hxxps://ki[.]tc/file/instrumentality[.]headcount[.]receptacles

Analysis

max time kernel
265s
max time network
263s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
04-06-2024 11:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://ki.tc/file/instrumentality.headcount.receptacles

Score

7^/10

agilenet

Malware Config

Signatures

Obfuscated with Agile.Net obfuscator 3 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/1728-227-0x0000000010390000-0x00000000103BA000-memory.dmp	agile_net
behavioral1/memory/1728-228-0x0000000010410000-0x000000001046A000-memory.dmp	agile_net
behavioral1/memory/1728-230-0x00000000130C0000-0x000000001320A000-memory.dmp	agile_net

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

412 1728 WerFault.exe Flash Counterfeit Bitcoin [FCB] Mode 10.E.exe

pid	pid_target	process	target process
412	1728	WerFault.exe	Flash Counterfeit Bitcoin [FCB] Mode 10.E.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133619743389699222"	chrome.exe

Modifies registry class 2 IoCs

Processes:

MiniSearchHost.exetaskmgr.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings	taskmgr.exe

NTFS ADS 1 IoCs

Processes:

chrome.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Flash Counterfeit Bitcoin [FCB] Mode 10.E (1).zip:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exechrome.exetaskmgr.exe

pid	process
3716	chrome.exe
3716	chrome.exe
4976	chrome.exe
4976	chrome.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

taskmgr.exe

pid process

4868 taskmgr.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

chrome.exe

pid process

3716 chrome.exe
3716 chrome.exe
3716 chrome.exe
3716 chrome.exe
3716 chrome.exe
3716 chrome.exe
3716 chrome.exe
3716 chrome.exe

pid	process
4868	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe
Token: SeShutdownPrivilege	3716	chrome.exe
Token: SeCreatePagefilePrivilege	3716	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe

pid	process
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exetaskmgr.exe

pid	process
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
3716	chrome.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MiniSearchHost.exe

pid process

3992 MiniSearchHost.exe

pid	process
3992	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3716 wrote to memory of 416	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 416	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 2440	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 1256	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 1256	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 4848	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 4848	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 4848	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 4848	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 4848	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 4848	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 4848	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 4848	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 4848	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 4848	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 4848	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 4848	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 4848	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 4848	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 4848	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 4848	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 4848	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 4848	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 4848	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 4848	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 4848	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 4848	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 4848	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 4848	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 4848	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 4848	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 4848	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 4848	3716	chrome.exe	chrome.exe
PID 3716 wrote to memory of 4848	3716	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ki.tc/file/instrumentality.headcount.receptacles
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd156bab58,0x7ffd156bab68,0x7ffd156bab78
2⤵
PID:416

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1676 --field-trial-handle=1776,i,12307878770032481768,6844864932762556467,131072 /prefetch:2
2⤵
PID:2440

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1776,i,12307878770032481768,6844864932762556467,131072 /prefetch:8
2⤵
PID:1256

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2124 --field-trial-handle=1776,i,12307878770032481768,6844864932762556467,131072 /prefetch:8
2⤵
PID:4848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1776,i,12307878770032481768,6844864932762556467,131072 /prefetch:1
2⤵
PID:2904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1776,i,12307878770032481768,6844864932762556467,131072 /prefetch:1
2⤵
PID:3632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4444 --field-trial-handle=1776,i,12307878770032481768,6844864932762556467,131072 /prefetch:8
2⤵
PID:1900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4532 --field-trial-handle=1776,i,12307878770032481768,6844864932762556467,131072 /prefetch:8
2⤵
PID:2332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4936 --field-trial-handle=1776,i,12307878770032481768,6844864932762556467,131072 /prefetch:1
2⤵
PID:728

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5048 --field-trial-handle=1776,i,12307878770032481768,6844864932762556467,131072 /prefetch:1
2⤵
PID:2952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4948 --field-trial-handle=1776,i,12307878770032481768,6844864932762556467,131072 /prefetch:8
2⤵
PID:4916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5248 --field-trial-handle=1776,i,12307878770032481768,6844864932762556467,131072 /prefetch:8
2⤵
PID:4868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2336 --field-trial-handle=1776,i,12307878770032481768,6844864932762556467,131072 /prefetch:1
2⤵
PID:4764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5304 --field-trial-handle=1776,i,12307878770032481768,6844864932762556467,131072 /prefetch:1
2⤵
PID:2796

