Resubmissions
29/06/2024, 08:55
240629-kvv3laxdmn628/06/2024, 08:26
240628-kb466azdng728/06/2024, 04:33
240628-e6m88s1fkc6Analysis
- max time kernel
35s - max time network
38s - platform
windows11-21h2_x64 - resource
win11-20240508-en - resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system - submitted
29/06/2024, 08:55
Static task
static1
Behavioral task
behavioral1
Sample
chromeremotedesktophost.msi
Resource
win11-20240508-en
windows11-21h2-x64
17 signatures
1800 seconds
General
- Target chromeremotedesktophost.msi
- Size 20.5MB
- Sample240629-kvv3laxdmn
- SHA256 9cdd681fc86c1e816e652b0b5590d2e986b08bc26204e8048918a59c291051ce
- MD5 5f259c755b3dcbbbbc27f9513cddac61
- SHA1 0e672bad7b67cc1f234b265f3af21976935c4903
- SHA512 4c7f66962cecba4e753f3c996cc45bd102c6b7c6ab97bf85197091cfdb05ca82dd400f0888ead82927c61e3f45ea33e919a3a51da63cb5af1141a980f779fcb3
- SSDEEP 393216:CQzX7/PFKRpAvIpgY6KKsIHNHSHY7nTMkJ5K6cOomwZCtgO5gAkUmZbXF:tzX7/cTHAK1uASTMkboRCtgO1kUmZbX
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\M: msiexec.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF2803AE7E8090782F.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{EF2787B1-0F5C-449C-86FF-6F4D28DE3C46} msiexec.exe File created C:\Windows\SystemTemp\~DF601EB42BE76023BB.TMP msiexec.exe File created C:\Windows\Installer\e580cad.msi msiexec.exe File opened for modification C:\Windows\Installer\e580cad.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe - Loads dropped DLL 1 IoCs
pid Process 1488 MsiExec.exe -
pid Process 3632 powershell.exe - Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
- Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs
pid Process 3732 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000c993a456edcb2280000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800000c993a450000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809000c993a45000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d0c993a45000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000c993a4500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133641249745797450" chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4704 chrome.exe 4704 chrome.exe 1400 msiexec.exe 1400 msiexec.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3732 msiexec.exe Token: SeIncreaseQuotaPrivilege 3732 msiexec.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeSecurityPrivilege 1400 msiexec.exe Token: SeCreateTokenPrivilege 3732 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3732 msiexec.exe Token: SeLockMemoryPrivilege 3732 msiexec.exe Token: SeIncreaseQuotaPrivilege 3732 msiexec.exe Token: SeMachineAccountPrivilege 3732 msiexec.exe Token: SeTcbPrivilege 3732 msiexec.exe Token: SeSecurityPrivilege 3732 msiexec.exe Token: SeTakeOwnershipPrivilege 3732 msiexec.exe Token: SeLoadDriverPrivilege 3732 msiexec.exe Token: SeSystemProfilePrivilege 3732 msiexec.exe Token: SeSystemtimePrivilege 3732 msiexec.exe Token: SeProfSingleProcessPrivilege 3732 msiexec.exe Token: SeIncBasePriorityPrivilege 3732 msiexec.exe Token: SeCreatePagefilePrivilege 3732 msiexec.exe Token: SeCreatePermanentPrivilege 3732 msiexec.exe Token: SeBackupPrivilege 3732 msiexec.exe Token: SeRestorePrivilege 3732 msiexec.exe Token: SeShutdownPrivilege 3732 msiexec.exe Token: SeDebugPrivilege 3732 msiexec.exe Token: SeAuditPrivilege 3732 msiexec.exe Token: SeSystemEnvironmentPrivilege 3732 msiexec.exe Token: SeChangeNotifyPrivilege 3732 msiexec.exe Token: SeRemoteShutdownPrivilege 3732 msiexec.exe Token: SeUndockPrivilege 3732 msiexec.exe Token: SeSyncAgentPrivilege 3732 msiexec.exe Token: SeEnableDelegationPrivilege 3732 msiexec.exe Token: SeManageVolumePrivilege 3732 msiexec.exe Token: SeImpersonatePrivilege 3732 msiexec.exe Token: SeCreateGlobalPrivilege 3732 msiexec.exe Token: SeCreateTokenPrivilege 3732 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3732 msiexec.exe Token: SeLockMemoryPrivilege 3732 msiexec.exe Token: SeIncreaseQuotaPrivilege 3732 msiexec.exe - Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 3732 msiexec.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe - Suspicious use of SendNotifyMessage 12 IoCs
