Analysis
-
max time kernel
120s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03-07-2024 13:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win7-20240508-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
Loader.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
Loader.exe
-
Size
48KB
-
MD5
3668e97d95b35672e4a8eb7cb1da1cf5
-
SHA1
2dc3e500ac21d9c07af38e5f70f83ec7bc30bace
-
SHA256
dc06db1dc05fad16aa820074f03db3cf2cea5f5b9e5ff9136f5cad896ccf0ab8
-
SHA512
61952fedcec08d8d940899381bef50a0e82cb86f226a4d207eccaa0958da6f71f517fb5ba2e704dfce320812bf1ba7e03fa934fb860cd57d69f43cc625195507
-
SSDEEP
768:zt5DuFP8FFIHGD+pqSh151a0SszvW4loC8DcztQcCZzt236dCuOMc:7DSPja+gS91aMzdxztQlZztPdCuRc
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe Loader.exe File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe Loader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies registry class 47 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags Loader.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}" Loader.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9} Loader.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4" Loader.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0c00000050000000a66a63283d95d211b5d600c04fd918d00b0000007800000030f125b7ef471a10a5f102608c9eebac0e00000078000000 Loader.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" Loader.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff Loader.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Loader.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0" Loader.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "1" Loader.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlot = "2" Loader.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} Loader.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 Loader.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg Loader.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2" Loader.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" Loader.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings Loader.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Loader.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000 Loader.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff Loader.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" Loader.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Loader.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Loader.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000 Loader.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Loader.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1" Loader.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Loader.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Loader.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg Loader.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC} Loader.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616257" Loader.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "16" Loader.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 Loader.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6" Loader.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" Loader.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Loader.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" Loader.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Loader.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48" Loader.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" Loader.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell Loader.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Loader.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Loader.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}" Loader.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders Loader.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg Loader.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Loader.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2136 chrome.exe 2136 chrome.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1944 Loader.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe -
Suspicious use of FindShellTrayWindow 53 IoCs
pid Process 1944 Loader.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1944 Loader.exe 1944 Loader.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1944 wrote to memory of 2520 1944 Loader.exe 30 PID 1944 wrote to memory of 2520 1944 Loader.exe 30 PID 1944 wrote to memory of 2520 1944 Loader.exe 30 PID 2432 wrote to memory of 2136 2432 Loader.exe 41 PID 2432 wrote to memory of 2136 2432 Loader.exe 41 PID 2432 wrote to memory of 2136 2432 Loader.exe 41 PID 2432 wrote to memory of 2136 2432 Loader.exe 41 PID 2136 wrote to memory of 2004 2136 chrome.exe 42 PID 2136 wrote to memory of 2004 2136 chrome.exe 42 PID 2136 wrote to memory of 2004 2136 chrome.exe 42 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 2176 2136 chrome.exe 44 PID 2136 wrote to memory of 1392 2136 chrome.exe 45 PID 2136 wrote to memory of 1392 2136 chrome.exe 45 PID 2136 wrote to memory of 1392 2136 chrome.exe 45 PID 2136 wrote to memory of 2896 2136 chrome.exe 46 PID 2136 wrote to memory of 2896 2136 chrome.exe 46 PID 2136 wrote to memory of 2896 2136 chrome.exe 46 PID 2136 wrote to memory of 2896 2136 chrome.exe 46 PID 2136 wrote to memory of 2896 2136 chrome.exe 46 PID 2136 wrote to memory of 2896 2136 chrome.exe 46 PID 2136 wrote to memory of 2896 2136 chrome.exe 46 PID 2136 wrote to memory of 2896 2136 chrome.exe 46 PID 2136 wrote to memory of 2896 2136 chrome.exe 46 PID 2136 wrote to memory of 2896 2136 chrome.exe 46 PID 2136 wrote to memory of 2896 2136 chrome.exe 46 PID 2136 wrote to memory of 2896 2136 chrome.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2520
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2672
-
C:\Windows\system32\verclsid.exe"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x4011⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef49d9758,0x7fef49d9768,0x7fef49d97783⤵PID:2004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1268,i,4823557878638618701,1295390876172387684,131072 /prefetch:23⤵PID:2176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 --field-trial-handle=1268,i,4823557878638618701,1295390876172387684,131072 /prefetch:83⤵PID:1392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1588 --field-trial-handle=1268,i,4823557878638618701,1295390876172387684,131072 /prefetch:83⤵PID:2896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2076 --field-trial-handle=1268,i,4823557878638618701,1295390876172387684,131072 /prefetch:13⤵PID:2560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2084 --field-trial-handle=1268,i,4823557878638618701,1295390876172387684,131072 /prefetch:13⤵PID:2508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1148 --field-trial-handle=1268,i,4823557878638618701,1295390876172387684,131072 /prefetch:23⤵PID:2248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1336 --field-trial-handle=1268,i,4823557878638618701,1295390876172387684,131072 /prefetch:13⤵PID:1940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3304 --field-trial-handle=1268,i,4823557878638618701,1295390876172387684,131072 /prefetch:83⤵PID:1228
-
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2824
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
140KB
MD56e22acc1222b23db81bb459718d93f53
SHA102d2eb0ccc8dc5c72463a6e8b7fed69da4563754
SHA256775f9a456344cc18e079096e19a4f3e9dbdeb9415a6d516a34934859d9853bb4
SHA5120ba6640714ba6703b0125dce47ef0b1c98bbd608a6fc547d8424a69bafeca8f307944fd98dfdd6c13996e826f5cf06c132fe99e1af642151c1279aebb4962b7f
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
53B
MD543d5d300d710001cc331581c761169fb
SHA13e4d1a088c1f6d498c84f3c86de73ce49f82a104
SHA256b98a42e7e75a66429bf21f48d54033a6083eaf101bd296b5fe5a63134c2b6565
SHA512e1d6d85a8b63c1fba8d2a74e7dd3b80f0f9eeafa9862a27d24e4e475b2d9d68baab0b8ad03978230197287b04ac51a5a28b43ef73a3278ee899ceed12108ecb3