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3096 --field-trial-handle=1776,i,12307878770032481768,6844864932762556467,131072 /prefetch:1
2⤵
PID:1472

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 --field-trial-handle=1776,i,12307878770032481768,6844864932762556467,131072 /prefetch:8
2⤵
- NTFS ADS
PID:456

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5912 --field-trial-handle=1776,i,12307878770032481768,6844864932762556467,131072 /prefetch:1
2⤵
PID:2716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5700 --field-trial-handle=1776,i,12307878770032481768,6844864932762556467,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4976

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2800

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3152

C:\Users\Admin\Downloads\Flash Counterfeit Bitcoin [FCB] Mode 10.E (1)\Flash Counterfeit Bitcoin [FCB] Mode 10.E\Flash Counterfeit Bitcoin [FCB] Mode 10.E.exe
"C:\Users\Admin\Downloads\Flash Counterfeit Bitcoin [FCB] Mode 10.E (1)\Flash Counterfeit Bitcoin [FCB] Mode 10.E\Flash Counterfeit Bitcoin [FCB] Mode 10.E.exe"
1⤵
PID:1728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 1312
2⤵
- Program crash
PID:412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1728 -ip 1728
1⤵
PID:3048

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
PID:4868

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:3332

C:\Users\Admin\Downloads\Flash Counterfeit Bitcoin [FCB] Mode 10.E (1)\Flash Counterfeit Bitcoin [FCB] Mode 10.E\Flash Counterfeit Bitcoin [FCB] Mode 10.E.exe
"C:\Users\Admin\Downloads\Flash Counterfeit Bitcoin [FCB] Mode 10.E (1)\Flash Counterfeit Bitcoin [FCB] Mode 10.E\Flash Counterfeit Bitcoin [FCB] Mode 10.E.exe"
2⤵
PID:2444

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
72B

MD5
c7f2aa2317235afee3d2c9b768731efb

SHA1
a575c3595ef797cd1db938980f9c213d05049e32

SHA256
de7832c923d715e8962cd95d7b8eb577ba893380a5b81933795563d9c8a95278

SHA512
d47c13a5342c05d6afeef21d48d30668b3a24bdb6085c2932e30ef0004172eda8a4d1ed34817245ef88c1ded13adbb52ab31e6c74c477107e2e182556a1ba35e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
312B

MD5
e321f903e0e8f6ce3ddeb04c4c169700

SHA1
789dbbf63809100280adc2343a83663214e8d6c4

SHA256
5543821053263b8e4993c79536422cc0311e297ab60831de8b3075182ecc3781

SHA512
76dedeb824a87fe6c8606c6bbdaeeabcdb4842e822d6709787a16c6e91a23842c46e1452528f9afabfad0e92a5a2278622731e0ebf498be6f03aa13fa83d4495

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
90c73ab8ccf61364cc0ffe153070292a

SHA1
2030443081a51d2167cc4a39678a9775fdb6a524

SHA256
c5ac2e2d30b3ac90ae0ccfc7060bd436663435c83215372d9961a2eb487a0d19

SHA512
90e1073d5d43e70e4e56fb4e19e5f47ef6a2ca7625140ed548fbabeaa2243c5d4f31b93369bd95e73488095e71c91b3c5a86a58a34514622683136f60575fd9e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
416eb222b6f1bc534fcd740ffbceffb1

SHA1
3c1551364ed378a89be9c8ee20c871ac09bfadc7

SHA256
46c16c97c8a04e8f0788986743600d87bdd9dd29db8711190509a124f20da6a7

SHA512
09564bf43d5f7dbd64638f06f3956c7315bfbfe292bf2e03188884bbd1ae15ccdd860a3044a24ac93781ee06b158951830b8cfccb7ae833f0316cd9550dd3842