pid Process 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2220 osk.exe 2220 osk.exe 3732 msiexec.exe 3732 msiexec.exe 3732 msiexec.exe 3732 msiexec.exe 3732 msiexec.exe 3732 msiexec.exe 3732 msiexec.exe 3732 msiexec.exe 3732 msiexec.exe 2220 osk.exe 2220 osk.exe 2220 osk.exe 2220 osk.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 2220 osk.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 2220 osk.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 2220 osk.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 2220 osk.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 2220 osk.exe 3732 msiexec.exe 3732 msiexec.exe 3732 msiexec.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4704 wrote to memory of 4276 4704 chrome.exe 81 PID 4704 wrote to memory of 4276 4704 chrome.exe 81 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 3364 4704 chrome.exe 82 PID 4704 wrote to memory of 2748 4704 chrome.exe 83 PID 4704 wrote to memory of 2748 4704 chrome.exe 83 PID 4704 wrote to memory of 660 4704 chrome.exe 84 PID 4704 wrote to memory of 660 4704 chrome.exe 84 PID 4704 wrote to memory of 660 4704 chrome.exe 84 PID 4704 wrote to memory of 660 4704 chrome.exe 84 PID 4704 wrote to memory of 660 4704 chrome.exe 84 PID 4704 wrote to memory of 660 4704 chrome.exe 84 PID 4704 wrote to memory of 660 4704 chrome.exe 84 PID 4704 wrote to memory of 660 4704 chrome.exe 84 PID 4704 wrote to memory of 660 4704 chrome.exe 84 PID 4704 wrote to memory of 660 4704 chrome.exe 84 PID 4704 wrote to memory of 660 4704 chrome.exe 84 PID 4704 wrote to memory of 660 4704 chrome.exe 84 PID 4704 wrote to memory of 660 4704 chrome.exe 84 PID 4704 wrote to memory of 660 4704 chrome.exe 84 PID 4704 wrote to memory of 660 4704 chrome.exe 84 PID 4704 wrote to memory of 660 4704 chrome.exe 84 PID 4704 wrote to memory of 660 4704 chrome.exe 84 PID 4704 wrote to memory of 660 4704 chrome.exe 84 PID 4704 wrote to memory of 660 4704 chrome.exe 84 PID 4704 wrote to memory of 660 4704 chrome.exe 84 PID 4704 wrote to memory of 660 4704 chrome.exe 84 PID 4704 wrote to memory of 660 4704 chrome.exe 84 PID 4704 wrote to memory of 660 4704 chrome.exe 84 PID 4704 wrote to memory of 660 4704 chrome.exe 84 PID 4704 wrote to memory of 660 4704 chrome.exe 84 PID 4704 wrote to memory of 660 4704 chrome.exe 84 PID 4704 wrote to memory of 660 4704 chrome.exe 84 PID 4704 wrote to memory of 660 4704 chrome.exe 84 PID 4704 wrote to memory of 660 4704 chrome.exe 84 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\chromeremotedesktophost.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3732
-
C:\Windows\system32\osk.exe"C:\Windows\system32\osk.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:2220
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffaf5dcab58,0x7ffaf5dcab68,0x7ffaf5dcab782⤵PID:4276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1832,i,15992089288468100048,18319966366191258598,131072 /prefetch:22⤵PID:3364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1912 --field-trial-handle=1832,i,15992089288468100048,18319966366191258598,131072 /prefetch:82⤵PID:2748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2200 --field-trial-handle=1832,i,15992089288468100048,18319966366191258598,131072 /prefetch:82⤵PID:660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1832,i,15992089288468100048,18319966366191258598,131072 /prefetch:12⤵PID:5064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3116 --field-trial-handle=1832,i,15992089288468100048,18319966366191258598,131072 /prefetch:12⤵PID:1332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4232 --field-trial-handle=1832,i,15992089288468100048,18319966366191258598,131072 /prefetch:12⤵PID:3320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4560 --field-trial-handle=1832,i,15992089288468100048,18319966366191258598,131072 /prefetch:82⤵PID:1380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4724 --field-trial-handle=1832,i,15992089288468100048,18319966366191258598,131072 /prefetch:82⤵PID:3468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4080 --field-trial-handle=1832,i,15992089288468100048,18319966366191258598,131072 /prefetch:12⤵PID:2100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4772 --field-trial-handle=1832,i,15992089288468100048,18319966366191258598,131072 /prefetch:12⤵PID:1748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4112 --field-trial-handle=1832,i,15992089288468100048,18319966366191258598,131072 /prefetch:12⤵PID:3128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4068 --field-trial-handle=1832,i,15992089288468100048,18319966366191258598,131072 /prefetch:12⤵PID:824
