43336782406f2c2ba84b016942c64bfbbe82cfda32ade4ee6d93a41ba051bd34

Resubmissions

26-06-2024 06:01

240626-grc6ts1hpn 10

26-06-2024 05:59

240626-gprw7syepb 10

Analysis

max time kernel
55s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-06-2024 05:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Size

147KB
MD5

448f1796fe8de02194b21c0715e0a5f6
SHA1

935c0b39837319fda571aa800b67d997b79c3198
SHA256

eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12
SHA512

0b93b2c881b1351ff688089abf12bbfcff279c5d6ca8733d6d821c83148d73c85cfedf5ab5bc02c2145970124b518551db3a9fc701d8084f01009ae20f71a831
SSDEEP

3072:l6glyuxE4GsUPnliByocWep0yjEJ3hDRMK89nB2:l6gDBGpvEByocWeebbMjV4

Score

10^/10

ransomware spyware stealer

Malware Config

Extracted

Path

C:\sYMY1N6ah.README.txt

Ransom Note

*** Welcome to Brain Cipher Ransomware! *** Dear managers! If you're reading this, it means your systems have been hacked and encrypted and your data stolen. *** The most proper way to safely recover your data is through our support. We can recover your systems within 4-6 hours. In order for it to be successful, you must follow a few points: 1.Don't go to the police, etc. 2.Do not attempt to recover data on your own. 3.Do not take the help of third-party data recovery companies. In most cases, they are scammers who will pay us a ransom and take a for themselves. *** If you violate any 1 of these points, we will refuse to cooperate with you!!! 3 steps to data recovery: 1. Download and install Tor Browser (https://www.torproject.org/download/) 2. Go to our support page: http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion 3. Enter your encryption ID: M8AL5cWJEU5CnMMPwCdt4x9NVn0ZY2uNtIgnKwkDJwdPbnanVROYFzGmgUCImexTGDmINYgSZXdlhM7D199lNMb294TGY2 Email to support: [email protected]

Emails

[email protected]

URLs

http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion

Signatures

Deletes itself 1 IoCs

Processes:

3801.tmp

pid	Process
1976	3801.tmp

Executes dropped EXE 1 IoCs

Processes:

3801.tmp

pid	Process
1976	3801.tmp

Loads dropped DLL 1 IoCs

Processes:

eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe

pid	Process
2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 2 IoCs

Processes:

eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe

description	ioc	Process
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe3801.tmp

pid	Process
2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
1976	3801.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exechrome.exe

pid	Process
2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
2280	chrome.exe
2280	chrome.exe

Suspicious behavior: RenamesItself 26 IoCs

Processes:

3801.tmp

pid	Process
1976	3801.tmp
1976	3801.tmp
1976	3801.tmp
1976	3801.tmp
1976	3801.tmp
1976	3801.tmp
1976	3801.tmp
1976	3801.tmp
1976	3801.tmp
1976	3801.tmp
1976	3801.tmp
1976	3801.tmp
1976	3801.tmp
1976	3801.tmp
1976	3801.tmp
1976	3801.tmp
1976	3801.tmp
1976	3801.tmp
1976	3801.tmp
1976	3801.tmp
1976	3801.tmp
1976	3801.tmp
1976	3801.tmp
1976	3801.tmp
1976	3801.tmp
1976	3801.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeBackupPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeDebugPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: 36	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeImpersonatePrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeIncBasePriorityPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeIncreaseQuotaPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: 33	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeManageVolumePrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeProfSingleProcessPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeRestorePrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeSecurityPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeSystemProfilePrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeTakeOwnershipPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeShutdownPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeDebugPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeBackupPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeBackupPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeSecurityPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeSecurityPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeBackupPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeBackupPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeSecurityPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeSecurityPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeBackupPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeBackupPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeSecurityPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeSecurityPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeBackupPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeBackupPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeSecurityPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeSecurityPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeBackupPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeBackupPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeSecurityPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeSecurityPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeBackupPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeBackupPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeSecurityPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeSecurityPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeBackupPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeBackupPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeSecurityPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeSecurityPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeBackupPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeBackupPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeSecurityPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeSecurityPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeBackupPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeBackupPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeSecurityPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeSecurityPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeBackupPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeBackupPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeSecurityPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeSecurityPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeBackupPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeBackupPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeSecurityPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeSecurityPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeBackupPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeBackupPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeSecurityPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
Token: SeSecurityPrivilege	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe

