Analysis
- max time kernel
150s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20240508-en - resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system - submitted
08/06/2024, 07:05
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe
Resource
win11-20240508-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe
- Size 1.1MB
- Sample240608-hwqs6aaa6t
- SHA256 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071
- MD5 52c6ed05ee8f0f54966b83e2596b850d
- SHA1 00840c5dc67d01353d3ee29ec94639b42bfa74a2
- SHA512 586027ec4ae03ab96d04c49e3379239fa3dd69ead44f59e0d6341298fb7301511c43345db734c66dd98c1af3208de95ce6ea4367d33a0df048ca187af9f5388a
- SSDEEP 24576:OqDEvCTbMWu7rQYlBQcBiT6rprG8auo2+b+HdiJUu:OTvC/MTQYxsWR7auo2+b+HoJU
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133623039358009609" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1672260578-815027929-964132517-1000\{F30E04F5-F618-4A0E-8ADB-E14DF0F3CBED} chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 4124 chrome.exe 4124 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe Token: SeShutdownPrivilege 1032 chrome.exe Token: SeCreatePagefilePrivilege 1032 chrome.exe - Suspicious use of FindShellTrayWindow 52 IoCs
pid Process 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 1032 chrome.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe - Suspicious use of SendNotifyMessage 37 IoCs
pid Process 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 1032 chrome.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3076 wrote to memory of 1032 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 78 PID 3076 wrote to memory of 1032 3076 5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe 78 PID 1032 wrote to memory of 4924 1032 chrome.exe 81 PID 1032 wrote to memory of 4924 1032 chrome.exe 81 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 1716 1032 chrome.exe 82 PID 1032 wrote to memory of 2308 1032 chrome.exe 83 PID 1032 wrote to memory of 2308 1032 chrome.exe 83 PID 1032 wrote to memory of 1472 1032 chrome.exe 84 PID 1032 wrote to memory of 1472 1032 chrome.exe 84 PID 1032 wrote to memory of 1472 1032 chrome.exe 84 PID 1032 wrote to memory of 1472 1032 chrome.exe 84 PID 1032 wrote to memory of 1472 1032 chrome.exe 84 PID 1032 wrote to memory of 1472 1032 chrome.exe 84 PID 1032 wrote to memory of 1472 1032 chrome.exe 84 PID 1032 wrote to memory of 1472 1032 chrome.exe 84 PID 1032 wrote to memory of 1472 1032 chrome.exe 84 PID 1032 wrote to memory of 1472 1032 chrome.exe 84 PID 1032 wrote to memory of 1472 1032 chrome.exe 84 PID 1032 wrote to memory of 1472 1032 chrome.exe 84 PID 1032 wrote to memory of 1472 1032 chrome.exe 84 PID 1032 wrote to memory of 1472 1032 chrome.exe 84 PID 1032 wrote to memory of 1472 1032 chrome.exe 84 PID 1032 wrote to memory of 1472 1032 chrome.exe 84 PID 1032 wrote to memory of 1472 1032 chrome.exe 84 PID 1032 wrote to memory of 1472 1032 chrome.exe 84 PID 1032 wrote to memory of 1472 1032 chrome.exe 84 PID 1032 wrote to memory of 1472 1032 chrome.exe 84 PID 1032 wrote to memory of 1472 1032 chrome.exe 84 PID 1032 wrote to memory of 1472 1032 chrome.exe 84 PID 1032 wrote to memory of 1472 1032 chrome.exe 84 PID 1032 wrote to memory of 1472 1032 chrome.exe 84 PID 1032 wrote to memory of 1472 1032 chrome.exe 84 PID 1032 wrote to memory of 1472 1032 chrome.exe 84 PID 1032 wrote to memory of 1472 1032 chrome.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe"C:\Users\Admin\AppData\Local\Temp\5ccb1aaff75cb6873c214dcb57fc166a6ced1df439fa397c563cd50f7fdd0071.