077fbfcf6bbc5690d8f7ad368a6414a0ca3ca4117d148e637b0ea07146c69809

Analysis

max time kernel
78s
max time network
272s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 16:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Creal.pyc
Size

108KB
MD5

827fee64b0b3073f98bd0c945081f337
SHA1

1bd490373e23f3db124f2049bf0081258b836139
SHA256

67c6aab3dc0f448c4b4de7c0fce857961e098986ccabb7c71fb9f48aef29aad2
SHA512

dd85c046bac960cfb4f2bb432ec5eee74e8fbfc48fbbb1727f9c140acf6fff2ff47ffb84828abf9ea470a2eb4216607f5ed062065345a1719f54d0780ab2fbc7
SSDEEP

3072:nV7MaNdUcd63LDAFT8+IiEssh00mH0PtZ8IKEDRc:aQUgW33Hlc

Score

6^/10

discovery pyinstaller

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
41	raw.githubusercontent.com
33	raw.githubusercontent.com
34	raw.githubusercontent.com
35	raw.githubusercontent.com
36	raw.githubusercontent.com
39	raw.githubusercontent.com
40	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0009000000019209-351.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2724	chrome.exe
2724	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 284	3024	cmd.exe	31
PID 3024 wrote to memory of 284	3024	cmd.exe	31
PID 3024 wrote to memory of 284	3024	cmd.exe	31
PID 2724 wrote to memory of 2756	2724	chrome.exe	33
PID 2724 wrote to memory of 2756	2724	chrome.exe	33
PID 2724 wrote to memory of 2756	2724	chrome.exe	33
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 1616	2724	chrome.exe	35
PID 2724 wrote to memory of 2208	2724	chrome.exe	36
PID 2724 wrote to memory of 2208	2724	chrome.exe	36
PID 2724 wrote to memory of 2208	2724	chrome.exe	36
PID 2724 wrote to memory of 556	2724	chrome.exe	37
PID 2724 wrote to memory of 556	2724	chrome.exe	37
PID 2724 wrote to memory of 556	2724	chrome.exe	37
PID 2724 wrote to memory of 556	2724	chrome.exe	37
PID 2724 wrote to memory of 556	2724	chrome.exe	37
PID 2724 wrote to memory of 556	2724	chrome.exe	37
PID 2724 wrote to memory of 556	2724	chrome.exe	37
PID 2724 wrote to memory of 556	2724	chrome.exe	37
PID 2724 wrote to memory of 556	2724	chrome.exe	37
PID 2724 wrote to memory of 556	2724	chrome.exe	37
PID 2724 wrote to memory of 556	2724	chrome.exe	37
PID 2724 wrote to memory of 556	2724	chrome.exe	37
PID 2724 wrote to memory of 556	2724	chrome.exe	37
PID 2724 wrote to memory of 556	2724	chrome.exe	37
PID 2724 wrote to memory of 556	2724	chrome.exe	37
PID 2724 wrote to memory of 556	2724	chrome.exe	37

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Creal.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Creal.pyc
  2⤵
  - Modifies registry class
  PID:284