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
859B

MD5
5f24d5b182a587076b28b7515d73a9cf

SHA1
8bf4ba3f4d343b0e72d6304b78835ae8ded50cec

SHA256
d4ff8cb219365b060499139d18391d8e6b80f54a7a1851e97d031387ff27b853

SHA512
3d3b5d1f4fe3a9ad87e374300403b5f69a0bc7071462d2dc65482fc574646142c0438e925e6eb44c0b77aeca44cb7cabf56e9b10bb0735e2a38ef37854531653

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
859B

MD5
842d89f00364e0d5abf69f055e71c217

SHA1
4e34855ad5de0f8c864cdc96f20a471627416115

SHA256
f3545f3066d8d295d0c2c4fa9966f0d623937eb40d9c4278548057a847987748

SHA512
44c8c0689ec4f2ff3ff3c7d31bd8abeecd58df92d802fcc2c7e9a0dd98e2d4445778232e51066a4deb98bee2bf7377d31e0e6f956f371cff3b4a99a45540dc5f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
2663a06cda6d7830b93bd6cf9bbfc7c2

SHA1
b33da23d356537faf2068a989980442a142bcbdf

SHA256
75506bf8480024d3ecdb48139165b9f0003c4553c25bcf145dd4d0cd74eb2f98

SHA512
06954c63cd8d32ac3e494fc2d11be6c55d000622861e2822dd7df2ea515e7bea215fd899ca6ae47a8606b9556309d9a8ff40af13d3fc1384fef0fd059a2211b3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
6963a68ef81f154f5cd44578c1a200ee

SHA1
b314c80b1921a2c584412ff20876334c01f3ee38

SHA256
65823a8a926b6f07b66e6cec149864d5a1e0ac0bc6e65d2165089ab37950dd46

SHA512
b15f65d7ee62f0852788ec0f3891ea7c4fdf3a201902f20a99d8a1f6a425af552769831c132fe9dfb37873330726cd92efd012b909465c2cdfc06cce0a207af8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
d7d349112993b1b05eb0453d073ee7e7

SHA1
d805a1610b2af5ff89b1c4abf93a1a9db934b61a

SHA256
654fb31e2188639f2456f1e57989692357c098c1287b402efdd38fe91224c8d6

SHA512
723d7bfd41aabf4d54c6078fdbf7b6ada478bc198eb225da3de02695eac4a68b6f979553b7b55ebb4ae4df454017eac36025a937d58bc5fcdf01097afa1dfd4f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
d9485bb775636dca79acd66cd2e17c6e

SHA1
5331b305ce5d77a6c0b11945ec4b210b4bc66086

SHA256
e0da6020e5f46f460d28a137d6ad538e0a5d13b4eddcde7a74a513e3e264dfca

SHA512
153b39cd5ffd9244fa5565e7d3a53cce3b0e78a5775641d3760f4fdb0856d06717bc9758dc9aac4cc27fc5143263fdaa20fffec9f1f610ce64927a06563a2852

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
129KB

MD5
944160ddc3bcc8c07032e99dd5008793

SHA1
9c95d426b641586d5c9f399e714a564907d26c34

SHA256
0f591436283d653aa9d4422f375785c99c3accfaba672b677496ffc7f37c9823

SHA512
ed49cf461709dd574b0c47d91eb2fea533ccbae5c0a19b3e11eb9c84900b705a61c5380e8ec1b606b7e128a16061ed346dba66329dbb6c23d0ef4c3e8f27de41

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
129KB

MD5
0e99bac06a70f1a3ff6605c445f41c3e

SHA1
dc7b53aeed4e03c8e2507dbc56f19b12a9a8d4d9

SHA256
ae8b7781afcc96fcc169f9bd5429f3a45664f66b8ae1a55ab2f04d4df81fba44

SHA512
8fa72f169576d9d329ef78cd030d58bd2fbf997ba21b2c989aa9cb69877fe4a83ec7ca04c37ca87917bcef268d32ed67b379f7be51179b17c205bbd07f1eaddc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
129KB

MD5
39ecdfeb7d2060231460b604d8842fa3

SHA1
872a44b9276c25f0ef8aef4864698b3a308cbe02

SHA256
857000b22e9a3a3f9892fc5e24038c352518dd00243895652a366d144bc968ac

SHA512
619b5c091f49b841a631cbd1e7e3d93368091c98536635a5d1112cd1e690c96d2bd1fde758dea7288a224a8f54535b2bd8b5f743d0b7a0c45d5fb2cfa6cfae95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Filesize
14KB

