Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20240508-en - resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system - submitted
12/06/2024, 03:51
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe
Resource
win11-20240508-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe
- Size 1.1MB
- Sample240612-eexctszgjl
- SHA256 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231
- MD5 fb96976e1d9f94d1072e7c6073c740b1
- SHA1 610a0f4c2972efd855258649edb198a3f64b46b3
- SHA512 ddab2058bc269bf82dbecffcf394bc2c76ea42089005f746723489ecc3d675b485cba52418e7134176c29d656c1c9daa17a58cea7fabde2ba032709205889771
- SSDEEP 24576:iqDEvCTbMWu7rQYlBQcBiT6rprG8auE2+b+HdiJUX:iTvC/MTQYxsWR7auE2+b+HoJU
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133626379172126553" chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 3800 chrome.exe 3800 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe Token: SeShutdownPrivilege 772 chrome.exe Token: SeCreatePagefilePrivilege 772 chrome.exe - Suspicious use of FindShellTrayWindow 63 IoCs
pid Process 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 772 chrome.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe - Suspicious use of SendNotifyMessage 48 IoCs
pid Process 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 772 chrome.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 244 wrote to memory of 772 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 77 PID 244 wrote to memory of 772 244 af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe 77 PID 772 wrote to memory of 4524 772 chrome.exe 80 PID 772 wrote to memory of 4524 772 chrome.exe 80 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 4904 772 chrome.exe 81 PID 772 wrote to memory of 2240 772 chrome.exe 82 PID 772 wrote to memory of 2240 772 chrome.exe 82 PID 772 wrote to memory of 4084 772 chrome.exe 83 PID 772 wrote to memory of 4084 772 chrome.exe 83 PID 772 wrote to memory of 4084 772 chrome.exe 83 PID 772 wrote to memory of 4084 772 chrome.exe 83 PID 772 wrote to memory of 4084 772 chrome.exe 83 PID 772 wrote to memory of 4084 772 chrome.exe 83 PID 772 wrote to memory of 4084 772 chrome.exe 83 PID 772 wrote to memory of 4084 772 chrome.exe 83 PID 772 wrote to memory of 4084 772 chrome.exe 83 PID 772 wrote to memory of 4084 772 chrome.exe 83 PID 772 wrote to memory of 4084 772 chrome.exe 83 PID 772 wrote to memory of 4084 772 chrome.exe 83 PID 772 wrote to memory of 4084 772 chrome.exe 83 PID 772 wrote to memory of 4084 772 chrome.exe 83 PID 772 wrote to memory of 4084 772 chrome.exe 83 PID 772 wrote to memory of 4084 772 chrome.exe 83 PID 772 wrote to memory of 4084 772 chrome.exe 83 PID 772 wrote to memory of 4084 772 chrome.exe 83 PID 772 wrote to memory of 4084 772 chrome.exe 83 PID 772 wrote to memory of 4084 772 chrome.exe 83 PID 772 wrote to memory of 4084 772 chrome.exe 83 PID 772 wrote to memory of 4084 772 chrome.exe 83 PID 772 wrote to memory of 4084 772 chrome.exe 83 PID 772 wrote to memory of 4084 772 chrome.exe 83 PID 772 wrote to memory of 4084 772 chrome.exe 83 PID 772 wrote to memory of 4084 772 chrome.exe 83 PID 772 wrote to memory of 4084 772 chrome.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe"C:\Users\Admin\AppData\Local\Temp\af27bcdbad4365f07a0ba3fd283a26260f3cec3b7bc2489408990a97e1b56231.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0x80,0x10c,0x7ff9a35eab58,0x7ff9a35eab68,0x7ff9a35eab783⤵PID:4524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1848,i,8841615585712774785,12417301896562196705,131072 /prefetch:23⤵PID:4904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1848,i,8841615585712774785,12417301896562196705,131072 /prefetch:83⤵PID:2240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2176 --field-trial-handle=1848,i,8841615585712774785,12417301896562196705,131072 /prefetch:83⤵PID:4084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1848,i,8841615585712774785,12417301896562196705,131072 /prefetch:13⤵PID:4972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3040 --field-trial-handle=1848,i,8841615585712774785,12417301896562196705,131072 /prefetch:13⤵PID:5036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4320 --field-trial-handle=1848,i,8841615585712774785,12417301896562196705,131072 /prefetch:83⤵PID:2212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4056 --field-trial-handle=1848,i,8841615585712774785,12417301896562196705,131072 /prefetch:83⤵PID:3324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4344 --field-trial-handle=1848,i,8841615585712774785,12417301896562196705,131072 /prefetch:13⤵PID:3336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4600 --field-trial-handle=1848,i,8841615585712774785,12417301896562196705,131072 /prefetch:13⤵PID:1584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4336 --field-trial-handle=1848,i,8841615585712774785,12417301896562196705,131072 /prefetch:83⤵PID:1884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4732 --field-trial-handle=1848,i,8841615585712774785,12417301896562196705,131072 /prefetch:83⤵PID:564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 --field-trial-handle=1848,i,8841615585712774785,12417301896562196705,131072 /prefetch:83⤵PID:2784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4704 --field-trial-handle=1848,i,8841615585712774785,12417301896562196705,131072 /prefetch:13⤵PID:2952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=1604 --field-trial-handle=1848,i,8841615585712774785,12417301896562196705,131072 /prefetch:13⤵PID:3340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3352 --field-trial-handle=1848,i,8841615585712774785,12417301896562196705,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:3800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4752 --field-trial-handle=1848,i,8841615585712774785,12417301896562196705,131072 /prefetch:13⤵PID:2312
-
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3348
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 7KB
- SHA256 348762fb95b0147fbf138158dbcb1c304cbabda6327aef4309d3e3b64f3fbcec
- MD5 ded96f123ff3aecf1b8af86aea8b2e24
- SHA1 fc0197216877b12e50d82747db24e05b8fd7acf7
- SHA512 f0202fa57f704eaf21e2ac9f770b002b07df5e05acd00a370e4dc7d8dd58d872abfdf671f0b12adcaa709408e8cd28697fc002b16dbb32df0350ee2e7dfa0f79
- SSDEEP 192:1UXRpSaJs88syh+F4jgAhjP5tjEsXtScR:1UXR5hyqVk9tIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 131KB
- SHA256 4ab32a173a40762ab60f9a6f8fa603fccd87fe4950a028ea45bf015df9b89943
- MD5 8635973f6f63da7c67e75fd41fc39b4b
- SHA1 c9b0f442a56706e33bc9fc0af259dfb9f6772b75
- SHA512 819872843cd3296ef0a70ded7de9257c40349edc06c34dd6f05c3fb900c394f1675f24b361465111833597b2695c6706453810cf78fc37db7675d0b4c5bc98ed
- SSDEEP 3072:t+pJtel1QotTyzB+lLrOuxfBSw6jKy7JCEmOPXsaUTysx:0rI1Qo5yzkpeXjnJFzXsWI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 131KB
- SHA256 71b7c9430187d55d96dd30c22a8a919f80826e0a723f1f22bca3fa4fa6bc3126
- MD5 faa9c797ed7864741889c592f3a199b7
- SHA1 3e92125746038ab8f5064d04fa40db72ac752b06
- SHA512 f7e858848e92dbddfe6e94bc64fa2e7e4fce136268a40fc2d651fac6e7314692f3aa45903e03ab48fce80a87e75271c9f6920f5a40a5ce745e13675a47985e74
- SSDEEP 3072:t+ZuJtel1QotTyzB+lLrOuxfBSw6jKy7JCEmOPXsaUTysx:rrI1Qo5yzkpeXjnJFzXsWI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
- Size 85KB
- SHA256 6d61ce11436580473be184989ef1a39be30ae87e5aa6159d882d28c1885ead79
- MD5 2cb4551e04215e4df94b66e1c6674b69
- SHA1 8e6120b5dd7763f5250b31ab7a62be9656e562f6
- SHA512 8ab9ba34a04b3c960cb33ff3875c5f43653e1b0f2dc24697ae4fa024111aeb220d83b6024d0c6c1068dcef5a4b8798eaa7d5d54ba0745679ad7988b2e350f1ee
- SSDEEP 384:GGVCxEQouwYFZNGXbNA6p0+UO38EvAobwMcoSaMuoLpN42LXk3NwX21dRxBg/8FZ:2iQxAbn4IepBe/gKWhm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57eadd.TMP
- Size 82KB
- SHA256 40146e2d7ebe74f75218972d2292b682b8c0a65ded09f12f212e3940fdf6ca83
- MD5 8c436092994fb84923a6ed356ecb6a33
- SHA1 b9154875a8b4e27ee0227c323e52345c4dc736b3
- SHA512 bbafe5490351ddb02d7db5eb91e38334f427d87837ce6b01d39b3d0c0dc231d600a753cf3c3588b34094784f6364a1c292042d67ae62752364976ed03ff35cc8
- SSDEEP 384:SGVCxEQouwYFZNGXbNA6p0+UO38AAobwMcoSaMuoLpNYLXk3NwX21dRxBg/8Fnu0:6iQxAbngdepBe/gKWh+
- MD5 SHA1 SHA512 SSDEEP