44caliber | hxxps://drive[.]google[.]com/file/d/1qve3iSf9oNRMFDBK6L6PtZ62riAvijni/

Resubmissions

29-06-2024 17:18

240629-vvsmksvekj 10

29-06-2024 17:18

240629-vvjdxavejm 6

29-06-2024 17:17

240629-vt6stavdrn 6

Analysis

max time kernel
44s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 17:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1qve3iSf9oNRMFDBK6L6PtZ62riAvijni/

Score

10^/10

44caliber stealer

Malware Config

Extracted

Family

44caliber

https://discord.com/api/webhooks/1245777927996444672/Pa7yygBxmLV6IhAtwwDgpI19U8WDrrXjnkfKMOnjCmIIqRO_iV1wun5uVVtAfPq4Dt1R

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Executes dropped EXE 3 IoCs

Processes:

proTanki_tableCheatEngine_v1.0.3.exeproTanki_tableCheatEngine_v1.0.3.exeproTanki_tableCheatEngine_v1.0.3.exe

pid process

2832 proTanki_tableCheatEngine_v1.0.3.exe
1836 proTanki_tableCheatEngine_v1.0.3.exe
4448 proTanki_tableCheatEngine_v1.0.3.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

4 drive.google.com
7 drive.google.com

pid	process
2832	proTanki_tableCheatEngine_v1.0.3.exe
1836	proTanki_tableCheatEngine_v1.0.3.exe
4448	proTanki_tableCheatEngine_v1.0.3.exe

flow	ioc
4	drive.google.com
7	drive.google.com

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133641551540921794"	chrome.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

chrome.exetaskmgr.exe

pid	process
3512	chrome.exe
3512	chrome.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

3512 chrome.exe
3512 chrome.exe
3512 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe7zG.exetaskmgr.exe

description	pid	process
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeRestorePrivilege	1828	7zG.exe
Token: 35	1828	7zG.exe
Token: SeSecurityPrivilege	1828	7zG.exe
Token: SeSecurityPrivilege	1828	7zG.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeDebugPrivilege	1972	taskmgr.exe
Token: SeSystemProfilePrivilege	1972	taskmgr.exe
Token: SeCreateGlobalPrivilege	1972	taskmgr.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe7zG.exetaskmgr.exe

pid	process
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
1828	7zG.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe

Suspicious use of SendNotifyMessage 59 IoCs

Processes:

chrome.exetaskmgr.exe

pid	process
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3512 wrote to memory of 2884	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2884	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 2072	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 4360	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 4360	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 1740	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 1740	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 1740	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 1740	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 1740	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 1740	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 1740	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 1740	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 1740	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 1740	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 1740	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 1740	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 1740	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 1740	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 1740	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 1740	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 1740	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 1740	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 1740	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 1740	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 1740	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 1740	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 1740	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 1740	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 1740	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 1740	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 1740	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 1740	3512	chrome.exe	chrome.exe
PID 3512 wrote to memory of 1740	3512	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1qve3iSf9oNRMFDBK6L6PtZ62riAvijni/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfb36ab58,0x7ffcfb36ab68,0x7ffcfb36ab78
  2⤵
  PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1940,i,2979539561131917353,408902480330544292,131072 /prefetch:2
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1940,i,2979539561131917353,408902480330544292,131072 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2188 --field-trial-handle=1940,i,2979539561131917353,408902480330544292,131072 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3048 --field-trial-handle=1940,i,2979539561131917353,408902480330544292,131072 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3068 --field-trial-handle=1940,i,2979539561131917353,408902480330544292,131072 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4316 --field-trial-handle=1940,i,2979539561131917353,408902480330544292,131072 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4600 --field-trial-handle=1940,i,2979539561131917353,408902480330544292,131072 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 --field-trial-handle=1940,i,2979539561131917353,408902480330544292,131072 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4180 --field-trial-handle=1940,i,2979539561131917353,408902480330544292,131072 /prefetch:8
  2⤵
  PID:2516

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:668

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5040

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap30359:122:7zEvent18593
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1828

C:\Users\Admin\Desktop\proTanki_tableCheatEngine_v1.0.3.exe
"C:\Users\Admin\Desktop\proTanki_tableCheatEngine_v1.0.3.exe"
1⤵
- Executes dropped EXE
PID:2832

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1972

C:\Users\Admin\Desktop\proTanki_tableCheatEngine_v1.0.3.exe
"C:\Users\Admin\Desktop\proTanki_tableCheatEngine_v1.0.3.exe"
1⤵
- Executes dropped EXE
PID:1836

C:\Users\Admin\Desktop\proTanki_tableCheatEngine_v1.0.3.exe
"C:\Users\Admin\Desktop\proTanki_tableCheatEngine_v1.0.3.exe"
1⤵
- Executes dropped EXE
PID:4448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
af0653449402adb2ee70db7c1fea8b6b

