Analysis
-
max time kernel
519s -
max time network
491s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
21-06-2024 03:34
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
Detect Blackmoon payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\Documents\Tomcat.exe family_blackmoon behavioral1/memory/4404-142-0x0000000000E20000-0x0000000000FDB000-memory.dmp family_blackmoon behavioral1/memory/4644-168-0x0000000000700000-0x00000000008BB000-memory.dmp family_blackmoon -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Bxksdn0w.exeBxksdn0w.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation Bxksdn0w.exe Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation Bxksdn0w.exe -
Drops startup file 1 IoCs
Processes:
Tomcat.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WPS.lnk Tomcat.exe -
Executes dropped EXE 4 IoCs
Processes:
Bxksdn0w.exeTomcat.exeBxksdn0w.exeTomcat.exepid process 4072 Bxksdn0w.exe 4404 Tomcat.exe 2852 Bxksdn0w.exe 4644 Tomcat.exe -
Processes:
resource yara_rule behavioral1/memory/4072-119-0x0000000010000000-0x0000000010014000-memory.dmp upx behavioral1/memory/4404-136-0x0000000002C70000-0x0000000002C88000-memory.dmp upx behavioral1/memory/2852-147-0x0000000010000000-0x0000000010014000-memory.dmp upx behavioral1/memory/4644-164-0x0000000002AF0000-0x0000000002B08000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133634144734138016" chrome.exe -
Modifies registry class 64 IoCs
Processes:
chrome.exechrome.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1" chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257" chrome.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags chrome.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell chrome.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 chrome.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe100000002f0283c647bcda01f71ee71854bcda01aff511168cc3da0114000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" chrome.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU chrome.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" chrome.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3} chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" chrome.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell chrome.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 chrome.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259} chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "4" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 chrome.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 chrome.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259} chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff chrome.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
chrome.exeBxksdn0w.exeTomcat.exeBxksdn0w.exeTomcat.exechrome.exepid process 3964 chrome.exe 3964 chrome.exe 4072 Bxksdn0w.exe 4072 Bxksdn0w.exe 4072 Bxksdn0w.exe 4072 Bxksdn0w.exe 4404 Tomcat.exe 4404 Tomcat.exe 4404 Tomcat.exe 4404 Tomcat.exe 4404 Tomcat.exe 4404 Tomcat.exe 4404 Tomcat.exe 4404 Tomcat.exe 4404 Tomcat.exe 4404 Tomcat.exe 4404 Tomcat.exe 4404 Tomcat.exe 4404 Tomcat.exe 4404 Tomcat.exe 4404 Tomcat.exe 4404 Tomcat.exe 4404 Tomcat.exe 4404 Tomcat.exe 4404 Tomcat.exe 4404 Tomcat.exe 4404 Tomcat.exe 4404 Tomcat.exe 4404 Tomcat.exe 4404 Tomcat.exe 4404 Tomcat.exe 4404 Tomcat.exe 2852 Bxksdn0w.exe 2852 Bxksdn0w.exe 2852 Bxksdn0w.exe 2852 Bxksdn0w.exe 4644 Tomcat.exe 4644 Tomcat.exe 4644 Tomcat.exe 4644 Tomcat.exe 4644 Tomcat.exe 4644 Tomcat.exe 4644 Tomcat.exe 4644 Tomcat.exe 4644 Tomcat.exe 4644 Tomcat.exe 4644 Tomcat.exe 4644 Tomcat.exe 4644 Tomcat.exe 4644 Tomcat.exe 4644 Tomcat.exe 4644 Tomcat.exe 4644 Tomcat.exe 4644 Tomcat.exe 4644 Tomcat.exe 4644 Tomcat.exe 4644 Tomcat.exe 4644 Tomcat.exe 4644 Tomcat.exe 4644 Tomcat.exe 4644 Tomcat.exe 4644 Tomcat.exe 3792 chrome.exe 3792 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
Processes:
