Analysis
-
max time kernel
140s -
max time network
556s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07-06-2024 17:06
Static task
static1
Behavioral task
behavioral1
Sample
Authenticator-7.0.0.zip
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Authenticator-7.0.0.zip
Resource
win10v2004-20240508-en
General
-
Target
Authenticator-7.0.0.zip
-
Size
450KB
-
MD5
1a567fa885b3ac63caa1028b1df5506b
-
SHA1
bc52c4e47542efb3814a77e6ccd424de7ff59594
-
SHA256
6476f7687d4aee100d659f19a57a0a23af4e5c88df87f24fde105cd5d8b21e02
-
SHA512
1b4f66dce8f68acf815cb728d6409778dce195594db9cda1ee9b8df003795ce03f38e1ca7ae94cd58f45ec2feec2d09b82f3e4f2b9076bdf6a9e342fbe946d04
-
SSDEEP
12288:57/kMCyJUBZUxel02BQKoGF6Mlob6qxKBtcoKbOf:5NOBZg01QwF665Btsbe
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies registry class 52 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2" chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9} chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\TV_TopViewVersion = "0" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\TV_TopViewVersion = "0" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\TV_TopViewID = "{BDBE736F-34F5-4829-ABE8-B550E65146C4}" chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "4" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 000000000100000002000000ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "16" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48" chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac04000000c8000000354b179bff40d211a27e00c04fc308710300000080000000354b179bff40d211a27e00c04fc308710200000080000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "4294967295" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616257" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6" chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC} chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\TV_FolderType = "{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}" chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000000000002000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "4" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4" chrome.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 2580 chrome.exe 2580 chrome.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
chrome.exepid process 2000 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
Processes:
chrome.exepid process 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
chrome.exepid process 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
chrome.exepid process 2000 chrome.exe 2000 chrome.exe 2000 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2580 wrote to memory of 2348 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 2348 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 2348 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1848 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1620 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1620 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 1620 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 2644 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 2644 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 2644 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 2644 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 2644 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 2644 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 2644 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 2644 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 2644 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 2644 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 2644 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 2644 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 2644 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 2644 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 2644 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 2644 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 2644 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 2644 2580 chrome.exe chrome.exe PID 2580 wrote to memory of 2644 2580 chrome.exe chrome.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Authenticator-7.0.0.zip1⤵PID:2772
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef70a9758,0x7fef70a9768,0x7fef70a97782⤵PID:2348
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1156 --field-trial-handle=1220,i,8350627188524052018,7350514050221274485,131072 /prefetch:22⤵PID:1848
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1220,i,8350627188524052018,7350514050221274485,131072 /prefetch:82⤵PID:1620
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1536 --field-trial-handle=1220,i,8350627188524052018,7350514050221274485,131072 /prefetch:82⤵PID:2644
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2328 --field-trial-handle=1220,i,8350627188524052018,7350514050221274485,131072 /prefetch:12⤵PID:1820
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2336 --field-trial-handle=1220,i,8350627188524052018,7350514050221274485,131072 /prefetch:12⤵PID:2380
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1260 --field-trial-handle=1220,i,8350627188524052018,7350514050221274485,131072 /prefetch:22⤵PID:2020
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3296 --field-trial-handle=1220,i,8350627188524052018,7350514050221274485,131072 /prefetch:12⤵PID:2232
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1252 --field-trial-handle=1220,i,8350627188524052018,7350514050221274485,131072 /prefetch:82⤵PID:2220
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3584 --field-trial-handle=1220,i,8350627188524052018,7350514050221274485,131072 /prefetch:82⤵PID:2896
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3584 --field-trial-handle=1220,i,8350627188524052018,7350514050221274485,131072 /prefetch:82⤵PID:2284
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2748 --field-trial-handle=1220,i,8350627188524052018,7350514050221274485,131072 /prefetch:12⤵PID:2044
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3752 --field-trial-handle=1220,i,8350627188524052018,7350514050221274485,131072 /prefetch:12⤵PID:1672
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3296 --field-trial-handle=1220,i,8350627188524052018,7350514050221274485,131072 /prefetch:82⤵PID:2808
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3244 --field-trial-handle=1220,i,8350627188524052018,7350514050221274485,131072 /prefetch:12⤵PID:2880
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 --field-trial-handle=1220,i,8350627188524052018,7350514050221274485,131072 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2000
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3056
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2152
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4b79a508-ca67-42e0-bb93-b4084387d24f.tmp
Filesize7KB
MD51f144fe4fab50c4be1bf6d0524accfc2
SHA1690fd6502c60b772ca4bcba0df4031d15f6fd970
SHA2563ce0a308108cfc6e5056d7414ad4fc6a9b3a65f24aeea4983c6e950c3d13c215
SHA51204a391abcba9a4b3d9834a7c56407e4aa0292bbcac4baa0dc46d48172796719fbe34ef98464c018e3ec91657e512f63f0734c81d55401e8e567f9e3928cc118f
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
1KB
MD5717761e6b6162a1a644cd7c50fb93fb9
SHA198e98efadfcff9bdbd6172595b83826857982405
SHA256859579fa3691c5d15192da4f1c2e0951c9489a1ea6096c44a154fcb5c476a25b
SHA512296ced1d623e18a828df86f3cf9b65a1c52906b27bb767d0c7371603893aa329d3ecc12659a2d98242462d2a09eb8b36e23f9f345985b8c00f4e0e6bd38b0628
-
Filesize
1KB
MD51908af6c5497caf4c083de174266edbb
SHA17f74c3e012304daa9cbb2354efeab387b98b131f
SHA25643a0cd9d121355c3bb1f3c51f7f45cc3aaeed5188c36ae49cef5b283761d621f
SHA51294698a895be1dbab4123aeda2650521938647c7d7c67fde99758def8b45738e58d0e5d6dc5c069970684f44285ab3d283e3fe9279a2d264b08181373826b17b0
-
Filesize
363B
MD58db022cc02641a19b6068560de9414cb
SHA1a84d28d960dfeda2595a80212a1bfde44e1ff704
SHA25691956acb13eff08684c7723ae0cda03d223c93b0a421e71793db0a1a80a5a5c6
SHA5129dd97ea99554bda06530a53e9fa54c067895d8e504a03586ee833b68693e68374c9c34529b9455358b2105099f5c9dd340c91d6961469cbf5a148424d3836660
-
Filesize
7KB
MD55cd33fab40477ff2f9da288a77b3924f
SHA1333de6b66f7a8311f850953bf7b7af3e4e6de2dd
SHA256076a44e995480ca16a9a753f98e4e4d2b50ee66331545d86261cd8112ff870c9
SHA512ad5ce5d5f060ef4e52c59101003a537d21a84bd747de95be0f1d7b61d73f9d888375e9db92fea8c77b600c303b4b2b4d92fdeb4751bcaa901619acf79f26373a
-
Filesize
4KB
MD5288d413a2a03fd81279769f8161d1c74
SHA1628a303624f06164a453fe98f5a2edb38f6cd31b
SHA256b1b009bfb84a7252a4f78a72d3112b9e28e1b4bb6d058bfae0dbce588d26a7f7
SHA5129605e7e24d201a4165212aaef858eebe0c924cd3270251b38b4246057a9650c3c6f043c32f640a1f24c5d95827ee646cf9839e120c91cba81c9383abc6c52b1f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Filesize16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e