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3772
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1400 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 866C1AC60F61714D1B7F6B7785E507E0 C2⤵
- Loads dropped DLL
PID:1488
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4876
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7833EEC03D04698F5F393317568CE15C2⤵PID:4916
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4B3CF5B1CC96C8ABCA1760623032B352 E Global\MSI00002⤵PID:1808
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass New-Item -ItemType SymbolicLink -Path 'C:\Program Files (x86)\Google\Chrome Remote Desktop\CurrentVersion' -Target 'C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\' -Force3⤵
- Command and Scripting Interpreter: PowerShell
PID:3632
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4136
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004C81⤵PID:1188
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
2Accessibility Features
1Installer Packages
1Privilege Escalation
Event Triggered Execution
2Accessibility Features
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 7KB
- SHA256 8c332ae08cf871b3fca6ebecc382ee85a6c9ebd9852e9e8cce4fc0c85cb35eab
- MD5 e38f00eb69f7fa58074708fd23bb4e89
- SHA1 ac0e4cd69b58b96f2e1c9499f349da2139a27281
- SHA512 01ac86996e5f3d1cd3ba83379967531120c71a39b48fd96d881deb7b9c8af5d73bd22de9a43b990f2b7b5f2dc159966a2cbf69a4390d58bb2593e8bb418640e5
- SSDEEP 96:7AzXJnpXq/iKIkJYN8iZRy7Dx+6MSmue3AIOBXgEt2MEVhYtjEsXt0/cgVup:72XlpbaJ68syh+FHAHFP5tjEsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 129KB
- SHA256 812f4f356c84356b277f3322bd3db879de0eb67d2d983e0ac4be7b1f7508c9d1
- MD5 32f19ed7d1731e07de1c43483990167c
- SHA1 f8b85318521c233ca3c77e355dfe1d69afd0e978
- SHA512 9da884c0cccffb24f25c0382dda4e69e5ac28890ada2af6cd4311f8fd8f937fd4c002d0ed3184f6df2ce9b4b038a4cad92a1ef7ce5f290f8b89c831dd57a0abb
- SSDEEP 3072:WJtel1QotTyzB+lLrOuxfBSw6jKy7JCEmOPXsaUTysS:WrI1Qo5yzkpeXjnJFzXsWf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSIEFCE.tmp
- Size 168KB
- SHA256 b9e73e5ab78d033e0328fc74a9e4ebbd1af614bc4a7c894beb8c59d24ee3ede9
- MD5 a0962dd193b82c1946dc67e140ddf895
- SHA1 7f36c38d80b7c32e750e22907ac7e1f0df76e966
- SHA512 118b0bd2941d48479446ed16ab23861073d23f9cc815f5f1d380f9977f18c34a71f61496c78b77b9a70f8b0a6cd08fe1edc1adb376dad5762ad0dd2068c64751
- SSDEEP 1536:ITrI12IxKBhPTpX1vPiAmd/Blv1JUQ9GTP4yl+UQ/b9wLDVkbcTx7sWjcdAle+ci:IPI12fvpN4yPtKUxEWe+cxZrxk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a1kjnxvo.p2h.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSIF0F.tmp
- Size 88KB
- SHA256 e24376a9346c2d486ce7426ca3ddc73cd020bb7216f8e5a0b9b2cb23caddcf31
- MD5 85fcf7b457b7194bbeb46db22fae05c3
- SHA1 5eca64d0d4ab4599852a475a7dd25beb88ae1c27
- SHA512 12d46c2d63d221adb288a89b2fe0b423d4ae7579c24c36d651a6ce9488bfdc669a1e8378309c28f7019c7cfc43fa87e99b4829cace97715c0b94ac9e2a758339
- SSDEEP 1536:EuBpEBa5arTkqbszXeYycSikLbsWjcdmbHpPpx/PS1h:H4/nqeYTkLkmbJPpx/PSv
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 12.8MB
- SHA256 71e340648a10f1762386664c5cc15876dc43b48cb20d5b954a29fe1f10d6f602
- MD5 b9445105fe2eda4610e46021bb3d931d
- SHA1 b9de77f2186dbc782e340d572d84ece62f34017b
- SHA512 9e6b5bb4600cbd45480cbd920b0f8e18189797ab675ffea610e3283a98eb9af81e14c2c0a28788ade8f8657e7e84e634b4bf825b697c1ee6210cd3b84fdbe3b7
- SSDEEP 12288:w0l1UbzH9QlO/bLnNwsuJ0GLjPlqoJ5yAavORq/WJOEkW0C5dHi3FZAm07TL9GRa:rIzdoO/v2lqokp2a9eKbbR9HTBN8Bb
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{453a990c-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{5702eb7f-9dec-420e-928d-74fc8538b21a}_OnDiskSnapshotProp
- Size 6KB
- SHA256 62e86c6863a6a2a2e6365c09e35debf2e400c91e7b51146bd704fa83ffbd75e4
- MD5 fea7c12c9426eb11287720d2359274ed
- SHA1 fbe692924c01c06fcc431a5cbf239c391e631850
- SHA512 c00373184bc7683e6f42a0dc614e8785ccd0573fb09ca5f2591fde3ec73ac6cf7215ad648188811bab9d2c2bbba2d864e2711611da348df38a0473a252519cb2
- SSDEEP 96:FlabTRcpADD84LTHzbOHXOHBlBRQL8Sc9XE56tOSVQpuN:ra5b++2VmN
- MD5 SHA1 SHA512 SSDEEP