Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2024, 10:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
Resource
win11-20240508-en
windows11-21h2-x64
14 signatures
150 seconds
General
-
Target
e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
-
Size
2.3MB
-
MD5
d06913fbee09bdfe1bb7cbb2b392c798
-
SHA1
127509ec2204bd8d16ce2355038755a0c53b01f7
-
SHA256
e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8
-
SHA512
18ae838dae507696a118cd8caacdc38230c20df15679e76b9490f5738b2eb742a161dd587a78d63d3f5bf0a90aac4ee9a4a2aa8fff164482709e6d1f945ad2d0
-
SSDEEP
49152:ZOC4iuI0MHyCRKsvOqoOuVDZ+bpBgNGOeOq068eNtGeZFLEKpZIYtB0Ck:ZOC4iuI0B9GVBgNGONiFikxEyb0C
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Wine e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe -
AutoIT Executable 13 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1672-3-0x00000000009C0000-0x0000000000F0E000-memory.dmp autoit_exe behavioral1/memory/1672-4-0x00000000009C0000-0x0000000000F0E000-memory.dmp autoit_exe behavioral1/memory/1672-5-0x00000000009C0000-0x0000000000F0E000-memory.dmp autoit_exe behavioral1/memory/1672-6-0x00000000009C0000-0x0000000000F0E000-memory.dmp autoit_exe behavioral1/memory/1672-7-0x00000000009C0000-0x0000000000F0E000-memory.dmp autoit_exe behavioral1/memory/1672-9-0x00000000009C0000-0x0000000000F0E000-memory.dmp autoit_exe behavioral1/memory/1672-10-0x00000000009C0000-0x0000000000F0E000-memory.dmp autoit_exe behavioral1/memory/1672-11-0x00000000009C0000-0x0000000000F0E000-memory.dmp autoit_exe behavioral1/memory/1672-61-0x00000000009C0000-0x0000000000F0E000-memory.dmp autoit_exe behavioral1/memory/1672-86-0x00000000009C0000-0x0000000000F0E000-memory.dmp autoit_exe behavioral1/memory/1672-87-0x00000000009C0000-0x0000000000F0E000-memory.dmp autoit_exe behavioral1/memory/1672-88-0x00000000009C0000-0x0000000000F0E000-memory.dmp autoit_exe behavioral1/memory/1672-94-0x00000000009C0000-0x0000000000F0E000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133640455256830920" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 4912 chrome.exe 4912 chrome.exe 216 chrome.exe 216 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe Token: SeShutdownPrivilege 4912 chrome.exe Token: SeCreatePagefilePrivilege 4912 chrome.exe -
Suspicious use of FindShellTrayWindow 63 IoCs
pid Process 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 4912 chrome.exe 4912 chrome.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe -
Suspicious use of SendNotifyMessage 60 IoCs
pid Process 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 4912 chrome.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1672 wrote to memory of 4912 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 88 PID 1672 wrote to memory of 4912 1672 e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe 88 PID 4912 wrote to memory of 2252 4912 chrome.exe 90 PID 4912 wrote to memory of 2252 4912 chrome.exe 90 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 1712 4912 chrome.exe 91 PID 4912 wrote to memory of 3916 4912 chrome.exe 92 PID 4912 wrote to memory of 3916 4912 chrome.exe 92 PID 4912 wrote to memory of 3768 4912 chrome.exe 93 PID 4912 wrote to memory of 3768 4912 chrome.exe 93 PID 4912 wrote to memory of 3768 4912 chrome.exe 93 PID 4912 wrote to memory of 3768 4912 chrome.exe 93 PID 4912 wrote to memory of 3768 4912 chrome.exe 93 PID 4912 wrote to memory of 3768 4912 chrome.exe 93 PID 4912 wrote to memory of 3768 4912 chrome.exe 93 PID 4912 wrote to memory of 3768 4912 chrome.exe 93 PID 4912 wrote to memory of 3768 4912 chrome.exe 93 PID 4912 wrote to memory of 3768 4912 chrome.exe 93 PID 4912 wrote to memory of 3768 4912 chrome.exe 93 PID 4912 wrote to memory of 3768 4912 chrome.exe 93 PID 4912 wrote to memory of 3768 4912 chrome.exe 93 PID 4912 wrote to memory of 3768 4912 chrome.exe 93 PID 4912 wrote to memory of 3768 4912 chrome.exe 93 PID 4912 wrote to memory of 3768 4912 chrome.exe 93 PID 4912 wrote to memory of 3768 4912 chrome.exe 93 PID 4912 wrote to memory of 3768 4912 chrome.exe 93 PID 4912 wrote to memory of 3768 4912 chrome.exe 93 PID 4912 wrote to memory of 3768 4912 chrome.exe 93 PID 4912 wrote to memory of 3768 4912 chrome.exe 93 PID 4912 wrote to memory of 3768 4912 chrome.exe 93 PID 4912 wrote to memory of 3768 4912 chrome.exe 93 PID 4912 wrote to memory of 3768 4912 chrome.exe 93 PID 4912 wrote to memory of 3768 4912 chrome.exe 93 PID 4912 wrote to memory of 3768 4912 chrome.exe 93 PID 4912 wrote to memory of 3768 4912 chrome.