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffcc959ab58,0x7ffcc959ab68,0x7ffcc959ab783⤵PID:4924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1632 --field-trial-handle=1864,i,16963150466602366466,11334031540070380495,131072 /prefetch:23⤵PID:1716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1864,i,16963150466602366466,11334031540070380495,131072 /prefetch:83⤵PID:2308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2188 --field-trial-handle=1864,i,16963150466602366466,11334031540070380495,131072 /prefetch:83⤵PID:1472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1864,i,16963150466602366466,11334031540070380495,131072 /prefetch:13⤵PID:4612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3096 --field-trial-handle=1864,i,16963150466602366466,11334031540070380495,131072 /prefetch:13⤵PID:4220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4188 --field-trial-handle=1864,i,16963150466602366466,11334031540070380495,131072 /prefetch:13⤵PID:2148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3360 --field-trial-handle=1864,i,16963150466602366466,11334031540070380495,131072 /prefetch:13⤵PID:2872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4444 --field-trial-handle=1864,i,16963150466602366466,11334031540070380495,131072 /prefetch:83⤵PID:3952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4452 --field-trial-handle=1864,i,16963150466602366466,11334031540070380495,131072 /prefetch:83⤵
- Modifies registry class
PID:3204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4844 --field-trial-handle=1864,i,16963150466602366466,11334031540070380495,131072 /prefetch:83⤵PID:4364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 --field-trial-handle=1864,i,16963150466602366466,11334031540070380495,131072 /prefetch:83⤵PID:4876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 --field-trial-handle=1864,i,16963150466602366466,11334031540070380495,131072 /prefetch:83⤵PID:4892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 --field-trial-handle=1864,i,16963150466602366466,11334031540070380495,131072 /prefetch:83⤵PID:3132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 --field-trial-handle=1864,i,16963150466602366466,11334031540070380495,131072 /prefetch:83⤵PID:2956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 --field-trial-handle=1864,i,16963150466602366466,11334031540070380495,131072 /prefetch:83⤵PID:4212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1540 --field-trial-handle=1864,i,16963150466602366466,11334031540070380495,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:4124
-
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4536
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1ccc594a-0a41-46f7-b9ab-a8f9b77ea00e.tmp
- Size 16KB
- SHA256 9da5d880d2fc2f6052821969b96aab0d0d2000da31570ce25ab19f4aa33bc3e1
- MD5 45ea57dc5d35e0a6261d1ca06a5ebb61
- SHA1 73e545d3a07933792cf9473f4f8f7afd85cc664d
- SHA512 1151ca4fc420deba8ec290e0edb1fc90797ff697f891eeeca147960a61455976f7ee3b89fd6968a2a0fb07e3c052ad4a6c7220ce758920919f2b5660d2bfc126
- SSDEEP 384:uWu1LPLexfXHZ1kXqKf/pUZNCgVLH2Hf9mXrU85HGCEfG:uV1LPLcPHZ1kXqKf/pUZNCgVLH2HfAXX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 336B
- SHA256 883b5310560fe2e7bbff441ddb341d5d959fe934b2f5ec839dba8c414d999f39
- MD5 2754d150d5194d9e6fc3499fb04249c6
- SHA1 3a5ae94802b4d97bd6955e2d8aa07cd66284319f
- SHA512 3da743ca8a73824f444080f21ab57a032217746497c2f348349c72088e5aa08cfaaac741d0bdb5cce41b6de37bd0d98e206a3bc7eb7cc7eb677b50d995799ce5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 32a72751077cb2b56c41c0b31abc0852cfc94d7fd591e393c2dc66c561eb8264
- MD5 6cbbf29acb5dc1ea3f811e49685907ec
- SHA1 d2d494a827f0dbafb31e17e57ae2b01d0cfa3c33
- SHA512 3ca79ecbf3bd54a52e41a61b6436fa99c4bd1e1cb27bb4cf99116269a0a6d4187ba9a8fc47c7ce20c010ab4ad5718f4ff31cd92a0f6cda63e127ffd02ceb6649