chrome.exepid process 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe Token: SeShutdownPrivilege 3964 chrome.exe Token: SeCreatePagefilePrivilege 3964 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
chrome.exe7zG.exepid process 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 2376 7zG.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
chrome.exepid process 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe 3964 chrome.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
Bxksdn0w.exeTomcat.exeBxksdn0w.exeTomcat.exechrome.exechrome.exepid process 4072 Bxksdn0w.exe 4072 Bxksdn0w.exe 4072 Bxksdn0w.exe 4404 Tomcat.exe 2852 Bxksdn0w.exe 2852 Bxksdn0w.exe 2852 Bxksdn0w.exe 4644 Tomcat.exe 1480 chrome.exe 2388 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 3964 wrote to memory of 3940 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3940 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3328 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 4580 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 4580 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3508 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3508 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3508 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3508 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3508 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3508 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3508 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3508 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3508 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3508 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3508 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3508 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3508 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3508 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3508 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3508 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3508 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3508 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3508 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3508 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3508 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3508 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3508 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3508 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3508 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3508 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3508 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3508 3964 chrome.exe chrome.exe PID 3964 wrote to memory of 3508 3964 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://hsdfhhfpyc.com/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e903ab58,0x7ff8e903ab68,0x7ff8e903ab782⤵PID:3940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1904,i,8586636428115461549,6854263207160482922,131072 /prefetch:22⤵PID:3328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1904,i,8586636428115461549,6854263207160482922,131072 /prefetch:82⤵PID:4580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2232 --field-trial-handle=1904,i,8586636428115461549,6854263207160482922,131072 /prefetch:82⤵PID:3508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3048 --field-trial-handle=1904,i,8586636428115461549,6854263207160482922,131072 /prefetch:12⤵PID:3840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=1904,i,8586636428115461549,6854263207160482922,131072 /prefetch:12⤵PID:2952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4272 --field-trial-handle=1904,i,8586636428115461549,6854263207160482922,131072 /prefetch:12⤵PID:1208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 --field-trial-handle=1904,i,8586636428115461549,6854263207160482922,131072 /prefetch:82⤵PID:1848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4612 --field-trial-handle=1904,i,8586636428115461549,6854263207160482922,131072 /prefetch:82⤵PID:2464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 --field-trial-handle=1904,i,8586636428115461549,6854263207160482922,131072 /prefetch:82⤵PID:2888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5200 --field-trial-handle=1904,i,8586636428115461549,6854263207160482922,131072 /prefetch:12⤵PID:4876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4328 --field-trial-handle=1904,i,8586636428115461549,6854263207160482922,131072 /prefetch:82⤵PID:1216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4560 --field-trial-handle=1904,i,8586636428115461549,6854263207160482922,131072 /prefetch:12⤵PID:1464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3792 --field-trial-handle=1904,i,8586636428115461549,6854263207160482922,131072 /prefetch:82⤵PID:952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4656 --field-trial-handle=1904,i,8586636428115461549,6854263207160482922,131072 /prefetch:12⤵PID:2424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4588 --field-trial-handle=1904,i,8586636428115461549,6854263207160482922,131072 /prefetch:82⤵PID:2720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4860 --field-trial-handle=1904,i,8586636428115461549,6854263207160482922,131072 /prefetch:12⤵PID:5092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=2296 --field-trial-handle=1904,i,8586636428115461549,6854263207160482922,131072 /prefetch:12⤵PID:2564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5232 --field-trial-handle=1904,i,8586636428115461549,6854263207160482922,131072 /prefetch:82⤵PID:3992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4640 --field-trial-handle=1904,i,8586636428115461549,6854263207160482922,131072 /prefetch:82⤵PID:1524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=4404 --field-trial-handle=1904,i,8586636428115461549,6854263207160482922,131072 /prefetch:12⤵PID:1396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=4720 --field-trial-handle=1904,i,8586636428115461549,6854263207160482922,131072 /prefetch:12⤵PID:3388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=4412 --field-trial-handle=1904,i,8586636428115461549,6854263207160482922,131072 /prefetch:12⤵PID:1592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3184 --field-trial-handle=1904,i,8586636428115461549,6854263207160482922,131072 /prefetch:82⤵PID:4388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 --field-trial-handle=1904,i,8586636428115461549,6854263207160482922,131072 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5412 --field-trial-handle=1904,i,8586636428115461549,6854263207160482922,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 --field-trial-handle=1904,i,8586636428115461549,6854263207160482922,131072 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2388
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2408
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3860
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\dzfp24061000858 (2)\" -spe -an -ai#7zMap22326:100:7zEvent193141⤵
- Suspicious use of FindShellTrayWindow
PID:2376
-
C:\Users\Admin\Downloads\dzfp24061000858 (2)\Bxksdn0w.exe"C:\Users\Admin\Downloads\dzfp24061000858 (2)\Bxksdn0w.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4072 -
C:\Users\Admin\Documents\Tomcat.exe"C:\Users\Admin\Documents\Tomcat.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4404
-
-
C:\Users\Admin\Downloads\dzfp24061000858 (2)\Bxksdn0w.exe"C:\Users\Admin\Downloads\dzfp24061000858 (2)\Bxksdn0w.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2852 -
C:\Users\Admin\Documents\Tomcat.exe"C:\Users\Admin\Documents\Tomcat.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4644
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD5081c4aa5292d279891a28a6520fdc047
SHA1c3dbb6c15f3555487c7b327f4f62235ddb568b84
SHA25612cc87773068d1cd7105463287447561740be1cf4caefd563d0664da1f5f995f
SHA5129a78ec4c2709c9f1b7e12fd9105552b1b5a2b033507de0c876d9a55d31678e6b81cec20e01cf0a9e536b013cdb862816601a79ce0a2bb92cb860d267501c0b69
-
Filesize
840B
