nanocore | e8713b84ea80e0553edb04dfbdcf5feb8d5ff57ee116c5f77e092b08a9898f8b

Resubmissions

22-07-2024 16:15

240722-tql4kawcra 10

22-07-2024 15:58

240722-tevxbswejn 10

22-07-2024 15:53

240722-tb1y6swcrn 10

22-07-2024 15:37

240722-s2ryhsvhnr 10

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Jako Gen Source Code.exe
Size

203KB
MD5

cf4eb39d02324430fde9a09b0c36e321
SHA1

5c6e77058e920d61ba74207027df073763905310
SHA256

e8713b84ea80e0553edb04dfbdcf5feb8d5ff57ee116c5f77e092b08a9898f8b
SHA512

332b5f3e25db8771b8f7afd9ded17e13e40bfa606377f4ba3531e46d9a6f080e81d7b826e8a5631b7131d50141e901d269cd78d595255705fdd390439b6bfaec
SSDEEP

3072:UzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIq3grv/ZCSAjdcedtBWn6BXiLL:ULV6Bta6dtJmakIM5LISpWbBNV82UG

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Jako Gen Source Code.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AGP Service = "C:\\Program Files (x86)\\AGP Service\\agpsv.exe"	Jako Gen Source Code.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Jako Gen Source Code.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Jako Gen Source Code.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Jako Gen Source Code.exe

Drops file in Program Files directory 2 IoCs

Processes:

Jako Gen Source Code.exe

description	ioc	process
File created	C:\Program Files (x86)\AGP Service\agpsv.exe	Jako Gen Source Code.exe
File opened for modification	C:\Program Files (x86)\AGP Service\agpsv.exe	Jako Gen Source Code.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133661373250327156"	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

892 schtasks.exe
2760 schtasks.exe

pid	process
892	schtasks.exe
2760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

Processes:

Jako Gen Source Code.exechrome.exe

pid	process
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
4148	chrome.exe
4148	chrome.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe
1968	Jako Gen Source Code.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Jako Gen Source Code.exe

pid process

1968 Jako Gen Source Code.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

4148 chrome.exe
4148 chrome.exe
4148 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Jako Gen Source Code.exechrome.exe

description	pid	process
Token: SeDebugPrivilege	1968	Jako Gen Source Code.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe
Token: SeCreatePagefilePrivilege	4148	chrome.exe
Token: SeShutdownPrivilege	4148	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Jako Gen Source Code.exechrome.exe

description	pid	process	target process
PID 1968 wrote to memory of 892	1968	Jako Gen Source Code.exe	schtasks.exe
PID 1968 wrote to memory of 892	1968	Jako Gen Source Code.exe	schtasks.exe
PID 1968 wrote to memory of 892	1968	Jako Gen Source Code.exe	schtasks.exe
PID 1968 wrote to memory of 2760	1968	Jako Gen Source Code.exe	schtasks.exe
PID 1968 wrote to memory of 2760	1968	Jako Gen Source Code.exe	schtasks.exe
PID 1968 wrote to memory of 2760	1968	Jako Gen Source Code.exe	schtasks.exe
PID 4148 wrote to memory of 2692	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2692	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2328	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 3320	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 3320	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2280	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2280	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2280	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2280	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2280	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2280	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2280	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2280	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2280	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2280	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2280	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2280	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2280	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2280	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2280	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2280	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2280	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2280	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2280	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2280	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2280	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2280	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2280	4148	chrome.exe	chrome.exe
PID 4148 wrote to memory of 2280	4148	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\Jako Gen Source Code.exe
"C:\Users\Admin\AppData\Local\Temp\Jako Gen Source Code.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "AGP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp978D.tmp"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:892

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "AGP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp980B.tmp"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4148

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff97a74cc40,0x7ff97a74cc4c,0x7ff97a74cc58
2⤵
PID:2692

