Analysis
- max time kernel
149s - max time network
141s - platform
windows11-21h2_x64 - resource
win11-20240611-en - resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system - submitted
13/06/2024, 04:31
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe
Resource
win11-20240611-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe
- Size 1.1MB
- Sample240613-e5h8wsthng
- SHA256 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11
- MD5 241d861f295214e2ead617445c7e9b44
- SHA1 4f9b306f04712a504bb170309eefc6bc79b0c57b
- SHA512 c7a52c41459e49cfa2183f502650123f7d220634366a953e1c00e12c1ee947995b29ebfd701c4d34e1b26c2aafd1ed42aedf7f4afd5aa572847810337c3c7582
- SSDEEP 24576:eqDEvCTbMWu7rQYlBQcBiT6rprG8aud2+b+HdiJUX:eTvC/MTQYxsWR7aud2+b+HoJU
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133627266874414024" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1276817940-128734381-631578427-1000\{5C0BD41C-049A-41B6-8575-0120C223DD39} chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4892 chrome.exe 4892 chrome.exe 4672 chrome.exe 4672 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe - Suspicious use of FindShellTrayWindow 63 IoCs
pid Process 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 4892 chrome.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 4892 chrome.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe - Suspicious use of SendNotifyMessage 48 IoCs
pid Process 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3432 wrote to memory of 4892 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 80 PID 3432 wrote to memory of 4892 3432 00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe 80 PID 4892 wrote to memory of 3680 4892 chrome.exe 83 PID 4892 wrote to memory of 3680 4892 chrome.exe 83 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 3372 4892 chrome.exe 85 PID 4892 wrote to memory of 4524 4892 chrome.exe 86 PID 4892 wrote to memory of 4524 4892 chrome.exe 86 PID 4892 wrote to memory of 776 4892 chrome.exe 87 PID 4892 wrote to memory of 776 4892 chrome.exe 87 PID 4892 wrote to memory of 776 4892 chrome.exe 87 PID 4892 wrote to memory of 776 4892 chrome.exe 87 PID 4892 wrote to memory of 776 4892 chrome.exe 87 PID 4892 wrote to memory of 776 4892 chrome.exe 87 PID 4892 wrote to memory of 776 4892 chrome.exe 87 PID 4892 wrote to memory of 776 4892 chrome.exe 87 PID 4892 wrote to memory of 776 4892 chrome.exe 87 PID 4892 wrote to memory of 776 4892 chrome.exe 87 PID 4892 wrote to memory of 776 4892 chrome.exe 87 PID 4892 wrote to memory of 776 4892 chrome.exe 87 PID 4892 wrote to memory of 776 4892 chrome.exe 87 PID 4892 wrote to memory of 776 4892 chrome.exe 87 PID 4892 wrote to memory of 776 4892 chrome.exe 87 PID 4892 wrote to memory of 776 4892 chrome.exe 87 PID 4892 wrote to memory of 776 4892 chrome.exe 87 PID 4892 wrote to memory of 776 4892 chrome.exe 87 PID 4892 wrote to memory of 776 4892 chrome.exe 87 PID 4892 wrote to memory of 776 4892 chrome.exe 87 PID 4892 wrote to memory of 776 4892 chrome.exe 87 PID 4892 wrote to memory of 776 4892 chrome.exe 87 PID 4892 wrote to memory of 776 4892 chrome.exe 87 PID 4892 wrote to memory of 776 4892 chrome.exe 87 PID 4892 wrote to memory of 776 4892 chrome.exe 87 PID 4892 wrote to memory of 776 4892 chrome.exe 87 PID 4892 wrote to memory of 776 4892 chrome.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe"C:\Users\Admin\AppData\Local\Temp\00f657e627571e12a0b2a137634be49fa98913955d61bcce5cf8af9ac943de11.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xa0,0x10c,0x7fff7164ab58,0x7fff7164ab68,0x7fff7164ab783⤵PID:3680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1512 --field-trial-handle=1596,i,12797836862459410269,1763938343511140150,131072 /prefetch:23⤵PID:3372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1992 --field-trial-handle=1596,i,12797836862459410269,1763938343511140150,131072 /prefetch:83⤵PID:4524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2068 --field-trial-handle=1596,i,12797836862459410269,1763938343511140150,131072 /prefetch:83⤵PID:776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2812 --field-trial-handle=1596,i,12797836862459410269,1763938343511140150,131072 /prefetch:13⤵PID:4288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2820 --field-trial-handle=1596,i,12797836862459410269,1763938343511140150,131072 /prefetch:13⤵PID:2024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4240 --field-trial-handle=1596,i,12797836862459410269,1763938343511140150,131072 /prefetch:13⤵PID:2176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4488 --field-trial-handle=1596,i,12797836862459410269,1763938343511140150,131072 /prefetch:13⤵PID:2012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4548 --field-trial-handle=1596,i,12797836862459410269,1763938343511140150,131072 /prefetch:83⤵PID:2820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 --field-trial-handle=1596,i,12797836862459410269,1763938343511140150,131072 /prefetch:83⤵
