Overview
overview
10Static
static
1#!!SetUp_2...$$.rar
windows11-21h2-x64
7PassCode.txt
windows11-21h2-x64
3Setup.exe
windows11-21h2-x64
10updater/ma...es.ini
windows11-21h2-x64
3x86/Direct...1].exe
windows11-21h2-x64
1x86/Paring...1].exe
windows11-21h2-x64
3x86/api-ms...-1.dll
windows11-21h2-x64
1x86/api-ms...-0.dll
windows11-21h2-x64
1x86/api-ms...-0.dll
windows11-21h2-x64
1x86/api-ms...-0.dll
windows11-21h2-x64
1x86/api-ms...-0.dll
windows11-21h2-x64
1x86/api-ms...-0.dll
windows11-21h2-x64
1x86/api-ms...-0.dll
windows11-21h2-x64
1x86/api-ms...-0.dll
windows11-21h2-x64
1x86/api-ms...-0.dll
windows11-21h2-x64
1x86/api-ms...-0.dll
windows11-21h2-x64
1x86/api-ms...-0.dll
windows11-21h2-x64
1x86/api-ms...-0.dll
windows11-21h2-x64
1x86/api-ms...-0.dll
windows11-21h2-x64
1x86/api-ms...-0.dll
windows11-21h2-x64
1x86/api-ms...-0.dll
windows11-21h2-x64
1x86/api-ms...-0.dll
windows11-21h2-x64
1x86/api-ms...-0.dll
windows11-21h2-x64
1x86/api-ms...-0.dll
windows11-21h2-x64
1x86/api-ms...-0.dll
windows11-21h2-x64
1x86/chrome...1].exe
windows11-21h2-x64
Analysis
- max time kernel
150s - max time network
146s - platform
windows11-21h2_x64 - resource
win11-20240730-en - resource tags
arch:x64arch:x86image:win11-20240730-enlocale:en-usos:windows11-21h2-x64system - submitted
02/08/2024, 02:47
Static task
static1
Behavioral task
behavioral1
Sample
#!!SetUp_2244_PassW0rd$$.rar
Resource
win11-20240730-en
windows11-21h2-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
PassCode.txt
Resource
win11-20240730-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
Setup.exe
Resource
win11-20240730-en
windows11-21h2-x64
17 signatures
150 seconds
Behavioral task
behavioral4
Sample
updater/manager/ks_tyres.ini
Resource
win11-20240730-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
x86/DirectoryMonitor_[1MB]_[1].exe
Resource
win11-20240730-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
x86/Paring_[1MB]_[1].exe
Resource
win11-20240730-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
x86/api-ms-win-core-processthreads-l1-1-1.dll
Resource
win11-20240730-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
x86/api-ms-win-core-profile-l1-1-0.dll
Resource
win11-20240730-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
x86/api-ms-win-core-rtlsupport-l1-1-0.dll
Resource
win11-20240730-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
x86/api-ms-win-core-string-l1-1-0.dll
Resource
win11-20240730-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
x86/api-ms-win-core-synch-l1-1-0.dll
Resource
win11-20240730-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
x86/api-ms-win-core-synch-l1-2-0.dll
Resource
win11-20240730-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
x86/api-ms-win-core-sysinfo-l1-1-0.dll
Resource
win11-20240730-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
x86/api-ms-win-core-timezone-l1-1-0.dll
Resource
win11-20240729-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
x86/api-ms-win-core-util-l1-1-0.dll
Resource
win11-20240730-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
x86/api-ms-win-crt-conio-l1-1-0.dll
Resource
win11-20240730-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
x86/api-ms-win-crt-convert-l1-1-0.dll
Resource
win11-20240730-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
x86/api-ms-win-crt-environment-l1-1-0.dll
Resource
win11-20240730-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