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6589758,0x7fef6589768,0x7fef6589778
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1156 --field-trial-handle=1316,i,7783916735496192565,4164024864843162729,131072 /prefetch:2
  2⤵
  PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1564 --field-trial-handle=1316,i,7783916735496192565,4164024864843162729,131072 /prefetch:8
  2⤵
  PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1532 --field-trial-handle=1316,i,7783916735496192565,4164024864843162729,131072 /prefetch:8
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2040 --field-trial-handle=1316,i,7783916735496192565,4164024864843162729,131072 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=1648 --field-trial-handle=1316,i,7783916735496192565,4164024864843162729,131072 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1404 --field-trial-handle=1316,i,7783916735496192565,4164024864843162729,131072 /prefetch:2
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2948 --field-trial-handle=1316,i,7783916735496192565,4164024864843162729,131072 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3660 --field-trial-handle=1316,i,7783916735496192565,4164024864843162729,131072 /prefetch:8
  2⤵
  PID:272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1084 --field-trial-handle=1316,i,7783916735496192565,4164024864843162729,131072 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1316,i,7783916735496192565,4164024864843162729,131072 /prefetch:8
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3376 --field-trial-handle=1316,i,7783916735496192565,4164024864843162729,131072 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3308 --field-trial-handle=1316,i,7783916735496192565,4164024864843162729,131072 /prefetch:1
  2⤵
  PID:980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3928 --field-trial-handle=1316,i,7783916735496192565,4164024864843162729,131072 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1736 --field-trial-handle=1316,i,7783916735496192565,4164024864843162729,131072 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=2672 --field-trial-handle=1316,i,7783916735496192565,4164024864843162729,131072 /prefetch:1
  2⤵
  PID:988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3288 --field-trial-handle=1316,i,7783916735496192565,4164024864843162729,131072 /prefetch:8
  2⤵
  PID:860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3660 --field-trial-handle=1316,i,7783916735496192565,4164024864843162729,131072 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4100 --field-trial-handle=1316,i,7783916735496192565,4164024864843162729,131072 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 --field-trial-handle=1316,i,7783916735496192565,4164024864843162729,131072 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3280 --field-trial-handle=1316,i,7783916735496192565,4164024864843162729,131072 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2316 --field-trial-handle=1316,i,7783916735496192565,4164024864843162729,131072 /prefetch:8
  2⤵
  PID:600
- C:\Users\Admin\Downloads\index.exe
  "C:\Users\Admin\Downloads\index.exe"
  2⤵
  PID:1356
- - C:\Users\Admin\Downloads\index.exe
    "C:\Users\Admin\Downloads\index.exe"
    3⤵
    PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3756 --field-trial-handle=1316,i,7783916735496192565,4164024864843162729,131072 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=1996 --field-trial-handle=1316,i,7783916735496192565,4164024864843162729,131072 /prefetch:1
  2⤵
  PID:376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 --field-trial-handle=1316,i,7783916735496192565,4164024864843162729,131072 /prefetch:8
  2⤵
  PID:2892

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c621e845ce4264682a2142fa8f9292cf

SHA1
944db49e601a3fe681f95585f6bdfb488caa3789

SHA256
c7efc031de18cb0c9692998fb5ab8e28275ac12c39d858f5c5af701be45ddcf5

SHA512
e2234ea72491e94bdd197faafc25a16ad4548d340e82c30a63718b0b0efe8544f70e6a98baf97f1887fc9547bb7363dc3f1795b1a1d280607dc3d16d1ab66e06

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
210KB

MD5
5ac828ee8e3812a5b225161caf6c61da

SHA1
86e65f22356c55c21147ce97903f5dbdf363649f

SHA256
b70465f707e42b41529b4e6d592f136d9eb307c39d040d147ad3c42842b723e7

SHA512
87472912277ae0201c2a41edc228720809b8a94599c54b06a9c509ff3b4a616fcdd10484b679fa0d436e472a8fc062f4b9cf7f4fa274dde6d10f77d378c06aa6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
79c8e6cfaf4d7227014bd5f4296562e0

SHA1
6898ec9a6d97486f37bb498b1745ad76bfe0c294

SHA256
e78573bfed6dd6455b5c520d5f8e340024a53ff9e658c3b9879281ff83ef15a5

SHA512
36cad9b5c9c66645eaaadfaff51001f304409b5d170a5551e3c5e9990d168a738f383f1e4bce4ae78a1080540d42bfe44ef66562d51db7682949b809790a7bdc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
51da2356e2b50722330b7a590ba3b8d7

SHA1
82d9b4f2c466558ed0f0289fa4c566fab3af25a0

SHA256
6fb934d6d2c053eaa37a427892c2a88e9c68260843a5e58154619a1a5a579f62

SHA512
ba079605783ad49e4a9624d1de3398ff8f3301c04adfa849cbd6d319752c3f3441f24410ccc56df12d9fcde16ff42ce71b4479da5d920d1bf704080ff99901a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
987B