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 9c036c3ca5698da8521d0de499f2f921cbb9f446cb632cae3779013b913ca392
- MD5 0cd2ea5552ad82992334f2384bc782e3
- SHA1 e912c36f089e2e6e5105cdb4240d2563586c8355
- SHA512 f24cbd54012c2caa7c6458e15fb7223c30b56ed31d6c526a6cf10453433b6cd875bb086be68b6d70dc5f734d3bb869c484c30b08555f1646bc080503802eff8c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 524B
- SHA256 8df76637d03bcb133e375b70ece9e812d8ee920d500cceb3894bc8186c0b006a
- MD5 eaacadcf88fe15dfc0ca9c76b80a6174
- SHA1 921f96109b6f56c250feb49e7d58bb8eb96aaa36
- SHA512 a2a5dce498d95443f33536e3c055059b715adc0e2e8131d5ba8f73f8e2a5b8e9d8bbfa3ca6f0b83be682bc7baaa6c5520fd5d5129108203bf09bc5201ebb9912
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 524B
- SHA256 91029e4f58504932b58e6109388da54edc985bb79ea3548433cac1b525b3d13b
- MD5 8c1a3a2c4de3b4d323813717380f476d
- SHA1 8adf34fb1906559b23a60d9be9bb575d5d2211ec
- SHA512 efd2d0e29eed9bbe3df3525020b88231e6644cd1674d0adc24f05850013f5fb021d461ef5b2a55b4387566528bbdce552c02c40ba4460ab3fc2024051b5db1b2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 7KB
- SHA256 489fb296eca01faa2cc54a017a81026bff6ae9ffe48f93b4317a98c1353f9254
- MD5 43d0678ec5b2238fc50e5b78e524c49d
- SHA1 d7236b8e3e673d182f44d8a79f908b1936331bfe
- SHA512 4cae3a45a67bde50e9b155a971ad3868f4420837f69de9651668e5f42e91aec7a52548ee21814a25422f00ad7699bc40589d524f0b1d48da873d6efb28421044
- SSDEEP 192:2PXV3ePuDaJs8Eyh+F/X2Ma+P5tjEsXtScR:2PXV3uBSyqv2Ma6tIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 257KB
- SHA256 f4c1d38e30262289b900c112e09d9129823edfc2d3a6133ae6a6a74d78fbd508
- MD5 9840cc843955d5cc94327a254895d170
- SHA1 6406a3cdacb5a0f9c2d771275197d688c0a45cdd
- SHA512 f61799db8be0dffe2724ec37b80677ebca00ca0519fdad14be8c57d1eb727813b4ce3464f452ad1deb4841db85e5f334f6be14e6581875c6ffd74e3178b7e91d
- SSDEEP 6144:qavh3PCfU6FMSNge1bIYDdlPwrI1Qo5yzkpeXjnJFzXsW3:qaNPCfUERg6kYZlYEjCkpeXtFbb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 266KB
- SHA256 e56c3bbe7b2638b3a2a6c1b5419da346f2e88ed008659ae2f08f8fd43fa04ffb
- MD5 7ea02c56da5348b24ec1e4c38af4f7f8
- SHA1 a9080b95f27c7be93d6c62ef58d1f390f238b968
- SHA512 31b37fc5d300f199a2fedd8202d633ce59a768af183e58d9a9397e23b4c7edb47cc86c1be1295443daf6447088e8a308440112298cf2fd93ce76d467b7addb71
- SSDEEP 6144:kG8t2jQMcAPNm/avh3PCfU6FMSNge1bIYDdlPR:8kQMc+Nm/aNPCfUERg6kYZl5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 265KB
- SHA256 dd4f687e6abcf28b49f10932f8ae621440942074bc1e835f7086a6ae2b3d2771
- MD5 cb7242b5f742a2d140df57b9eef793ce
- SHA1 eee20fc058666da695ef5379f48c79bf9b0e8001
- SHA512 847fa2bf9381f579455477435f7bd51d7d26fcbd0c78a606d83af38616dd4dc21eb7e202ea61b6f69f17a07749f5cf394b656914628019a93062270102387801
- SSDEEP 6144:xgiG8t2jQMcAPNm/avh3PCfU6FMSNge1bIYDdlPR:mukQMc+Nm/aNPCfUERg6kYZl5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
- Size 89KB
- SHA256 a213a600ee5b5bed4bc85573dd4449717dd57cfcc4fdc3f6db13c8626afc1af0
- MD5 3e833132ee0376f18eb2208858fb80b5
- SHA1 d22a49b44693f7d226df4cdae448d1ebc7c36ea2
- SHA512 1f05f7ec4470131341ce22f9ae19c950f04e8d2387dc5a9ad15b0a6d21cf0a94a89d8462211348d520bd46d0971fdac39b56147b073863364c1d721f9c5bf74b
- SSDEEP 384:DyZWxEQgi84Z1JanPtEGd0CMC78P4rMoP7XwY0WOMiELVRU9LD4LNsD6Z5pFBU/q:biQRMnrsUBKb5iLEK2pi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57dcb4.TMP
- Size 86KB
- SHA256 0eb91a4dd2a4c3ed64bc552c09372c453b8680a4f772189e471f2b67ff341015
- MD5 ba6a25de0f1c2b65562f02c4ab38dcf6
- SHA1 20d59bc4dde0cc5333c59f01383494b6a6a6c594
- SHA512 3b04142e11f3e9ee75227453ea5e72908b893ae62b861d67773fbbcfeef197dae6623a942305d84791f264c5c33edc6cb245201da23f61662321be69d2c68514
- SSDEEP 384:0SyZWxEQgi84Z1JanPtEGd0CMC78sMoP7XwY0WOMiELVRXLD4LNsD6Z5pFBU/4x3:0eiQRMnroUwKb5iLEK2pi
- MD5 SHA1 SHA512 SSDEEP