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1836,i,3402043433043692707,15016458256383676580,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=1828 /prefetch:2
2⤵
PID:2328

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1692,i,3402043433043692707,15016458256383676580,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=1700 /prefetch:3
2⤵
PID:3320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2280,i,3402043433043692707,15016458256383676580,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2448 /prefetch:8
2⤵
PID:2280

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3160,i,3402043433043692707,15016458256383676580,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3180 /prefetch:1
2⤵
PID:1512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3212,i,3402043433043692707,15016458256383676580,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3232 /prefetch:1
2⤵
PID:1668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4072,i,3402043433043692707,15016458256383676580,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4520 /prefetch:1
2⤵
PID:4684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4828,i,3402043433043692707,15016458256383676580,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4836 /prefetch:8
2⤵
PID:4716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5068,i,3402043433043692707,15016458256383676580,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=5064 /prefetch:8
2⤵
PID:5056

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:1904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
6d7bdfa0774dff78433d3adb0b6bebd9

SHA1
82776913e0d0e3ef5838edb60ad477913252da26

SHA256
f4411aea5fe15df42083b8d59210efbab01bfdbd304c7299a63977fb857a0eda

SHA512
1d34d62e201d108f66a75359ac195fbd95a93a993b81373c9fd9e3942c9bb3614f7aecf62120846496f05873d0d8f8b625d2ee6f4f9738eeeec738973678f9c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
ec8358f31f7d0ca2bc489de2116398d8

SHA1
e9e20a05cdd0fe42bb881f5a6b861a23a64b9c1f

SHA256
e970bfb157892f5876ed4dd10ef779bf23bbd4bcae76cdb2dc6fcd5dc06c8163

SHA512
11af004b87f615155c04324f16aba6dcbc56cc4b4ca16618c73a72334ebf40075cd64cc5d49b9ee5b8f5aed2c76554d6391ce23229e8f26ee9fdfac1d9366353

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
e375379e02b992b3485271482b5ab6c5

SHA1
c107526995f33c4d4721ed86a19cd711c78ed3ef

SHA256
b66241f3f58855613c79ae5e17311755bfb4749d4f69c928b5586eb488fb9a91

SHA512
26edf5c9ca22e7bc45aa17285fcc6c9c3db2ce75c99cd10e4c7e7c1936df6e069d906da5d1a39247948f2cb87f251bf5ea75f74d9bd77b069a843cbd2fa814ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
4caabe27d1f453ed66b4865a4f5b290b

SHA1
f09b705b76d252e7022231b7dd7ed0181af8ef1d

SHA256
5e3c9ec8da9ccf2df3858536ce27ec26328baba01de1aacb2fa8dd23fc828510

SHA512
c2a5b62b723f370d013fc18fb7019a525206bbef0128a5d767972f468e05b4585ee32712a75565056a0c0fa28beab73423c6a81f846528dcd42115c36e7318ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
3de9088ce4ed341c7b892d09489c731c

SHA1
3e0597135809a3e19d3ab1496408b330d2a5a808

SHA256
ae2d95fcdefc3f1820e8dbbf390d281bdf14b8a15541160ec404331f414853c7

SHA512
cea2a7ebbda2f30ed2718e827236f75c28c7e018e3303c1bc4cc05a591aaf5ee7e5ad5cd91b5fc660806fd21ad81c66ac6a6a85d4ea11dac3ebb8fe9645ddbd6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
903f64a1c9f2d27b5e26c4885af5948e

SHA1
77ee0aeff066b3e4aa67df0cb7db5357a451896c

SHA256
3cc73b2f7f24eeec8d7d02ea52c2b1cbfcced475725b82932a052407af567fbf

SHA512
6ebdee91bad962a9cb373c3a6186cd61ca91c6f4e6a494267bc503356a269072ea59e0fa569ae10fcab0a25825d7c5ff0bfdb1cbda57a2380450b38333cd4cd6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
4ac7e21b1a4ca09d98477894fbfed3ca