MD5
d65de35bd4870bda45b1d7b80d9df716

SHA1
99a72ad505b5c466fd097ed7d991cd6b8f0e7bcb

SHA256
9ef9fc3bbf37757eda9f337162bbee7d99904dba0dd3c08bbcdc6d96ff3fb27d

SHA512
296410bb500180bb3fa84adc5ecf4c6c512f97fe055a78bdac0ef030cc468b7e14baa5f378746c310cf991ac52fc9d180ea58279f43376d80de43ceb79d8f4bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
3df2a4fc4ba5a201dcff32f445bdbf0d

SHA1
37d41dc1e8fc317c0fe953eae36f43eb80206488

SHA256
cb63451440d22cff0cee6c19367f75095c5f95677c1fb84c7c7e5ff3fa5c6c4c

SHA512
14d7d434d606cb0a488311e623f9a306c1e2e31370a122ef505f81d0a5c9008c97cac45685c6947300fccb71184e8e213b13d970042f6c86fecc2a901da16ec4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
987B

MD5
89f80353a16371a2e630ea5a7c028b0e

SHA1
e81ef96488992b4b02004f6c60da6e451051238d

SHA256
896fa4f2d2212a5f98944a3cbce8b005e41eeb8171d182e551b350e5c454e10c

SHA512
fec5c889b61e9fb4b09c9ba450d475e7d3279957d3b0a0f334048848484d722e6ad1c43afa07afb9eac5329d7752e8dc7f549e2c44f3015a2cdf714146c41bf1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
987B

MD5
00236f0bcf90477de1d7a93e595399d0

SHA1
dac58cf773621ab18ca8ed76ecdde12e0a143eaf

SHA256
11ca72b6721b56acb83afacba514d39e7e81229bcd421319c2833c214b3bf0c4

SHA512
9eacb06de62b46326a1a37c98630b2110ae2ba8d02e4e83d8adcb70a8273b4afa7b310496a84a6da309cae5d360851a5752c64167f9fce7ac2c4d971ac5314e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
526B

MD5
e937ef59c9d4e1de021a2d117c3da21e

SHA1
9f728ddaf9fa2fc8f18b1cb17d2623e13c581989

SHA256
fae25918a90db662a8f7bf7b33305fc7a6ba8349f87f34c60a53af1491fbcc3a

SHA512
d18a7b4c78bafa8335d4290feb82d4e606809b1da9957ec4e681e44e487cf37470155af8aedbf6019a5f96e106081f90bc4c0b452655b99979c6c98cbd162dd8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
526B

MD5
735e9b7dc7f2970b1e51390d97533298

SHA1
7c28e7d768de430c409951e5b705d85ccfc3a44d

SHA256
d9640236ea5fe71881a2da6e3c9d8eaf9cf8883f9e5fd49c9197b86f299acb09

SHA512
0723d2760c6dfe4c6ae93bbc4b0654ea9ff26dd3deb4af862a05b3e58c5bb43db904d138109747bb60ebbaadf8562574cf532b247c7f3bb3764de47a2e5096d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
a1f840cc7b3b487e1a764763bb4992b8

SHA1
ab1635b7f59a18fbf0f31608a70e03d33e2016c3

SHA256
a6930d9a1d209708032c303ce09789f1f6a4c89e88a73b52f38b41d54c47dc9d

SHA512
e26e2b21a106d8b4c42c73b64af9d2505927958866a89ec63f5ac256e18795d99b9c69030dd1cb7d18021bd42452657751af875b86b6e26dcbce1716a0bf7764

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
226e8b5a7ba0df86113a4485ce79a8ef

SHA1
9a249c99d44e8a797f84df535834697a14208749

SHA256
3061df8a3538c20d68902a9b1e5b622a68bebe33a0153030736cc76f57b0e4da

SHA512
2fa99613a71c89251c745f175717ba0d5367be3d3e6249b3c25a16383ce42e3bddcba5d19e2763af4eada86fbf7dceffd1ba2cb5c9b3d87cd00d7cfa2a5c8b3d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
33e1af6351af1ce351f8c156b0a2113c