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe"C:\Users\Admin\AppData\Local\Temp\e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff530aab58,0x7fff530aab68,0x7fff530aab783⤵PID:2252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=2040,i,11923205151573166313,11945439531157603764,131072 /prefetch:23⤵PID:1712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1876 --field-trial-handle=2040,i,11923205151573166313,11945439531157603764,131072 /prefetch:83⤵PID:3916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2276 --field-trial-handle=2040,i,11923205151573166313,11945439531157603764,131072 /prefetch:83⤵PID:3768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3024 --field-trial-handle=2040,i,11923205151573166313,11945439531157603764,131072 /prefetch:13⤵PID:1176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3032 --field-trial-handle=2040,i,11923205151573166313,11945439531157603764,131072 /prefetch:13⤵PID:3300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4288 --field-trial-handle=2040,i,11923205151573166313,11945439531157603764,131072 /prefetch:13⤵PID:2000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3296 --field-trial-handle=2040,i,11923205151573166313,11945439531157603764,131072 /prefetch:83⤵PID:1588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3344 --field-trial-handle=2040,i,11923205151573166313,11945439531157603764,131072 /prefetch:83⤵PID:2284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4648 --field-trial-handle=2040,i,11923205151573166313,11945439531157603764,131072 /prefetch:83⤵PID:2716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1592 --field-trial-handle=2040,i,11923205151573166313,11945439531157603764,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:216
-
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2292
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4092,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:81⤵PID:3304
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216B
MD553fec90f5292fb461da40a4908dd9175
SHA170368787beb88456e7c5a4a91a81960a57e76f15
SHA25673cf6e2cda3adc55e4a2158b45bf3a98fb7d692eb0df0bcb32093e9b98e8ccd1
SHA512f207da685c970bd4f358421cb53bbf550d5105d7b83de0bfd249e2d40d55381c9fa180288c30b9e3862a6e026395b5b0c7fcc8163e30a7918f9ed6095db5005b
-
Filesize
2KB
MD526a36b2c09160bef2ee039c2a07812f3
SHA171936bcf2c194aa2d06aa6e836e30eeb489dc913
SHA2567285a6e2e2ddb02187953e1543e528bfef9ccde7a3165b3a66186153ea7df96c
SHA512b7d3de3477000acfe43dd0c138f818bdf88ee6570f35f4b893fff7ae6b62328a5b820180cc2f0b077e97773cf5a46b47845e33ee2f44bb5365ea8cccc166f970
-
Filesize
2KB
MD597ef1b960414b9cd60df256ddac6f092
SHA15f217d4423576ae6f14872d7ccf4dad674c81ff6
SHA256403482dd0226c9a875580ab7683e9b13ecc2a8806dc154309419442c1c179b82
SHA51210126256450844f5b93fe95279bccf40fa011c89201a3a1bc35884b59d301964267fb5cc913e35eb6e581e8fac20c25ca5c08cc60f0ff7ecb534ba172e2a6699
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
692B
MD566d685821c8e7e6e706a6d90b914665b
SHA1ec67e63b9b1dfd75d5b3287e8982763abebe2c26
SHA2563a212c04492f74808dd4e14330cbc6e42ea2ea8c172d6bc98a9bce10d9592de8
SHA512951dd3f36b5435cce4a46839630cf9f248bac46c586decb945c8a3ae46036992b96b1c93721fe3fa851010c99c43583868d8651a7e3c9738911dd4e489a3caa0
-
Filesize
7KB
MD58a467008b19955b2a48f9e8107825a9e
SHA14f756d4cdeb21ea87200d5442e1e2a69b819e960
SHA2567924460c8a252247c5877aefb91addb792b713181f8b853f13e187b45df862c0
SHA5124b20cd800bfd3393e76f75259c3d04287a767a34fd38283ff44868cf957261340414745c7aef97422d09f7822e80e687453c4a6fd7716af6316d4d52db2d180a
-
Filesize
16KB
MD5c71fbaf4ab5fd5907dd547fbb12c83f6
SHA137b0bcbe5d527f7006c3cb5ac7d596ec8ce15ea5
SHA2565a7fbd37d3862c3e2146d107b95ac539e165b4b54af622fe06dc4fe658077949
SHA51224ba5e772ab6b2b4c8d56d386352bdfa3aa0ab222e473339e6adaa1e9b2db03d84fb77b85875d1c74f56cded6d46093daedb9fcd6e700a909b2d212928fc541f
-
Filesize
272KB
MD515e7c4b1dd5fbec0f7124a03cda15795
SHA13f2b9164cac1f03862f88f1a0cbbab60b1955c45
SHA2565e5f6534d4e6efe807ed791bf54f2e185a7a9f9a6c4a52ed9683df54418a09f9
SHA5125b6042436b74fced9438a1a80061979378027b03f9e2380efd4e9a511419d95bbdb3372edb5ce0ba7abff6c21bf40fc2a3bd53914cbc71b8b066090111eb242c