SHA1
9e976bb36cf3e0de67df54ebde56fe9e5f5b6e01

SHA256
be1a63bc4f9a53d2a4d783560e66ad3cbb16c7dca3369c9561a01b4f2c5e9f32

SHA512
e165e5a81d252e58e821f437f16b1c93ea47a98b1e67b173ab9d1bdd51412b4657123439c69d05b981687fe9d7a64291ae1bf927867dd9953ef8fe277050609b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
185KB

MD5
062634a50eabf37619a681edd3b0bd4e

SHA1
cf23d0935235da30c951395f2b07195cea23da53

SHA256
bc79c7224829a47827ee8072408792e7bf346d2ee5b760b5c5a5b4f4b4fc44e2

SHA512
3efcf82aa8d06a8dc07e8140e40a98037135baa1ddb55d0cd586ff09c6cc5b38ae883e5205ebc583a76a580bf1a2f7a13e8e880f4a979c5bce0c4f9de63f2db6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
185KB

MD5
dcfc765635f6f6b159b04d3bea2c6ceb

SHA1
1c7242a2473a679de69f90166a04bccffd196427

SHA256
652559b2453c790da2327810252a6ba05261b612b48d2ae44a67ef31b5e33d9b

SHA512
335179bde31e8a5d2e325802d32680151bab2a264627da304aab0f0d8dab21ca7c44d4d407fba3209a718ce2d374a09823b346394b5f509549cec915f53b1cdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp978D.tmp

Filesize
1KB

MD5
db325bebc82dd6d76c00239301b1170c

SHA1
78dad3a14d69a80147c6f8bd7be1d5cd226015e6

SHA256
77701b041ffaa9b1733bcea92c0d4a954675dd7f6d62a7a7ad555cc2c05c5b35

SHA512
6e7e3067a568efcfe5c58ba6c105353a36c2f8169b05e6569f5131229408d864dec8647a193d9bff59fe7fc264d84525bd149d5e5f90ecbad24152505f7ba227

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp980B.tmp

Filesize
1KB

MD5
7a81ae69c04c8d95261eb5f490b7f869

SHA1
9f4f484d306fea15b2e7f9f16db660833bb1f8ce

SHA256
ce3933e772f663a834335cc2071e5e7b2d49a065b51d84a259054b8ef663e785

SHA512
8260ab83106752a488e164bbed63ef334d34399bc9a5c09a0cfceba6aef48eafe5c64e4dfbd353ac3edfff2523b16c2b0287d34833a293c4436e068fae656de8

Download Submit
\??\pipe\crashpad_4148_XAOCVRWEFVHXLKYH

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1968-16-0x0000000074A40000-0x0000000074FF1000-memory.dmp

Filesize
5.7MB

Download
memory/1968-15-0x0000000074A40000-0x0000000074FF1000-memory.dmp

Filesize
5.7MB

Download
memory/1968-14-0x0000000074A40000-0x0000000074FF1000-memory.dmp

Filesize
5.7MB

Download
memory/1968-13-0x0000000074A42000-0x0000000074A43000-memory.dmp

Filesize
4KB

Download
memory/1968-12-0x0000000074A40000-0x0000000074FF1000-memory.dmp

Filesize
5.7MB

Download
memory/1968-11-0x0000000074A40000-0x0000000074FF1000-memory.dmp

Filesize
5.7MB

Download
memory/1968-0-0x0000000074A42000-0x0000000074A43000-memory.dmp

Filesize
4KB

Download
memory/1968-4-0x0000000074A40000-0x0000000074FF1000-memory.dmp

Filesize
5.7MB

Download
memory/1968-2-0x0000000074A40000-0x0000000074FF1000-memory.dmp

Filesize
5.7MB

Download
memory/1968-1-0x0000000074A40000-0x0000000074FF1000-memory.dmp

Filesize
5.7MB

Download