- Modifies registry class
PID:1800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4732 --field-trial-handle=1596,i,12797836862459410269,1763938343511140150,131072 /prefetch:83⤵PID:2052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5012 --field-trial-handle=1596,i,12797836862459410269,1763938343511140150,131072 /prefetch:83⤵PID:2708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 --field-trial-handle=1596,i,12797836862459410269,1763938343511140150,131072 /prefetch:83⤵PID:2652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2496 --field-trial-handle=1596,i,12797836862459410269,1763938343511140150,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:4672
-
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2480
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 336B
- SHA256 bdffde84c3f4a5d24846d8880d02985abd866a0a47b1859328e60393e5235ec0
- MD5 313761e6e1ca590e79758123cbb3a99f
- SHA1 0d7e192bd1a141c5ef4288ea6af5c8258f9ff63c
- SHA512 681d5e59fcbab9e59578a4074241662efb78757b8516480c3730c8cf50f009aa583a263fbd37dd0dda50a1dc2e68a2757fcbdd4568afee48c8d2766ab1abb8e2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 ac05a651f61d0ff36a4065bdfd4162e43d480a568ccac532930221a0f9354f21
- MD5 94ffc07b64bd9b8b8413073ac5e8110d
- SHA1 d9ab93cf6cf753f15b57bf1a6058b4f411fac1fa
- SHA512 66285c371d36eb667a1f01b599047e595c9136c3981f607aeb82809eaedd4309d038522b4f7063c2f21f01f03412ab2c4ca9b3588b0783672d97e5ad77e67e77
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 19cc24df3e77f20dab9b3f714556481a568152ab0f55005d91a166d277a4ef5a
- MD5 a54fef11340e52e67ba6e251cdb0ad24
- SHA1 108aa6a172c22281ec3f9a2c7e68e6d8c96cdad4
- SHA512 221174601204984a6d2cc1dbe1cfa5b371634f613f3a60505ed7cfc35e49564cdd2642d076ec76b5a322314049efa99412c0411cdbf73d2876ec204e37c81b61
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 522B
- SHA256 f0581764f52acaa9c9dd4b27c9a4ed3f21ab4a1940cee01250552d34dc299b03
- MD5 c1901eabe948b9920b377de1aa8694e8
- SHA1 3b65f73b62ab774fdfe7c64081d090dd426d40ac
- SHA512 052d1e1eb502e73a7c3f258d757692878b66fa05849c982049debdfd5f4a4aa873387776512aae7c1e45b593bbb2e30165e606113729991a8aab2d4f4621fa4d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 520B
- SHA256 57abb39212f55405c8ce15e8718a7c58c0f64dd0daa859d1135284a27f7bccd8
- MD5 fc975427a55d355d9032dd4d87750f53
- SHA1 662ea5079d34ed0918c2c6a4c7e745b775898bab
- SHA512 53c0c5dc43d2d117b4f4083dde1b0b50b115cdf86144a6b190afc4d2395323bd8ae628733188b80fca7286452927b8d53448fcf1f80e4acf89e85bd0d647ad67
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 7KB
- SHA256 280806feed2040cd28c1e878be863852861b6dc1cc5532de1d28824e511d86f6
- MD5 178cb50fab01bb6b5dba3fd39739edcd
- SHA1 bff134a66ff185d945ab1d00344b7b6c9eada2d7
- SHA512 8f52facebe85f005082eada1d88bcaa4d0b24e8752af84ab26fee51749169587339f40317fc8dc1a4847d955b8ea06d489d32272d29a1d51ac5ecef0c6086abc
- SSDEEP 192:u7XdnGaaJma8iyh+FHOrUF6P5tjEsXtScR:u7XdWmeyqurUFWtIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 428bdcfb4bd8dc0b9940b2980ffb31fb28bd0047975cec40917ea11ed054cde7
- MD5 14e8e04a773100849521efccffc09b94
- SHA1 062cdeb8124a993203f483daba2aa101079d15f9
- SHA512 cceebbc45a9497107901a078fd18d69a3b9cf91c83e32acfa3d54218db2f98121e010a4b088704c29bb475308724915180dc20e8833f9a319f7deca8eb17fac4
- SSDEEP 384:CyTs7pLhLcsBhzX7N1kXqKf/pUZNCgVLH2Hf9aTrUSpHGYj1R2kpt:CEs7pLhL9Xb7N1kXqKf/pUZNCgVLH2HW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 274KB
- SHA256 a149e62be4b5538ca1e020fce6c05458d57cc1d3316b561f5b65031ea7c6977a
- MD5 5a28fdf8432379b03ea51c563d1b679b
- SHA1 9f73b1fb98358eb8c5bbc438ac8f3d2f7af5ed6f
- SHA512 0fc8b1f87fa11952f3252bba85d9ae570492f9fc4b0731392dae00fcf2712527f3e7bfb446b7ff959fb29acc880d34c851d97dd218080a7f2214d7ae1c70da62
- SSDEEP 6144:picE6pdf9wrlEzkbgfPH/iv0m4Mw5Qf2RSTIadDpwU5CAJ:picE6p0rBbgfiv732gTIadDhJ
- MD5 SHA1 SHA512 SSDEEP