3eb94783cb0063c9fb90a79f8a157e315f627bd60e5bcfc4c426aa90b6069f1a

Analysis

max time kernel
749s
max time network
750s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
12/06/2024, 15:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Graphing data.xlsx
Size 7.6MB
Sample240612-skwkdatckm
SHA256 3eb94783cb0063c9fb90a79f8a157e315f627bd60e5bcfc4c426aa90b6069f1a
MD5 e19d0eda637f74082459f65ef9932c06
SHA1 02c1b4bea5a8a8984ae4b06b88cc30c5ccbbe58e
SHA512 d95c57f1f5df143956fd9f1582ee38ffcf0679724346b242d49cd5639a1eca714fb65ddbb23ff5b22518028938054277e2eaf3c8226c3c6dcfb6912f104d849f
SSDEEP 196608:nkDusCHhRf8ewh52r1LDpD7jruFNTiuYvWa4mApTz:kCs6dgz2r1LDpD7jUNTiuYu9
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133626787210166124"	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
636	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2332	chrome.exe
2332	chrome.exe
636	EXCEL.EXE
636	EXCEL.EXE
3908	chrome.exe
3908	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeDebugPrivilege	636	EXCEL.EXE
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
636	EXCEL.EXE
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
636	EXCEL.EXE

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
636	EXCEL.EXE
636	EXCEL.EXE
636	EXCEL.EXE
636	EXCEL.EXE
636	EXCEL.EXE
636	EXCEL.EXE
636	EXCEL.EXE
636	EXCEL.EXE
636	EXCEL.EXE
636	EXCEL.EXE
636	EXCEL.EXE
636	EXCEL.EXE
636	EXCEL.EXE
636	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 1872	2332	chrome.exe	81
PID 2332 wrote to memory of 1872	2332	chrome.exe	81
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 4324	2332	chrome.exe	82
PID 2332 wrote to memory of 3332	2332	chrome.exe	83
PID 2332 wrote to memory of 3332	2332	chrome.exe	83
PID 2332 wrote to memory of 3048	2332	chrome.exe	84
PID 2332 wrote to memory of 3048	2332	chrome.exe	84
PID 2332 wrote to memory of 3048	2332	chrome.exe	84
PID 2332 wrote to memory of 3048	2332	chrome.exe	84
PID 2332 wrote to memory of 3048	2332	chrome.exe	84
PID 2332 wrote to memory of 3048	2332	chrome.exe	84
PID 2332 wrote to memory of 3048	2332	chrome.exe	84
PID 2332 wrote to memory of 3048	2332	chrome.exe	84
PID 2332 wrote to memory of 3048	2332	chrome.exe	84
PID 2332 wrote to memory of 3048	2332	chrome.exe	84
PID 2332 wrote to memory of 3048	2332	chrome.exe	84
PID 2332 wrote to memory of 3048	2332	chrome.exe	84
PID 2332 wrote to memory of 3048	2332	chrome.exe	84
PID 2332 wrote to memory of 3048	2332	chrome.exe	84
PID 2332 wrote to memory of 3048	2332	chrome.exe	84
PID 2332 wrote to memory of 3048	2332	chrome.exe	84
PID 2332 wrote to memory of 3048	2332	chrome.exe	84
PID 2332 wrote to memory of 3048	2332	chrome.exe	84
PID 2332 wrote to memory of 3048	2332	chrome.exe	84
PID 2332 wrote to memory of 3048	2332	chrome.exe	84
PID 2332 wrote to memory of 3048	2332	chrome.exe	84
PID 2332 wrote to memory of 3048	2332	chrome.exe	84
PID 2332 wrote to memory of 3048	2332	chrome.exe	84
PID 2332 wrote to memory of 3048	2332	chrome.exe	84
PID 2332 wrote to memory of 3048	2332	chrome.exe	84
PID 2332 wrote to memory of 3048	2332	chrome.exe	84
PID 2332 wrote to memory of 3048	2332	chrome.exe	84
PID 2332 wrote to memory of 3048	2332	chrome.exe	84
PID 2332 wrote to memory of 3048	2332	chrome.exe	84