MD503cc097d6c02cf116571cda91ee19807
SHA176467e9d1afe66cdee36921a0deef1a3dd7f9f27
SHA256254ecdfe70546af26ddef49d090e36b0f802f2d67e020e2de79e92ca17ad7b3c
SHA51257bd778b9e47602d0c53e94aab4a76dfcefd81fc6d87c3e036db45a241801ba4e45bb6ebe14c8b82e8cc5d00bc36cec1bb3035c96f8e1f5eb61297b485e016ff
-
Filesize
840B
MD59e18372c5ccb0b462f9090aa581f1c34
SHA175a70fb8e4c51a35bc5223e3bf78d9ee649cf365
SHA2569fe4cbf27e55c59ee17bcb5bc7ceb96ba729e36d4705f3f6eea2b1dbd0325269
SHA51265c2283dee1a255098c07448e1fe43554c90b1ea71925d087c6ea0f98038297892fcd272be28aef4580646a3dfad101d7b85bfa3bdd7531346ed5cac5a6e8b3b
-
Filesize
1KB
MD5e934b2b8f1387df4c00091e13310ef51
SHA168f8b2fc57b986f21b290162f8ac6865314c97ab
SHA256cc0900c30cf18dfd6a912682174acfb9b2390c9967779eb5e38a420ab5297a37
SHA512e4013aca97c648ef30cc25bc8845a58928b222f4ccc89ae65edbc78fe4d5763b2e00e8d8ef3093f039d337a4817532f22bc41d73bf3fe8e12aee953550fcdf14
-
Filesize
1KB
MD569cca541140b8605669d311887887d9d
SHA1ba3e60a387eb4fbad168c8c31b62bd86cc24cc4e
SHA2566ad138e81de987b12aeadbff49d26004be1b90205e9f4d1f0dcd84a5fa4d9a18
SHA512786392c5dea16bb49e3e16c518098416f1a8cb6e648568d8d83452e3276f084b0d71440c2f9d52410e64c8426a68c1adc6c7727feee0676bd6e62aae13418bcd
-
Filesize
840B
MD5b79c188bf86514da34db3fd87371c506
SHA1a18750de82562032415525d7b89e7b447c701f32
SHA256470922ee051bc07ec6c2a3adc39cebf4f22ce6a49542afc1d87a3dfd2d4ad0a4
SHA5121a497d2b416ff03ee8f90edfe0c2332ff9513a5797e1d570827e7a85e1118eaaf7c39440f6c420e242030eaddce95c1250c1cf36d53306f1d0489fb5bb74e9ed
-
Filesize
1KB
MD50200dc43f8749987b3992f2bd58f8bb6
SHA1783f3e2b787e500a7d6780b5164f49c865859a79
SHA256de48081e0044ace1cff5dd116dfb6420745acd6b0f5626f6e9f4d2b9770f610c
SHA5126e71676e5c232525d389505e1319bdd0f868035c44a383a4a9558bc3e170cbb0d0803c86a96548c2913e8f199331e26ce7f48da2a502d98eb2c4ec66f1ae016d
-
Filesize
4KB
MD508801e1c577c3c05faf736f8926fe0eb
SHA1ab61e9ecf7389a682d31275a5fe0a1704cdde07b
SHA256529d25cc7757e67e71b6c93f5714c781f73ff7912883a50d31abbf53f67a2d78
SHA512c84ef7778f99e23a9284d9cee8d37a38c5255f9f93279836b39bd1d24dce68371bac22bd6ffe9de32a650dcb5cd3c92b87ed7a8aabc5b60ed4cc0a5c59a59437
-
Filesize
2KB
MD5df6254afac985bb6022a39615ed5b070
SHA147644f8b395139ebbb1e09c333308ab05111af2d
SHA256f7e2fcf0e516d1865c784f6333a577c5a637b97bbc9622c02a19adfa1b01bf84
SHA51247f58899ea82af9f1ec5c55b92cb4326fb8415c721dbb9ab2f3896d06ea4ebc24a36aa6ac0e8affa9e83169f8d466ca10bc3112e42fb30d4217d110153382bbc
-
Filesize
5KB
MD525e2564584f42713b4426272a0181017
SHA18b870c3001e2e0f69808335687d64f26fbda35c3
SHA256fc9b688734eb303d664d254e630b49fe591a93daf0a93c1218c9081d5740b5d2
SHA512ce655dbaf30c145629413c5be52cfd2f51fb0e5465430317d59583ff405ad1f0be654133a9ab07911030128187b7eb5ce66016f68fbaf3251e6a3d536ef23ebc
-
Filesize
4KB
MD5c57a53e77385d45320eb5c6857e9fc13
SHA14c1536c7da4a71a3865e73a1f02193b935b3498d
SHA2560fefd77aae1db57803459abb02ccff24a4af8a539b5e6817defdbb7af66cbee5
SHA512b94ab96eea10c3d383fb209b5101f4ff57fc0540ada57a384bc90a748084e2fc4b65369076d031851d3a51e8817ee89a9ccc73c1b1cbcbc85096e4223ea8b0e6
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
524B
MD5d75ddcffc7c0d53a95a93088eda4afbe
SHA11ba2203186e39f1fc5a312a2dea3752a60f0a8a6
SHA256e1cee8136d0d09625afcda36f2eced80779762f14fbe36141486201656ae5b27
SHA51224ec520affe4645dd7aa708b8ba231412676d61a32d1fb15703b0bc7d01512d749f4f863bf909f03d5e19f498440b2803257ed13b5f7d304e0b5924d47d2114b
-
Filesize
1KB
MD508e60cf0790b16950b4b0923e7c5454e
SHA11592b999cc28348d42920058c45afecbc06ec8c6
SHA2565f5eb3aa81a2386d0a149669063fb2f477031969ace686356a17138e80a367c8
SHA5122f4a893c3668ec4a8d07e0a4beabb8ff1e42393b768469eb5b1cddf8c091e9ec4e554dc7e042cc25d986a1093d11cbbddc0ef4376ad01afcc96a4c41f416afe4
-
Filesize
7KB
MD573233f10e0a21877b3299f450f24425c
SHA169c2c157068154fb36c0640c31972993d2c4b4c7
SHA25691036a2313498531db11f11799ea76e88e841cbe678f541e6ba99fc92152d88a
SHA51237de76b531462c183ee1b3cc2116f0df910c3bbd6caeea6e7a4ef1555935580dbd5007ed3f384f339e14bc89dce2ccc32201b172ca40e7d443876e801189b5e6
-
Filesize
8KB
MD511c16fcae603e9a4281b3ba00781d884