MD5
9eebad8c5d8690401b28dea08d0c9dd1

SHA1
f47fb51fc8df77dd347be5d0111fe3399f4597d5

SHA256
509818f6c3545a020fb0a7f79ef575bea2030ba63c7f0e1af6ebc47224a41eb7

SHA512
209e92788e48cb2ba4fc1213a7070cfa92b5255e412fdaf8185b18fdcebf848cfcc4acf1379494e1b21e17e6759bc7f65c39be16d1d79e51a1bba23970936e7e

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize
10KB

MD5
a71ab244d565671f741686cb2c5ed11b

SHA1
b6e766a85f1f878d512f752df2dd4873971755e2

SHA256
06a5716962f3b50a8aa3acd30e33d6c75664465c3d795196ad6dce5e33a80faa

SHA512
0826c8e52b0f5dbcbda745f06390fd59ce9eee8e0e845cdb007f4a97b19065f2544ca63226b34d361adf9e1cf26644672abfe5dcfd75651cd2aeb1ae27f16f84

Download Submit
C:\Users\Admin\Downloads\Flash Counterfeit Bitcoin [FCB] Mode 10.E (1).zip:Zone.Identifier
Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
\??\pipe\crashpad_3716_JGVYPKWCKIWWYSRE
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1728-231-0x0000000013660000-0x0000000013776000-memory.dmp

Filesize
1.1MB

Download
memory/1728-233-0x0000000075190000-0x0000000075941000-memory.dmp

Filesize
7.7MB

Download
memory/1728-224-0x0000000010290000-0x0000000010322000-memory.dmp

Filesize
584KB

Download
memory/1728-225-0x0000000010160000-0x000000001016A000-memory.dmp

Filesize
40KB

Download
memory/1728-226-0x0000000010330000-0x0000000010386000-memory.dmp

Filesize
344KB

Download
memory/1728-227-0x0000000010390000-0x00000000103BA000-memory.dmp

Filesize
168KB

Download
memory/1728-228-0x0000000010410000-0x000000001046A000-memory.dmp

Filesize
360KB

Download
memory/1728-229-0x0000000075190000-0x0000000075941000-memory.dmp

Filesize
7.7MB

Download
memory/1728-230-0x00000000130C0000-0x000000001320A000-memory.dmp

Filesize
1.3MB

Download
memory/1728-222-0x00000000101F0000-0x000000001028C000-memory.dmp

Filesize
624KB

Download
memory/1728-232-0x0000000013780000-0x00000000137B0000-memory.dmp

Filesize
192KB

Download
memory/1728-223-0x0000000010840000-0x0000000010DE6000-memory.dmp

Filesize
5.6MB

Download
memory/1728-221-0x0000000000CF0000-0x0000000001CF0000-memory.dmp

Filesize
16.0MB

Download
memory/1728-220-0x000000007519E000-0x000000007519F000-memory.dmp

Filesize
4KB

Download
memory/4868-242-0x0000027729820000-0x0000027729821000-memory.dmp

Filesize
4KB

Download
memory/4868-241-0x0000027729820000-0x0000027729821000-memory.dmp

Filesize
4KB

Download
memory/4868-247-0x0000027729820000-0x0000027729821000-memory.dmp

Filesize
4KB

Download
memory/4868-252-0x0000027729820000-0x0000027729821000-memory.dmp

Filesize
4KB

Download
memory/4868-251-0x0000027729820000-0x0000027729821000-memory.dmp

Filesize
4KB

Download
memory/4868-250-0x0000027729820000-0x0000027729821000-memory.dmp

Filesize
4KB

Download
memory/4868-249-0x0000027729820000-0x0000027729821000-memory.dmp

Filesize
4KB

Download
memory/4868-248-0x0000027729820000-0x0000027729821000-memory.dmp

Filesize
4KB

Download
memory/4868-246-0x0000027729820000-0x0000027729821000-memory.dmp

Filesize
4KB

Download
memory/4868-240-0x0000027729820000-0x0000027729821000-memory.dmp

Filesize
4KB

Download