3ba782f1ddf9b091232171b072b30dd145090d02cbb16f6ed816e14e35885285

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 06:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ratka.exe
Size 37KB
Sample240612-gyphfasfnn
SHA256 3ba782f1ddf9b091232171b072b30dd145090d02cbb16f6ed816e14e35885285
MD5 f82ab1b6c91dbfc8a1fc643f3c10922b
SHA1 5088dc1515bf6cedfbea693bdf0d897e25345775
SHA512 def496bca5a0cc7957d726d02409372885292690618ae5a13c44e6921fb7de72e5ec8e1855a2cb1de9d4cc1d77be01f3e7d65889b17bf41f00cea12d6b6f805e
SSDEEP 384:VmOq0IiejvCVLO309QmykrtG+dA+Vd7wvOSiKrAF+rMRTyN/0L+EcoinblneHQMi:XLdGdkrgYH7wWS9rM+rMRa8Nu9+Ot
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4036	netsh.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
48	0.tcp.eu.ngrok.io
58	0.tcp.eu.ngrok.io
3	0.tcp.eu.ngrok.io
32	0.tcp.eu.ngrok.io
43	0.tcp.eu.ngrok.io
45	0.tcp.eu.ngrok.io
8	0.tcp.eu.ngrok.io
18	0.tcp.eu.ngrok.io
20	0.tcp.eu.ngrok.io
22	0.tcp.eu.ngrok.io

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133626464187707329"	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2616	chrome.exe
2616	chrome.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe
3940	Ratka.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3940	Ratka.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3940	Ratka.exe
Token: 33	3940	Ratka.exe
Token: SeIncBasePriorityPrivilege	3940	Ratka.exe
Token: 33	3940	Ratka.exe
Token: SeIncBasePriorityPrivilege	3940	Ratka.exe
Token: SeShutdownPrivilege	2616	chrome.exe
Token: SeCreatePagefilePrivilege	2616	chrome.exe
Token: SeShutdownPrivilege	2616	chrome.exe
Token: SeCreatePagefilePrivilege	2616	chrome.exe
Token: 33	3940	Ratka.exe
Token: SeIncBasePriorityPrivilege	3940	Ratka.exe
Token: SeShutdownPrivilege	2616	chrome.exe
Token: SeCreatePagefilePrivilege	2616	chrome.exe
Token: SeShutdownPrivilege	2616	chrome.exe
Token: SeCreatePagefilePrivilege	2616	chrome.exe
Token: SeShutdownPrivilege	2616	chrome.exe
Token: SeCreatePagefilePrivilege	2616	chrome.exe
Token: SeShutdownPrivilege	2616	chrome.exe
Token: SeCreatePagefilePrivilege	2616	chrome.exe
Token: SeShutdownPrivilege	2616	chrome.exe
Token: SeCreatePagefilePrivilege	2616	chrome.exe
Token: SeShutdownPrivilege	2616	chrome.exe
Token: SeCreatePagefilePrivilege	2616	chrome.exe
Token: SeShutdownPrivilege	2616	chrome.exe
Token: SeCreatePagefilePrivilege	2616	chrome.exe
Token: SeShutdownPrivilege	2616	chrome.exe
Token: SeCreatePagefilePrivilege	2616	chrome.exe
Token: 33	3940	Ratka.exe
Token: SeIncBasePriorityPrivilege	3940	Ratka.exe
Token: SeShutdownPrivilege	2616	chrome.exe
Token: SeCreatePagefilePrivilege	2616	chrome.exe
Token: SeShutdownPrivilege	2616	chrome.exe
Token: SeCreatePagefilePrivilege	2616	chrome.exe
Token: SeShutdownPrivilege	2616	chrome.exe
Token: SeCreatePagefilePrivilege	2616	chrome.exe
Token: SeShutdownPrivilege	2616	chrome.exe
Token: SeCreatePagefilePrivilege	2616	chrome.exe
Token: SeShutdownPrivilege	2616	chrome.exe
Token: SeCreatePagefilePrivilege	2616	chrome.exe
Token: SeShutdownPrivilege	2616	chrome.exe
Token: SeCreatePagefilePrivilege	2616	chrome.exe
Token: SeShutdownPrivilege	2616	chrome.exe
Token: SeCreatePagefilePrivilege	2616	chrome.exe
Token: SeShutdownPrivilege	2616	chrome.exe
Token: SeCreatePagefilePrivilege	2616	chrome.exe
Token: 33	3940	Ratka.exe
Token: SeIncBasePriorityPrivilege	3940	Ratka.exe
Token: SeShutdownPrivilege	2616	chrome.exe
Token: SeCreatePagefilePrivilege	2616	chrome.exe
Token: SeShutdownPrivilege	2616	chrome.exe
Token: SeCreatePagefilePrivilege	2616	chrome.exe
Token: SeShutdownPrivilege	2616	chrome.exe
Token: SeCreatePagefilePrivilege	2616	chrome.exe
Token: SeShutdownPrivilege	2616	chrome.exe
Token: SeCreatePagefilePrivilege	2616	chrome.exe
Token: SeShutdownPrivilege	2616	chrome.exe
Token: SeCreatePagefilePrivilege	2616	chrome.exe
Token: SeShutdownPrivilege	2616	chrome.exe
Token: SeCreatePagefilePrivilege	2616	chrome.exe
Token: SeShutdownPrivilege	2616	chrome.exe
Token: SeCreatePagefilePrivilege	2616	chrome.exe
Token: SeShutdownPrivilege	2616	chrome.exe
Token: SeCreatePagefilePrivilege	2616	chrome.exe
Token: 33	3940	Ratka.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe
2616	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 4036	3940	Ratka.exe	94
PID 3940 wrote to memory of 4036	3940	Ratka.exe	94
PID 3940 wrote to memory of 4036	3940	Ratka.exe	94
PID 2616 wrote to memory of 3164	2616	chrome.exe	99
PID 2616 wrote to memory of 3164	2616	chrome.exe	99
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 4884	2616	chrome.exe	100
PID 2616 wrote to memory of 1736	2616	chrome.exe	101
PID 2616 wrote to memory of 1736	2616	chrome.exe	101
PID 2616 wrote to memory of 2576	2616	chrome.exe	102
PID 2616 wrote to memory of 2576	2616	chrome.exe	102
PID 2616 wrote to memory of 2576	2616	chrome.exe	102
PID 2616 wrote to memory of 2576	2616	chrome.exe	102
PID 2616 wrote to memory of 2576	2616	chrome.exe	102
PID 2616 wrote to memory of 2576	2616	chrome.exe	102
PID 2616 wrote to memory of 2576	2616	chrome.exe	102
PID 2616 wrote to memory of 2576	2616	chrome.exe	102
PID 2616 wrote to memory of 2576	2616	chrome.exe	102
PID 2616 wrote to memory of 2576	2616	chrome.exe	102
PID 2616 wrote to memory of 2576	2616	chrome.exe	102
PID 2616 wrote to memory of 2576	2616	chrome.exe	102
PID 2616 wrote to memory of 2576	2616	chrome.exe	102
PID 2616 wrote to memory of 2576	2616	chrome.exe	102
PID 2616 wrote to memory of 2576	2616	chrome.exe	102
PID 2616 wrote to memory of 2576	2616	chrome.exe	102
PID 2616 wrote to memory of 2576	2616	chrome.exe	102
PID 2616 wrote to memory of 2576	2616	chrome.exe	102
PID 2616 wrote to memory of 2576	2616	chrome.exe	102
PID 2616 wrote to memory of 2576	2616	chrome.exe	102
PID 2616 wrote to memory of 2576	2616	chrome.exe	102
PID 2616 wrote to memory of 2576	2616	chrome.exe	102
PID 2616 wrote to memory of 2576	2616	chrome.exe	102
PID 2616 wrote to memory of 2576	2616	chrome.exe	102
PID 2616 wrote to memory of 2576	2616	chrome.exe	102
PID 2616 wrote to memory of 2576	2616	chrome.exe	102