SHA19f67c128282580d804f4504456384f09a23dc654
SHA256600e180270dda6de0af989830bb9e6d6a274be1ca8a3b88604248de661d8c5bf
SHA51205ee13cca7dd1699aea0e814ea67effd817ac2144ddd205b259efc959efdc478787a6a940af9f5acbfed433b1f5b9058c24e7a5e40924640e6877747325e695e
-
Filesize
8KB
MD55af725f4a7981afe81ef9aadb2d04493
SHA1211ff14e212aa4df3eb2321defe404fbc65c0187
SHA256daf5a5e8ded85ee505a9c3c9279ca158366245aa5a308060fe5ba86042ab54c8
SHA512e99bb06a62c8530f884e37a0cd5cdf3cd67bb8d00ba8fcef5a0eaf5da1ae6afa487b8020e476997695dafe2ec1510a5192109b07259597fa83311f13606ae65f
-
Filesize
8KB
MD5ec6c13dec1a09b37558ca54445e38eb3
SHA1412993e99644493b0063ec231b6f582a8fa38fd0
SHA256dd2f8447bf68f9c035ae5f498512fb4ecf913012974c5b2e43770823cab28361
SHA5123b5ae63c1a699d3314da7229cbe1afdf88fbb70398bda20f757b965a57d76a0976951979f8284962ccb9064dfe843aafd1873e2deaa30928b1bf3f32bec0c5b8
-
Filesize
7KB
MD581efacca25ceb601d2ede3e4933d9398
SHA16593dc733df0b1fb579619947f07c9cca9fab24c
SHA25629979588c802480cdf4ae30a1d58eb168c7b3c6b37f6ec1128e8b430a1511fb1
SHA512fb71e99f55c80a4bf9a35cea3ac61350723817db1ad8d9edd661cc056ebaf24d8b3842fbf2d54523758697779ff3ed103df924c51b9590c2f806cc133ffc6f03
-
Filesize
7KB
MD5d8692d584d77b92a348b3292e10db514
SHA1e56dc01540e4fbe4202c238a8c5bed37f8cc7d94
SHA256ac9e60c8e1b45359e74fa70769ef0c190f83c2e65835fd654c7e7498d7f01026
SHA512cc155bacdcf5da82f869c28a219603986092a1f15b930b775c0ec45d95ab317c848adddbf71976bbaae48df29af0d8bf4c968e181ffe3d0b68bdc6b2fdfd38d2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize96B
MD5136abf1202e1de958f3ce2eae5d40236
SHA197ac8600eacc26df5a1d80e201b0aefea81d3380
SHA25615705f38b0f9a2bd810becc95a579bd328810a12b9194ed7660e104866ed1c14
SHA512e328b50f3d58a6e0f37bba1743c86dce5080d5fd65c0d4e9442fa84a3aaf32b48a452b2b50d7fe36155562b883f30b63d459bdbfa11f066926360229374bf46b
-
Filesize
138KB
MD5406182ce0c91dd54f1bf85bae55e355f
SHA1a43b43e7a90fc4a1d94c4be7bf64302dab612f1b
SHA256f75bb6f4ad0a5c5af517dd6cd60ee97c18218c2e9dd23a1d5343621ee2283038
SHA51293dc870b17a3978b68a823a70d7e878ec0614383d905c81fc47dc01cb50e1564f089f46da7d1c9fecc82a7c0ec500712f41f4e01a8242b1573da465c7035e160
-
Filesize
138KB
MD588a8d5d8f6c18cd6a58ea721ab38d07b
SHA1e64b795aa44055a2ad0b32b5435816e9f3251145
SHA25630a76a3f7d80c5aa414b382491961d633bdb2865bcdbee0574ff3b3b6c02f65d
SHA512e99eabe53b56be57d6a0d746895b1f472d0d26ee276a33d54004e5469151bf49aa03b2481471a0bd237a17bac534ac5369056266f8ba3368a6e651bfc5042cca
-
Filesize
1.6MB
MD55cd294b94371d13efabcd5da87debb1e
SHA1712b6a8ab8bf44ab750247e4f277887600896870
SHA25688f9e0380024e72ffcd753bb0501a48d2f166909f190ab866762be04afceee01
SHA512d13f8bb18a9e2a686bb12248efdaf6c56e563a7d095ad781c8fb9d85d641ab27cda308ab6a2cc04fe4298a31996c59a8a52564d8ef513057830a58a69b4c0470
-
Filesize
132B
MD59b1490685333876b4681b312466d65a5
SHA150e2bf8e692f0e0db52833e0d0367f0446b81d2b
SHA2562992c75e6d12de288efb9b9bad01092ad46400bad22785041e05ed19474bab76
SHA5122b2dbeaaf97fc2d33b3b77736f6838274f759716cb6516969f5c31caa7427aa8e1de836978abdec1b902044175b0bba9e5b9af2af630d5938a3d173fdec36ad2
-
Filesize
140B
MD5962b0ac1382559a59528aac12765f5ed
SHA13d13465f3e4750d65e73fc9eb8b7c2e7967ca282
SHA25692f3639eee1b531d926ee6d5aa3510554c7628b7819fe9058fae816b67a995e6
SHA512ab5debf0efb7b376883c0d884cac94ecb5b96ee5c3506c2d2d360c60cfb5b1e214b4dcec23b9d1257ef756850436f3feb55d3118a8ca32efcc20d2fbbea5bff2
-
Filesize
20.9MB
MD5a3e2e7ca1c713b9b456e8bf911e8b61b
SHA19271aebf8d93f52a7b0ee833bc30d3cdbeb60936
SHA256443335e6baaac1c32fc3c2cf39b31e7834391afd939215d0ae2e07b477c8baa2
SHA5125dc76548939292d19bb968d8e3333996ca220728265a0fe224469ed7dda27587a9cbf55739692084e4d52efc0c05dc084c5b86782506b1b7aba7fd48ef55b950
-
Filesize
10.8MB
MD54a2f3a927188466abf955e4967e9d99c
SHA1b0d8898acf140020fae7d7e45134511f77dd584d
SHA2562ee9593f968f5a4b2f2ad1b51dcf61b1e1f190717bee4c78f5dc9ce9f3a15856
SHA51286ca476a57aa1c31a3e53e9f111677444f70e322b20e13100daf9d845746ef147d1f6e7ada9f9a3825eb8a541a925141f7398bc6b16efcaf25e159a0d632d032
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e