Suspicious use of FindShellTrayWindow 34 IoCs

Processes:

chrome.exe

pid	Process
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

chrome.exe

pid	Process
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe3801.tmpchrome.exe

description	pid	Process	procid_target
PID 2820 wrote to memory of 1976	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe	30
PID 2820 wrote to memory of 1976	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe	30
PID 2820 wrote to memory of 1976	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe	30
PID 2820 wrote to memory of 1976	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe	30
PID 2820 wrote to memory of 1976	2820	eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe	30
PID 1976 wrote to memory of 1528	1976	3801.tmp	31
PID 1976 wrote to memory of 1528	1976	3801.tmp	31
PID 1976 wrote to memory of 1528	1976	3801.tmp	31
PID 1976 wrote to memory of 1528	1976	3801.tmp	31
PID 2280 wrote to memory of 1104	2280	chrome.exe	34
PID 2280 wrote to memory of 1104	2280	chrome.exe	34
PID 2280 wrote to memory of 1104	2280	chrome.exe	34
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1916	2280	chrome.exe	35
PID 2280 wrote to memory of 1144	2280	chrome.exe	36
PID 2280 wrote to memory of 1144	2280	chrome.exe	36
PID 2280 wrote to memory of 1144	2280	chrome.exe	36
PID 2280 wrote to memory of 1612	2280	chrome.exe	37
PID 2280 wrote to memory of 1612	2280	chrome.exe	37
PID 2280 wrote to memory of 1612	2280	chrome.exe	37
PID 2280 wrote to memory of 1612	2280	chrome.exe	37
PID 2280 wrote to memory of 1612	2280	chrome.exe	37
PID 2280 wrote to memory of 1612	2280	chrome.exe	37
PID 2280 wrote to memory of 1612	2280	chrome.exe	37
PID 2280 wrote to memory of 1612	2280	chrome.exe	37
PID 2280 wrote to memory of 1612	2280	chrome.exe	37
PID 2280 wrote to memory of 1612	2280	chrome.exe	37

C:\Users\Admin\AppData\Local\Temp\eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
"C:\Users\Admin\AppData\Local\Temp\eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe"
1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820
- C:\ProgramData\3801.tmp
  "C:\ProgramData\3801.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\3801.tmp >> NUL
    3⤵
    PID:1528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fefc5f9758,0x7fefc5f9768,0x7fefc5f9778
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1340,i,9443410706881528016,16148289631025795446,131072 /prefetch:2
  2⤵
  PID:1916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1532 --field-trial-handle=1340,i,9443410706881528016,16148289631025795446,131072 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1620 --field-trial-handle=1340,i,9443410706881528016,16148289631025795446,131072 /prefetch:8
  2⤵
  PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1404 --field-trial-handle=1340,i,9443410706881528016,16148289631025795446,131072 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=1768 --field-trial-handle=1340,i,9443410706881528016,16148289631025795446,131072 /prefetch:1
  2⤵
  PID:920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1472 --field-trial-handle=1340,i,9443410706881528016,16148289631025795446,131072 /prefetch:2
  2⤵
  PID:2680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1432 --field-trial-handle=1340,i,9443410706881528016,16148289631025795446,131072 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3440 --field-trial-handle=1340,i,9443410706881528016,16148289631025795446,131072 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3556 --field-trial-handle=1340,i,9443410706881528016,16148289631025795446,131072 /prefetch:8
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2688 --field-trial-handle=1340,i,9443410706881528016,16148289631025795446,131072 /prefetch:8
  2⤵
  PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=1340,i,9443410706881528016,16148289631025795446,131072 /prefetch:8
  2⤵
  PID:2144

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1196

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2208

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x148
1⤵
PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini

Filesize
129B

MD5
52f84cfb0702fd3635da8329edde44b7

SHA1
72c2b7670e49610a473e040e374db364bb25e74c

SHA256
ef6549d57e08490681fee63202627189f6d83695feed2e1aa1064bce46357635

SHA512
0040370c4cb6978c24d942e9bee955c7aeb6f989c885d3837c9eee9d63ae8c76d505410ffc88e5284c7d2ade5c7ca9c55531665f6a2977086b37c1d122e254c4

Download Submit
C:\ProgramData\3801.tmp

Filesize
14KB

MD5
294e9f64cb1642dd89229fff0592856b

SHA1
97b148c27f3da29ba7b18d6aee8a0db9102f47c9

SHA256
917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

SHA512
b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\p42qCfV.sYMY1N6ah

Filesize
4.0MB

MD5
ee465985025bc869d93435ae6b437375

SHA1
199d21f949e6118a143e44e6c24c1556e97b5a59

SHA256
f7259e886b0e6402c0ca6fc8fe12485be6258bd3a131c47e82ed5153ecc65d0b

SHA512
235a6799fccc2bda8075247abc98ddce83c9ae7266611a6f124c67b45779a2072491b622ea1eab44fd0a009460a8211dc9c88fbcb6eb4d4deb52418728a071c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
8447cf2116eb990799a6b4d3403b8e86

SHA1
e901436c0f96b495b69cd881d83757d458cdc4da

SHA256
c43ab7aca60bbf1e4eedccbc8ce0e26facde9b91b74367a60c56604140611fe7

SHA512
9802928f7d55c2a6e79ec53bd70c8b007d94874873d6451dd416171133fc5c518075d2dc19109b5c50e064490eb3684c669fb024a3acbed0d78ba42c8607736d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
36ccc5ff7ceddc7f7ff844087146c25c

SHA1
fd5ae74f488f8d822aa0f0111c9dcc808cc5212f

SHA256
4eb05b853fe24cd945f797e32e047617ab0fbb5af53d25d5f41368bb5d416fc5

SHA512
cba3591e7730c40699d26cf8131262b0605f05dbbf9f16fe631cdf104558aa4a71342af7a1c2afda50b8b58c5cec7cfa58e0b889133dda86286856cca118ac5e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

Filesize
147KB

MD5
f1e95603c41e9a5edcd7acafe2e09179

SHA1
131db8baf239362ded09c66c04f7371f272effc8

SHA256
cfc3b3952e5f37c231809f4a434dbda6c1253789c0252a1e0ae459d62df299df

SHA512
045ca8ee4059f53ca543a9b6fca331ece350c862250cd73c76c9b4c3a49262bd52802ad9cb90720afd7643d5945163aa9c62f05fbadabfc11e72f248b3cc98a2

Download Submit
C:\sYMY1N6ah.README.txt

Filesize
1KB

MD5
deb2e0756d331362d57ad9fe408c4ff3

SHA1
870865aad7c7cccafbca0c1f50f7eecaedbd4bf1

SHA256
1ddacee1d25936970279557169037a335b362f86c3797ded625d68077bd0145c

SHA512
e218624d2704517a358df0dfb794116bbeed3ad81daae8c07d5d969e61e7936ed043911008f4816d663de373fd23515219c8038dd22e5838af7df1678a0134a6

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-1298544033-3225604241-2703760938-1000\DDDDDDDDDDD

Filesize
129B

MD5
093d6851eacbda47780722cb1e32a4c4

SHA1
dd1dec57b0465908aa20440db3e974b32f71b1e4

SHA256
42b456a1f689326851d843f1f30ee49ea3144354b1fdbaa96294455ac21726ec

SHA512
ca536e518b83f13f898ec6d4415a300ed0ac7ef9d02e88051529627193e4df62a624df1506962436577dab2afc90141dfb22ec6b919e64844cc7afd70d4cdd38

Download Submit
\??\pipe\crashpad_2280_HJCTLJQRTJZVRIUE

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1976-860-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/1976-861-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2820-0-0x0000000000380000-0x00000000003C0000-memory.dmp

Filesize
256KB

Download