x86/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win11-20240729-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
x86/api-ms-win-crt-heap-l1-1-0.dll
Resource
win11-20240730-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
x86/api-ms-win-crt-locale-l1-1-0.dll
Resource
win11-20240730-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
x86/api-ms-win-crt-math-l1-1-0.dll
Resource
win11-20240730-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
x86/api-ms-win-crt-multibyte-l1-1-0.dll
Resource
win11-20240730-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
x86/api-ms-win-crt-private-l1-1-0.dll
Resource
win11-20240730-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
x86/api-ms-win-crt-process-l1-1-0.dll
Resource
win11-20240730-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
x86/chrome_[1MB]_[1].exe
Resource
win11-20240730-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target #!!SetUp_2244_PassW0rd$$.rar
- Size 10.6MB
- Sample240802-c9v25sweqe
- SHA256 984d530e78ec72391f217805e5e078cef1c4e15c156c12d60841dae8b2e5af87
- MD5 06d7ba03e2e6f8ce2c5c2de914346dd7
- SHA1 50f3d4d36c7dc47b69e51d94a2091000fce4f9e6
- SHA512 e9956985dfac0e526b49c55a43f99bb13b17702a518466dabc79cc010c26267e514f41dfc68aa08cabb486b5669ce1a52107c547d3f7a51f270aad6fc3aa9e7c
- SSDEEP 196608:9+1VuY7zteC5qmRRfTHHPwoD3LVYeNCjYJN7qGQLwi3Io1M8qiBbVRG:EtqmHwoD7GYCjYtwM8TBxY
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2940 winrar-x64-701.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File opened for modification C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier chrome.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133670405439626295" chrome.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3070649267-739947649-3250922198-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3070649267-739947649-3250922198-1000_Classes\Local Settings OpenWith.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4548 chrome.exe 4548 chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3876 OpenWith.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe - Suspicious use of FindShellTrayWindow 36 IoCs
pid Process 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe - Suspicious use of SendNotifyMessage 12 IoCs
pid Process 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe - Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 3876 OpenWith.exe 3876 OpenWith.exe 3876 OpenWith.exe 3876 OpenWith.exe 3876 OpenWith.exe 3876 OpenWith.exe 3876 OpenWith.exe 3876 OpenWith.exe 3876 OpenWith.exe 3876 OpenWith.exe 3876 OpenWith.exe 2940 winrar-x64-701.exe 2940 winrar-x64-701.exe 2940 winrar-x64-701.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4548 wrote to memory of 568 4548 chrome.exe 89 PID 4548 wrote to memory of 568 4548 chrome.exe 89 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2772 4548 chrome.exe 90 PID 4548 wrote to memory of 2532 4548 chrome.exe 91 PID 4548 wrote to memory of 2532 4548 chrome.exe 91 PID 4548 wrote to memory of 3548 4548 chrome.exe 92 PID 4548 wrote to memory of 3548 4548 chrome.exe 92 PID 4548 wrote to memory of 3548 4548 chrome.exe 92 PID 4548 wrote to memory of 3548 4548 chrome.exe 92 PID 4548 wrote to memory of 3548 4548 chrome.exe 92 PID 4548 wrote to memory of 3548 4548 chrome.exe 92 PID 4548 wrote to memory of 3548 4548 chrome.exe 92 PID 4548 wrote to memory of 3548 4548 chrome.exe 92 PID 4548 wrote to memory of 3548 4548 chrome.exe 92 PID 4548 wrote to memory of 3548 4548 chrome.exe 92 PID 4548 wrote to memory of 3548 4548 