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Graphing data.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7fffa635ab58,0x7fffa635ab68,0x7fffa635ab78
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1632 --field-trial-handle=1780,i,10660848435456462654,46894976284977852,131072 /prefetch:2
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1780,i,10660848435456462654,46894976284977852,131072 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2208 --field-trial-handle=1780,i,10660848435456462654,46894976284977852,131072 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3156 --field-trial-handle=1780,i,10660848435456462654,46894976284977852,131072 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3256 --field-trial-handle=1780,i,10660848435456462654,46894976284977852,131072 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4236 --field-trial-handle=1780,i,10660848435456462654,46894976284977852,131072 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4580 --field-trial-handle=1780,i,10660848435456462654,46894976284977852,131072 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4620 --field-trial-handle=1780,i,10660848435456462654,46894976284977852,131072 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:4908
- - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff76f5fae48,0x7ff76f5fae58,0x7ff76f5fae68
    3⤵
    PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4524 --field-trial-handle=1780,i,10660848435456462654,46894976284977852,131072 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5012 --field-trial-handle=1780,i,10660848435456462654,46894976284977852,131072 /prefetch:1
  2⤵
  PID:480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3248 --field-trial-handle=1780,i,10660848435456462654,46894976284977852,131072 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4724 --field-trial-handle=1780,i,10660848435456462654,46894976284977852,131072 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3448 --field-trial-handle=1780,i,10660848435456462654,46894976284977852,131072 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4004 --field-trial-handle=1780,i,10660848435456462654,46894976284977852,131072 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4560 --field-trial-handle=1780,i,10660848435456462654,46894976284977852,131072 /prefetch:1
  2⤵
  PID:680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2704 --field-trial-handle=1780,i,10660848435456462654,46894976284977852,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=1728 --field-trial-handle=1780,i,10660848435456462654,46894976284977852,131072 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=1468 --field-trial-handle=1780,i,10660848435456462654,46894976284977852,131072 /prefetch:1
  2⤵
  PID:4980

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 e42d59ad80ffc4473a0cddbcdcabaff64dd95031a170588be6b4e5e736adb4e3
MD5 d67e280ab586f016774e5d5a1f8c0d7e
SHA1 9d7b8867b90dd86f0e5e591c1e64e227e0ef783d
SHA512 ca54c52111b545de5c1a864eaf202b2e9f020ed5a757011ee22f617e752ad878a2194756519f340672be315f701bc1bbd362d20fc442a403c2ccf675eb1ea1f0
SSDEEP 192:eFcrc2kJ2WpY3aJF8syh+FLl03nUvwIP5tjEsXtScR:eCrc2WxjyqeE4QtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

f202700a-a580-4651-ab8c-cacdc3900216.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f202700a-a580-4651-ab8c-cacdc3900216.tmp
Size 7KB
SHA256 df9c251205ce474018d0b2beab8abc3d2cef6f089eceef0a3f2f9e480461ac82
MD5 555539aa9b7dc45e5ef4ca97668a170d
SHA1 2a34b8189df986470578685898c919df4c2923d8
SHA512 b317cc69eee134e0578c0f2aee05bacc63086c64d559b451d4c5d04bd85eb37890006cac3e0e072ca1029df9fd1d82295b59a65cd772d48e33bbb4f8879946d2
SSDEEP 192:eFcXWpY3aJF8syh+FLl03nUvwIP5tjEsXtScR:eCXWxjyqeE4QtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 4fbd94c98379b57f6f5a80836a0e2c44dc26b95d404430788efe94bdde2cdde4
MD5 81c7ab00792cb777db1e267aed34f4c5
SHA1 ff433f8acf0fb42336e66c629143c0c0b635256e
SHA512 993adc6ee9255052bab930e45c01385ab1b7986bb43ff2c53f35c2444ff5c04badbfeb4fa8b6ecf5439311230312660e8e45a19bfae94fe63b7b97de631a11e5
SSDEEP 3072:5rJtel1QotTyzB+lLrOuxfBSw6jKy7JCEmOPXsaUTyso:5rrI1Qo5yzkpeXjnJFzXsW1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 2ccb9689969668d00126021314108f7cc867f720558a3f57e48c0b5f6ae7e2f3
MD5 c92aa0d48e1502ca6a56bbd165ca8cab
SHA1 81181747fde1513cb624a1127434253181b79b1a
SHA512 61916970fdc9f72d4c47fa21642efbd43da9eacecc2b426eb1cf03e75487419aa328845b3affb2a88dc901b55bd09494723b226c0d9c76576f95ca8b0eef1483
SSDEEP 3072:5FJtel1QotTyzB+lLrOuxfBSw6jKy7JCEmOPXsaUTyso:5FrI1Qo5yzkpeXjnJFzXsW1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 420673b79ebfd4ebc102c5caccbb0d5a7df0ae453fb9245ecb3a2ecb72f8d75a
MD5 8c9bca06cf7ab33a5805b8cc015d9c25
SHA1 0ca1e4e8ec6982780370a400aca6f6d7f8624ba9
SHA512 a7e21397ba3ea50191a5e312df16f0c788ebee272e4ffb902b89cfad2961df09f23c4f5128a693ee9421f857b171227b75d8490eb9e3f4a9520ad09a6e69ba89
SSDEEP 3072:5oJtel1QotTyzB+lLrOuxfBSw6jKy7JCEmOPXsaUTyso:5orI1Qo5yzkpeXjnJFzXsW1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/636-8-0x00007FFF8CA90000-0x00007FFF8CAA0000-memory.dmp

