Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
02/08/2024, 17:06
240802-vmmrcsscqn 702/08/2024, 17:01
240802-vj1h2ssbqr 602/08/2024, 16:56
240802-vfvhmaxakd 7Analysis
-
max time kernel
69s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240708-es -
resource tags
arch:x64arch:x86image:win7-20240708-eslocale:es-esos:windows7-x64systemwindows -
submitted
02/08/2024, 16:56
Static task
static1
Behavioral task
behavioral1
Sample
CeleryInstaller.exe
Resource
win7-20240708-es
Behavioral task
behavioral2
Sample
CeleryInstaller.exe
Resource
win10v2004-20240802-es
General
-
Target
CeleryInstaller.exe
-
Size
822KB
-
MD5
0bd82e264be214414d6dd26bac3e1770
-
SHA1
5325e64053dcf599a9c5cedec532418716f9d357
-
SHA256
60593ced1e78fd4b3fdffcd58bcde989d8e9b031b3ad9132815fdf614e0449d4
-
SHA512
842a80fed2286d06987cd2dde7ae94fc6c7986eb49cc62684f62f148973e5080df7866e1d2f81d53cb5ac95ef9d88489f6765265e29104be0ae349c6a3164592
-
SSDEEP
12288:c5SsIg0ZvkY29slOLJFbJZXM1Eg/2QAu4NRFNxIg0Z:Ru0ZvkY29+OLfzI2Q0NH10Z
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 5 raw.githubusercontent.com 6 raw.githubusercontent.com -
Program crash 1 IoCs
pid pid_target Process procid_target 1812 2328 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CeleryInstaller.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 CeleryInstaller.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e CeleryInstaller.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e CeleryInstaller.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e CeleryInstaller.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1464 chrome.exe 1464 chrome.exe -
Suspicious use of AdjustPrivilegeToken 57 IoCs
description pid Process Token: SeDebugPrivilege 2328 CeleryInstaller.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe Token: SeShutdownPrivilege 1464 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe 1464 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2328 wrote to memory of 1812 2328 CeleryInstaller.exe 32 PID 2328 wrote to memory of 1812 2328 CeleryInstaller.exe 32 PID 2328 wrote to memory of 1812 2328 CeleryInstaller.exe 32 PID 2328 wrote to memory of 1812 2328 CeleryInstaller.exe 32 PID 1464 wrote to memory of 1752 1464 chrome.exe 34 PID 1464 wrote to memory of 1752 1464 chrome.exe 34 PID 1464 wrote to memory of 1752 1464 chrome.exe 34 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1244 1464 chrome.exe 36 PID 1464 wrote to memory of 1056 1464 chrome.exe 37 PID 1464 wrote to memory of 1056 1464 chrome.exe 37 PID 1464 wrote to memory of 1056 1464 chrome.exe 37 PID 1464 wrote to memory of 2220 1464 chrome.exe 38 PID 1464 wrote to memory of 2220 1464 chrome.exe 38 PID 1464 wrote to memory of 2220 1464 chrome.exe 38 PID 1464 wrote to memory of 2220 1464 chrome.exe 38 PID 1464 wrote to memory of 2220 1464 chrome.exe 38 PID 1464 wrote to memory of 2220 1464 chrome.exe 38 PID 1464 wrote to memory of 2220 1464 chrome.exe 38 PID 1464 wrote to memory of 2220 1464 chrome.exe 38 PID 1464 wrote to memory of 2220 1464 chrome.exe 38 PID 1464 wrote to memory of 2220 1464 chrome.exe 38 PID 1464 wrote to memory of 2220 1464 chrome.exe 38 PID 1464 wrote to memory of 2220 1464 chrome.exe 38 PID 1464 wrote to memory of 2220 1464 chrome.exe 38 PID 1464 wrote to memory of 2220 1464 chrome.exe 38 PID 1464 wrote to memory of 2220 1464 chrome.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\CeleryInstaller.exe"C:\Users\Admin\AppData\Local\Temp\CeleryInstaller.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 23762⤵
- Program crash
PID:1812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6ff9758,0x7fef6ff9768,0x7fef6ff97782⤵PID:1752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1160 --field-trial-handle=1372,i,12202021991684120042,17953105968210498963,131072 /prefetch:22⤵PID:1244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1484 --field-trial-handle=1372,i,12202021991684120042,17953105968210498963,131072 /prefetch:82⤵PID:1056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 --field-trial-handle=1372,i,12202021991684120042,17953105968210498963,131072 /prefetch:82⤵PID:2220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1416 --field-trial-handle=1372,i,12202021991684120042,17953105968210498963,131072 /prefetch:12⤵PID:1196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2256 --field-trial-handle=1372,i,12202021991684120042,17953105968210498963,131072 /prefetch:12⤵PID:1472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1528 --field-trial-handle=1372,i,12202021991684120042,17953105968210498963,131072 /prefetch:22⤵PID:2492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1468 --field-trial-handle=1372,i,12202021991684120042,17953105968210498963,131072 /prefetch:12⤵PID:2908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3660 --field-trial-handle=1372,i,12202021991684120042,17953105968210498963,131072 /prefetch:82⤵PID:2748
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1516
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
5KB
MD513e04222d59f2cddfe8f1f9a1d8550a9
SHA10c9b2ed0df23ace87547ebd9a6f6ad9bd04d3b7f
SHA256d070d0c5e77b298ab3adcbcf661e03ed0a8d7f24d0c58ba93d2e55b6ed22cdc6
SHA5122e711fee3e257be65684089dc8ef6a3730d5ed3f046de2fd433b0810340e7bf97fd1580356441d58678a9f2fbb7c4515bfb128601c6d622ea08f09d4771bcf0d
-
Filesize
5KB
MD529b8164310fe0c3c8d5883dc1f6af607
SHA19c40c10275ad31c186841d9d16894e04a8b3251b
SHA256ecf4763380c26052bd35b9d4b8bb78ac8c7ce2c5ca313521485de3a3daff3487
SHA5123a3b39eae4bc666bb86fcd6ec3446565a5391b1bc9a4db2a728f8b2a9e9b7eebd9e6e0e2e563531b71c531a2d71f67067a3f31985bf7d410f84b6a5f26a9f916
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Filesize16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b