C:\Users\Admin\AppData\Local\Temp\Ratka.exe
"C:\Users\Admin\AppData\Local\Temp\Ratka.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Ratka.exe" "Ratka.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  PID:4036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3756,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
1⤵
PID:2296

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff99049ab58,0x7ff99049ab68,0x7ff99049ab78
  2⤵
  PID:3164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1852 --field-trial-handle=1916,i,11352947211072951229,12820452971963259483,131072 /prefetch:2
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1916,i,11352947211072951229,12820452971963259483,131072 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2240 --field-trial-handle=1916,i,11352947211072951229,12820452971963259483,131072 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3180 --field-trial-handle=1916,i,11352947211072951229,12820452971963259483,131072 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3252 --field-trial-handle=1916,i,11352947211072951229,12820452971963259483,131072 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4348 --field-trial-handle=1916,i,11352947211072951229,12820452971963259483,131072 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 --field-trial-handle=1916,i,11352947211072951229,12820452971963259483,131072 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4836 --field-trial-handle=1916,i,11352947211072951229,12820452971963259483,131072 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=2384 --field-trial-handle=1916,i,11352947211072951229,12820452971963259483,131072 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=2664 --field-trial-handle=1916,i,11352947211072951229,12820452971963259483,131072 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3392 --field-trial-handle=1916,i,11352947211072951229,12820452971963259483,131072 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5012 --field-trial-handle=1916,i,11352947211072951229,12820452971963259483,131072 /prefetch:1
  2⤵
  PID:756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3504 --field-trial-handle=1916,i,11352947211072951229,12820452971963259483,131072 /prefetch:1
  2⤵
  PID:400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3708 --field-trial-handle=1916,i,11352947211072951229,12820452971963259483,131072 /prefetch:1
  2⤵
  PID:392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4368 --field-trial-handle=1916,i,11352947211072951229,12820452971963259483,131072 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5024 --field-trial-handle=1916,i,11352947211072951229,12820452971963259483,131072 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5012 --field-trial-handle=1916,i,11352947211072951229,12820452971963259483,131072 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=3344 --field-trial-handle=1916,i,11352947211072951229,12820452971963259483,131072 /prefetch:1
  2⤵
  PID:4804