Download

memory/636-25-0x000002DC02A60000-0x000002DC054C0000-memory.dmp

Download

memory/636-6-0x00007FFF8F570000-0x00007FFF8F580000-memory.dmp

Download

memory/636-4-0x00007FFFCF4E0000-0x00007FFFCF6E9000-memory.dmp

Download

memory/636-7-0x00007FFFCF4E0000-0x00007FFFCF6E9000-memory.dmp

Download

memory/636-3-0x00007FFF8F570000-0x00007FFF8F580000-memory.dmp

Download

memory/636-10-0x00007FFFCF4E0000-0x00007FFFCF6E9000-memory.dmp

Download

memory/636-11-0x00007FFFCF4E0000-0x00007FFFCF6E9000-memory.dmp

Download

memory/636-13-0x00007FFFCF4E0000-0x00007FFFCF6E9000-memory.dmp

Download

memory/636-15-0x00007FFFCF4E0000-0x00007FFFCF6E9000-memory.dmp

Download

memory/636-14-0x00007FFF8CA90000-0x00007FFF8CAA0000-memory.dmp

Download

memory/636-16-0x00007FFFCF4E0000-0x00007FFFCF6E9000-memory.dmp

Download

memory/636-12-0x00007FFFCF4E0000-0x00007FFFCF6E9000-memory.dmp

Download

memory/636-21-0x00007FFFCF4E0000-0x00007FFFCF6E9000-memory.dmp

Download

memory/636-20-0x00007FFFCF4E0000-0x00007FFFCF6E9000-memory.dmp

Download

memory/636-19-0x00007FFFCF4E0000-0x00007FFFCF6E9000-memory.dmp

Download

memory/636-18-0x00007FFFCF4E0000-0x00007FFFCF6E9000-memory.dmp

Download

memory/636-17-0x00007FFFCF4E0000-0x00007FFFCF6E9000-memory.dmp

Download

memory/636-9-0x00007FFFCF4E0000-0x00007FFFCF6E9000-memory.dmp

Download

memory/636-2-0x00007FFF8F570000-0x00007FFF8F580000-memory.dmp

Download

memory/636-22-0x000002DBA88D0000-0x000002DBA8A72000-memory.dmp

Download

memory/636-24-0x00007FFFCF4E0000-0x00007FFFCF6E9000-memory.dmp

Download

memory/636-23-0x00007FFFCF4E0000-0x00007FFFCF6E9000-memory.dmp

Download

memory/636-5-0x00007FFF8F570000-0x00007FFF8F580000-memory.dmp

Download

memory/636-26-0x000002DBFDE50000-0x000002DBFE0E4000-memory.dmp

Download

memory/636-27-0x000002DBFDBB0000-0x000002DBFDC0C000-memory.dmp

Download

memory/636-28-0x000002DBFE0F0000-0x000002DBFE2B2000-memory.dmp

Download

memory/636-29-0x000002DBFC750000-0x000002DBFC772000-memory.dmp

Download

memory/636-30-0x000002DBFF050000-0x000002DBFFDE0000-memory.dmp

Download

memory/636-31-0x000002DBFBE10000-0x000002DBFBE20000-memory.dmp

Download

memory/636-32-0x000002DBFBE40000-0x000002DBFBE4A000-memory.dmp

Download

memory/636-65-0x000002DBFC780000-0x000002DBFC7A2000-memory.dmp

Download

memory/636-66-0x00007FFFCF4E0000-0x00007FFFCF6E9000-memory.dmp

Download

memory/636-67-0x000002DC097E0000-0x000002DC0DAF6000-memory.dmp

Download

memory/636-68-0x000002DBFDC10000-0x000002DBFDC38000-memory.dmp

Download

memory/636-69-0x000002DBFDC90000-0x000002DBFDCE0000-memory.dmp

Download

memory/636-70-0x000002DBFBE50000-0x000002DBFBE60000-memory.dmp

Download

memory/636-71-0x000002DBFDC40000-0x000002DBFDC58000-memory.dmp

Download

memory/636-72-0x000002DB87CF0000-0x000002DB87D4A000-memory.dmp

Download

memory/636-92-0x00007FFFCF4E0000-0x00007FFFCF6E9000-memory.dmp

Download

memory/636-97-0x00007FFFCF583000-0x00007FFFCF584000-memory.dmp

Download

memory/636-98-0x00007FFFCF4E0000-0x00007FFFCF6E9000-memory.dmp

Download

memory/636-105-0x00007FFFCF4E0000-0x00007FFFCF6E9000-memory.dmp

Download

memory/636-117-0x00007FFFCF4E0000-0x00007FFFCF6E9000-memory.dmp

Download

memory/636-1-0x00007FFFCF583000-0x00007FFFCF584000-memory.dmp

Download

memory/636-0-0x00007FFF8F570000-0x00007FFF8F580000-memory.dmp

Download