SHA1
ce0147a1504ef262baef80dd64254718490f96b0

SHA256
11557fbdc0ce0f9b7da185e9e6518458442ec32bce0ca83e09012caa2f76dab7

SHA512
7f84856571d9067c2a7f538cf107ff897a49e3d9ff5ca61d024f3b684db5b2d2cc9ef84648ddf55a2d8f44cd720a335c174a4e35cb94ed7149d168bbdb1ea641

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
f9042ff36e24428f948d5e28450fe948

SHA1
8a288ea1cde17a26b99384851b2721e0cae1f3ff

SHA256
c7c27ad55de0baaca85690a942afed5e1b8f49e82809059ecd321e76a0a4bb39

SHA512
44d14cd93e0968f6cbed00bcbf6107e52c07f9aac0ba9b784462481991ad8466b0b6d7a310c8f2bf7f0c67841e582dc2a99f6703be323fafea8a1b0a542f0eac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
5651a5f1367b41042c1eb46ae509e31c

SHA1
b8d3a0a4f9e88f68245656b8aeaf3c6cb78fb26a

SHA256
96c6865d42355ffbbb08d2daceef4bc03425170b72bf41663e7fbb6e8771abaa

SHA512
321687792f5ce695655d96e9d3299d87a9b7adadbfd004c22bb017be29a6f2057309bb4e12b60b11291c4676d1eda70e4b27a6805a5b69b5204f568c70e8f7b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
35f86863437259147524121dc642ca12

SHA1
1c689503155a3a89ea3c6ac312030f5cc56c9783

SHA256
3819c3db252df9f5533e7b0dae7387fdd2c63ec900808aa300c6756af0fe8e73

SHA512
a4489e1a3ed0322904a10387a633e448e58fcf94eaec73b4d70059bba22565ab344fb78912b6ce87cef978f1712a9266a567033f0a548dfd1d90a0f94c948b9b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d1f31858-b1b0-4e3b-aba9-1e0cdfe02872.tmp

Filesize
6KB

MD5
733ad8a0befb2b043fb3edf3798e60ce

SHA1
56890be23f320bfc684e84022387fb2c825f7406

SHA256
f05f653619356c08c968210d781e87c551122796b232c979818f63f38406b062

SHA512
324fff985c2e60f80c9c28b6f727f721e9753b3b657a2e8d7db829db30c30831ae98b7b7834db27095b2dc49bb11b671b26059c6cc2bdc24df500f5a7bb569d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
82KB

MD5
c943787814865816d7050400b092095e

SHA1
dff6d6da23a9c1dc1903e776795a48683f4fa9ea

SHA256
c888df5210a12e27ef122fe23201d6e678d0763d318353da8b13ea99a133b974

SHA512
eb0c3c33259eb779c1836079bbde1dcfb8cd177454bc86bde03889c6e32eb013e7451ac04dfae920bfa302af876a4cf979089e6262bdf5bc81b815d6c0af2cde

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDD18.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDE05.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13562\python312.dll

Filesize
6.6MB

MD5
3c388ce47c0d9117d2a50b3fa5ac981d

SHA1
038484ff7460d03d1d36c23f0de4874cbaea2c48

SHA256
c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb

SHA512
e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35

Download Submit
\Users\Admin\Downloads\index.exe

Filesize
13.2MB

MD5
b19ecc85f6fb66a7284923be049659cd

SHA1
23d8ffbf1f0dd96538124c80481e7676bbd392fb

SHA256
077fbfcf6bbc5690d8f7ad368a6414a0ca3ca4117d148e637b0ea07146c69809

SHA512
e030cf7383f1ea05f9af400034e0f6673ecbda6f25a24ee98e467555cebf41b3ce56cf3e11c02af33baaa25293fd74a62a818cd81a08c40f2c600c41a53c2051

Download Submit