa95db1cbd4843487f060ccf40
-
Filesize
140KB
MD5d76ddfd0d46141734b7bfbb0f9b88a09
SHA1fe41a62ce3bf5c2e55a2f2b4fdb4ad64e9f07717
SHA256eaa7853b725db0b12aa350f43258fceb81b3a2fcadbbc3d0d9abd1aa4fde1467
SHA512b317bb9eb178be617077ff798b4ef76eb332cc5ab62b3d4bb9e11f2e138cd3fa73676269a279be66951bf6b14bd97026a1c9f6394c14d19dc9134267fd82aa75
-
Filesize
21KB
MD52d6ad8f5e8961ad6c19bac56093c84f0
SHA18060e01378de33df80320f3a3c1158c9f61f9ff3
SHA2567892119c9e4b815c07b93d2bc8f7310b16064734a99affae694ca6b81b5ea0b4
SHA51263177b3273ca0687035c7226a70e590ae36385ed5c28e9d793ea393e528685f88496f9f921a39f304aa7f83f9774d33f04f1d49124ac8c50842e76634a389a36
-
Filesize
7.5MB
MD5388711eadc901d35669b16882db51d15
SHA13ad43cb4ed12f29f5b8a665a4967a8249d60f083
SHA2560afe53f6051beae18a8f61544082a99ba90bbe167485301292bd1a7e57b5c412
SHA5123621a5c3a4a3e1ba0ecd4352c3ee85d0880264be58973b46efc51110c38352bafeba42396d86a85fd0f2d4cf4044dd8cb3f5ad5899f340283519a703150c9c5b
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e