chrome.exe 92 PID 4548 wrote to memory of 3548 4548 chrome.exe 92 PID 4548 wrote to memory of 3548 4548 chrome.exe 92 PID 4548 wrote to memory of 3548 4548 chrome.exe 92 PID 4548 wrote to memory of 3548 4548 chrome.exe 92 PID 4548 wrote to memory of 3548 4548 chrome.exe 92 PID 4548 wrote to memory of 3548 4548 chrome.exe 92 PID 4548 wrote to memory of 3548 4548 chrome.exe 92 PID 4548 wrote to memory of 3548 4548 chrome.exe 92 PID 4548 wrote to memory of 3548 4548 chrome.exe 92 PID 4548 wrote to memory of 3548 4548 chrome.exe 92 PID 4548 wrote to memory of 3548 4548 chrome.exe 92 PID 4548 wrote to memory of 3548 4548 chrome.exe 92 PID 4548 wrote to memory of 3548 4548 chrome.exe 92 PID 4548 wrote to memory of 3548 4548 chrome.exe 92 PID 4548 wrote to memory of 3548 4548 chrome.exe 92 PID 4548 wrote to memory of 3548 4548 chrome.exe 92 PID 4548 wrote to memory of 3548 4548 chrome.exe 92 PID 4548 wrote to memory of 3548 4548 chrome.exe 92 PID 4548 wrote to memory of 3548 4548 chrome.exe 92
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\#!!SetUp_2244_PassW0rd$$.rar1⤵
- Modifies registry class
PID:4908
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3876
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9ea6bcc40,0x7ff9ea6bcc4c,0x7ff9ea6bcc582⤵PID:568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1844,i,17795359477004158305,6285670967809304031,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=1840 /prefetch:22⤵PID:2772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2128,i,17795359477004158305,6285670967809304031,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=2120 /prefetch:32⤵PID:2532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2176,i,17795359477004158305,6285670967809304031,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=2224 /prefetch:82⤵PID:3548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3112,i,17795359477004158305,6285670967809304031,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=3116 /prefetch:12⤵PID:3852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,17795359477004158305,6285670967809304031,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=3164 /prefetch:12⤵PID:2152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3716,i,17795359477004158305,6285670967809304031,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=3564 /prefetch:12⤵PID:3016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4764,i,17795359477004158305,6285670967809304031,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=4708 /prefetch:82⤵PID:2060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4780,i,17795359477004158305,6285670967809304031,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=4772 /prefetch:82⤵PID:1556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4828,i,17795359477004158305,6285670967809304031,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=4836 /prefetch:12⤵PID:4696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4976,i,17795359477004158305,6285670967809304031,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:3924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5196,i,17795359477004158305,6285670967809304031,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=5200 /prefetch:82⤵PID:664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5248,i,17795359477004158305,6285670967809304031,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=5384 /prefetch:82⤵PID:3736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5540,i,17795359477004158305,6285670967809304031,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=5528 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:1588