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 811B
SHA256 6d376a43506cf018fe2ee060527088eb3976dcea250d893ad9d0df6021c11246
MD5 025e3a5e7f3534adff8e672bd6b2d096
SHA1 f1ed783204d962758f07749c16ea81a99fab5944
SHA512 ceb82b58e02188d8932f56e996ba081b3442c6fd8f4822fd4cf19cac8dd46a4aeed20acb04a5c43af873b0362b440eb36678c1b1f3eb11074819c8cb26b7f6fc
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 81ec24460e9f7a204c64cc8af65c96bff1d241a89eddba445cbe369198d9f8f1
MD5 d9305988a5173da7e09ae1c1604bbc0b
SHA1 09de7ad3acc3fc5aeab45b71722a8884e359efb1
SHA512 cc2633891d582157dad3bc7ffb1e0457340cfce14a4852e471ae92c797f10b8fffe8d87d1c1703edf2bbabe8410b3cdcff648a8584ec4f451dfad9985bb11143
SSDEEP 192:OWYQpBcaJMf8syh+FRtAgBARTmP5tjEsXtScR:OWf3VkyqVQitIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 930f470ffc7dab17b97f23b98c49f97f160668a1e254b0da7b7fb24bd8a629c9
MD5 fa9168d6d476abe2ca5a1297cf52b8ca
SHA1 fcc9dd6772d069176612e49a4d27bf26512dcc0f
SHA512 c71833ec2ada86c0fa7c6d17c54dfc7398c08176023d4259e162ba3bb4bfc377f9be0105e532460fbda61299a16d0b0bbff74482e5bdb82e89235477228630c3
SSDEEP 192:OWYQpBcaJMf8syh+FD/WAgBARTmP5tjEsXtScR:OWf3VkyqbCQitIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 255KB
SHA256 b1a9bf809eebaf310d2a16edce98451a10f98558c350611d54e594a60a64ad2f
MD5 e272cb9d616d8eaff154e708eb6df7fa
SHA1 c2b5f59db677ff05a8d9245c9102df13bdb4dc24
SHA512 8315b6256e6070d1f4b5b608a934d7c70627379be6fe1bd56f07e7c63474278b8187fb42e833928cdf3dff2205ab52598b6edaa26353155b73d9fdafbc92d808
SSDEEP 6144:VrI1Qo5yzkpeXjnJFzXsWKQYRPILxZnhLMJjX0EeGzY2rLS:VEjCkpeXtFbGQ5fnReEFsLLS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 255KB
SHA256 e64473240c6a03bbf48efbb0dce39c654a957ead80c9f94a9859bd259ccec9a8
MD5 1dea17e8d4869600b657b1b305a5aa45
SHA1 0558b54bb3ee1252d811e70578649781e3b1c7b0
SHA512 ea4ffe9f534b371e8371e16846133bd4253113027ba98a813c30a18bf4fa66a08faf95e3b27fa245f1ded476b49745d6e31f134ad8d1f18d9157bc236e407174
SSDEEP 6144:6rI1Qo5yzkpeXjnJFzXsWKQYRPILxZnhLMJjX0EeGzY2rLS:6EjCkpeXtFbGQ5fnReEFsLLS
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 8b6f737d071b4fc5f4cf2803fa0687cfb81ddce9a9224725d614e35805de68bd
MD5 589f008c3e2759f5776eabfc853d63b5
SHA1 2560f44988acc6faccc0f9fb8e588f4759324167
SHA512 f1f29c13f0434302676489af94aa16e5c5ee7330f5e2fb2b0e807e0602cbb83c4ef2a5bf2c12b0096247107e52797ef58fd7403b5537d4d838b52e3653491364
SSDEEP 3:MsEllllkEthXllkl2zE/luhrl:/M/xT02z/hrl
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3940-4-0x0000000075542000-0x0000000075543000-memory.dmp

Download

memory/3940-30-0x0000000075540000-0x0000000075AF1000-memory.dmp

Download

memory/3940-5-0x0000000075540000-0x0000000075AF1000-memory.dmp

Download

memory/3940-48-0x0000000075540000-0x0000000075AF1000-memory.dmp

Download

memory/3940-0-0x0000000075542000-0x0000000075543000-memory.dmp

Download

memory/3940-3-0x0000000075540000-0x0000000075AF1000-memory.dmp

Download

memory/3940-2-0x0000000075540000-0x0000000075AF1000-memory.dmp

Download

memory/3940-1-0x0000000075540000-0x0000000075AF1000-memory.dmp

Download