SHA1
cace8e10e830c9d928481d4f99d731ea8ccca7be

SHA256
e3c0ba6f276b0dbcfa478dc916acd963aa69eacbeb57e35c04229a52109eed61

SHA512
e25c2f2ab752d11a2bf21e29a75c284727abb92a7d5617ef6a0476db35842403916316ae451afcc6e252416a13e063340c1f68adbc7eede565860eaae2ff1328

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
6189626b78ad042d1944026e8da5af59

SHA1
c45422b36339c578b214f22e643c2ef0b9850233

SHA256
c11c6a9af8bff8e1b492698a92c1bd8c3a2c0702417a458bb5518e63764c5bc7

SHA512
1914cfb78d0197d838aec848f65e5b5dd5994dce2058a34fdfe9590158a9219a984176a714329f6328006ae8b5d6a4c694229fa1863e3e93c817b3e7c4540b25

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
f576b06c10b1e4f9693426ae1fe2f7ab

SHA1
a33f110897f59454926b0f5c6a0f0092e252bfe2

SHA256
133837d70ae07755ed0505c35704628d0365c08dd69beecbaf13da660c32b785

SHA512
aefa812540cf4f8784e0f5ba3d2321ffe46f8984a00736e8f1ae6158f1ef731d05619c3de662dc8e95af2440b86a5b16becbd96dd07bc5b1c8f42f152072b7e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
138KB

MD5
186b6fa0c6bc6629cb648d8e58766682

SHA1
f95552b90d77446b7377ef3088939a78343380df

SHA256
2e705739ad291f1f4419e97d27084b0e95d4b7b12044f828f461fb9dd0f693a5

SHA512
1311d700057328c48646fc598e5d19a006562f9c1e84166f12769b314e14d59a6245e89589093e173c505293cb8ee69b0c7110945eb37c90abc3dbfbc411e78d

Download Submit
C:\Users\Admin\Desktop\proTanki_tableCheatEngine_v1.0.3.exe

Filesize
90KB

MD5
1580ec2391e97ed4b71b2a6392617dd5

SHA1
48a06af7d933adcb4a71b0319a09671ba754fcf0

SHA256
6b58d5db5a3f5563b25d84510f3f2d00aed8d0a2cffdec0fb28011c8a96cb899

SHA512
97ca6f38b0ba8a97c3dade1ecc2978eb70adee8b44d9d3b018100cee4e1f99e76fc1bc2b2be70c01f0561963b838a2efce2857c6d7d63eb48d82ebdbdc26d575

Download Submit
C:\Users\Admin\Desktop\proTanki_tableCheatEngine_v1.0.3.rar

Filesize
38KB

MD5
06b6e0c1dd2937df2f8589fea222613c

SHA1
27309918937ac973e3875244495fa390a19fda4c

SHA256
6f292f204ee2e41d8c1b9592ba144cfb87efe3cbf6ac8f83b7ad8dab5d924a10

SHA512
5205d98c0c88450cd575a4af0756b2d3b56a6899dd3570576fdc389b3fea6408d39732342274af64a0de50fa1f49b1a09d374ca9f14f6c6eda8442b1ab65e2be

Download Submit
\??\pipe\crashpad_3512_JKQKGPIXKVRVHTFJ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1972-104-0x0000018BC0B00000-0x0000018BC0B01000-memory.dmp

Filesize
4KB

Download
memory/1972-106-0x0000018BC0B00000-0x0000018BC0B01000-memory.dmp

Filesize
4KB

Download
memory/1972-105-0x0000018BC0B00000-0x0000018BC0B01000-memory.dmp

Filesize
4KB

Download
memory/1972-110-0x0000018BC0B00000-0x0000018BC0B01000-memory.dmp

Filesize
4KB

Download
memory/1972-116-0x0000018BC0B00000-0x0000018BC0B01000-memory.dmp

Filesize
4KB

Download
memory/1972-115-0x0000018BC0B00000-0x0000018BC0B01000-memory.dmp

Filesize
4KB

Download
memory/1972-114-0x0000018BC0B00000-0x0000018BC0B01000-memory.dmp

Filesize
4KB

Download
memory/1972-113-0x0000018BC0B00000-0x0000018BC0B01000-memory.dmp

Filesize
4KB

Download
memory/1972-112-0x0000018BC0B00000-0x0000018BC0B01000-memory.dmp

Filesize
4KB

Download
memory/1972-111-0x0000018BC0B00000-0x0000018BC0B01000-memory.dmp

Filesize
4KB

Download
memory/2832-98-0x00000289F0EE0000-0x00000289F0EFC000-memory.dmp

Filesize
112KB

Download
memory/2832-97-0x00007FFCE72C3000-0x00007FFCE72C5000-memory.dmp

Filesize
8KB

Download