-
-
C:\Users\Admin\Downloads\winrar-x64-701.exe"C:\Users\Admin\Downloads\winrar-x64-701.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2940
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵PID:2348
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4888
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5f89baa7-b8a4-453f-a82f-1e80c98ae52b.tmp
- Size 15KB
- SHA256 42ba8d1c460f8649f7bbafbb83bc6969ebb22be6d1d540269739b7103e8e9130
- MD5 000d20daf8713fc2ab730d3104637e38
- SHA1 52426917ee32929b3f3dd6d4c335d9516ee42b83
- SHA512 12676ef8ac72ad77bf7b70c2878c94c0ec0bb611f4d0e962780ee6f534b971e4ac55a67d1e0653736d6db962204b17af16ca257b1ea7c58ba996bc79d218a21d
- SSDEEP 384:zHGF7pLhLc+eL+XV61kXqKf/pUZNCgVLH2HfPr2rU8bHGkKMCcO:zmF7pLhLnwkV61kXqKf/pUZNCgVLH2Hv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001
- Size 209KB
- SHA256 27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
- MD5 3e552d017d45f8fd93b94cfc86f842f2
- SHA1 dbeebe83854328e2575ff67259e3fb6704b17a47
- SHA512 e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
- SSDEEP 6144:ewpSHs6ljYg6trFqiSAprekukr20IgIgR:OHvhlo8XGus2oR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 216B
- SHA256 50d76989c21b47a147140d0dba824bc1645b506ab2bc37f13f3affe6e2c812c3
- MD5 2639b16c47d1ffb5244bad2805a68b8d
- SHA1 62855ae59f136429d43f6968d968e2e982b07b06
- SHA512 d219575e173da5f7c499c0f2ec68b5b1968788ab9da965fe0434ba469db1f0a2467b8cff1b8e6a60286407133131de8634b0cebda06d0dfb48d444f74f4510cb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 541c6328ee89677be91413eea0adfa28d2b4d3e1fe0585187a2c2499bd8c3f21
- MD5 2edc641593462c8ca6264a2856bea12e
- SHA1 465fb4e2eeb3736d35bf301c89cf163c69d80969
- SHA512 ad19c418c0a2001a2d3b1600eea89cad6fe80fe880f5869011d98c4e2af8e3fbef503b21892fe90da659bc848db3204cd2045d3e84fdcbfc388a78de0dd46ec8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 356B
- SHA256 c21f234e5db4bd7cf8066dce4a3db76a97fe273af7f737bbc1d3134bd66c8eed
- MD5 dad23944cd6e17469ec13c4d4130c648
- SHA1 a37a43dfdf60a5a1471b2de2ad46b52da2a04bfa
- SHA512 c47e7087fc24f8b4443451be3787f8112c4ac048a15ac499cf978d55f72011eeef3c49b29f186c245aeb384d8f77d654d7f6c60c8d52260a7a3225fd2fb48dba
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 523B
- SHA256 bdc7c497e6cf03cb41a4e9642c614da9a61222fc130cf66e28bbcdc1ab90ac2d
- MD5 98a51b69af22376958c3654c9e9c9e26
- SHA1 8cfaa3c09293b31d146423b2ee2bdf42c2602e26
- SHA512 2c6d8e6803b8d4b8fdc064fc1ea033b0bb52f146c2a60a0eeccfebbff2797f87bedf8486061ebf28bd5a7161807c7cc81f6671d597f5ef394da6b60b03c7f694
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 523B
- SHA256 eeaa1b8c6cfb4ed73f61f1d09ba3ac27e2fa165e26c4b78b55a41d9693bde2ba
- MD5 a3855ec8aeb16e4fe74696843574a756
- SHA1 96f9af9c52cb333f99be9fa6aaf4d428de575cc0
- SHA512 4a15bfc754904588e131f8e969bbbbb4e5d1f8ba00f9ecb043e2597cb4f8f1f86aa882e15dffeb8f161c9413f49a3bb7d162646dc5b748fa1d53a5e942af6c7a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 8KB
- SHA256 4a0504fecfa712ff7046fbbea450c0b05b0714444a67c481c2761c475c2ed0b2
- MD5 4ebb466f288faa944317c6ca32ee7267
- SHA1 756102d1e6cb804536f8e35a22bd32d20111cade
- SHA512 ff7398f730c8b114a083b9b0a602c8010496c9041910a57dad4440d45c9ee59c4a6e16b17c9770cb15adb60bd3089491501a8f778c2d84c88eaf3ff36497c7f6
- SSDEEP 96:7KXTB+HXvylSJoKI7DCWTbeY16ZhKH7/x+6MhmueSs1CV/Oc+Bwe9l2MoAy8yIsD:7KXT4HSRe5KHV+FpskmeoPo6yIsnVdg4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 9KB
- SHA256 3c6a1704ef046dd19739c0645b97f896a0e74d9ba7eda41931d6a0b738f82023
- MD5 2e3e2e952e8beb06a06529ef54c40710
- SHA1 d7b1fbb0aa0f49c41a0f40289d3a4379b27ea899
- SHA512 a8bd746c15c9fc900a68aff86faf178be64519c5c66393fc4b9d72ebb60a2400c265cb0ea9df9c27238b2d1c5088bee5af01731b73161a60ab19e3bdd2adbdd4
- SSDEEP 192:7KrcBzT4HSeevKHV+Fgw6bumKeVPo6yIsnVdg4:7KrmzT4OeGgzbumv4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 9KB
- SHA256 4407b79aab2fadde608d47701429ff6878299c0e33862e02b0b62231f9925096
- MD5 3dad66980a3f19b399184f864ae155ab
- SHA1 9c0094e8db1790f5e18c556495d3ffb7997ccca9
- SHA512 1dffd62782f5a0fae03f8adabe851538640c561f71a10f752f05752744f3c15efc07ba8a0c484dd8defff2d223e5dfe7f23ea1a4611609521afc80689bb62f75
- SSDEEP 192:7KrcBzTqHSkeAKHV+F3w6bumhe5Po6yIsnVdg4:7KrmzTqheG3zbumY4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 9KB
- SHA256 0b62b6e2ec9f24f1364ba637b1703dedb9dca07f9910dfb1fbe3ca1082299429
- MD5 e9613cbc03e313bc7eee0b8a77ee529f
- SHA1 7948b4ef54adbd3c166ef143c36d59212476f1b4
- SHA512 b97a5c3fd852ff14c6d6683e2a0f40a5af73e52e53377ba6ea372a578cc6eafa5f41a49f09b9934863e2b391d6908041c4fd62a80e7fb5e4513749c6c650a705
- SSDEEP 96:7KXTB+HXvylSJoKI7DCVTbeY16ZhKH7/x+6MhmuecqMFNVmOc+Bw8Q9l2MoAy8y1:7KXT4HSge5KHV+Fnq6peVPo6yIsnVdg4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 8KB
- SHA256 f087f3355088e714a7fc126f5836dcb45980c435b56690a304f081708d83ddb6
- MD5 7c43c84fa1f9c3b4ed15cad489f30fca
- SHA1 d41483ffa0c6cb4d02ff607f5cb415bd6f9e8faf
- SHA512 92d143ea9d9e9c81ac690a0887da5d9ef1d31b286fd60f969b3f4f01556acb33379b3d905ba15d490520b47e52533f50cf2b1078a920a241cacdbdabed167693
- SSDEEP 96:7KXTB+HXvylSJoKI7DCVTbeY16Z7KH7/x+6MhmuecVn2Oc+Bwe9l2MoAy8yIsnVB:7KXT4HSEejKHV+FR9XeoPo6yIsnVdg4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 195KB
- SHA256 564d8f413d34976fd4e3e0474d1869828f5aa0da7480b07196a28675efb898c7
- MD5 ae400b385e3dd38f7b45251c0d092c75
- SHA1 0a3aad388cd1e6d1b15f4c6baa0a543f1c0861b4
- SHA512 74153ef615d1571e34ddebc26831f5cd391307961742d0f1b41d67f8f9ffa2e4c47be51706599e6ab60eea65824601abd1f3a828a99933e8649a83053fa483c4
- SSDEEP 3072:/f6cyd16pz23BgX85eAeCsL6n7/mK0uEP8EphMccS3SxK1GEz9VGEKhMb5R7eiHJ:/fwqnLAoL67+KEP8Iuc1UZu5sk+H8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 196KB
- SHA256 c7b792739b8fb9547f843b19650a93caf434ee348d6aa5cdc8e73594c5c2281d
- MD5 6aa80446fe1252e8a8aaa779ab7586b1
- SHA1 6da43b29ad1c8eafb7febef1d2b5bc49495a7434
- SHA512 d1333b065cbca329e2e91dd17760e981b68f55b0d47cf277178fbcf0b5a01a21ef93f5aeeb1a64fe69f0cccef676557065a1dd1d107ec759f9146c871141bc77
- SSDEEP 3072:gf6cyd16pz23BgX85eAeCsL6n7/mK0uEP8EphMccS3SxK1GEz9VGEKhMb5R7eiHJ:gfwqnLAoL67+KEP8Iuc1UZu5sk+H8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Downloads\winrar-x64-701.exe
- Size 3.8MB
- SHA256 c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a
- MD5 46c17c999744470b689331f41eab7df1
- SHA1 b8a63127df6a87d333061c622220d6d70ed80f7c
- SHA512 4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6
- SSDEEP 98304:6NRBOBfKgQIm9EOTqw8vjh9Ac9nUNupK4hVvcF+yHrAr:sR/gmeOqv7Ac9F0kB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier
- Size 26B
- SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
- MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
- SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
- SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
- MD5 SHA1 SHA512