hxxp://GOOGLE[.]COM

Analysis

max time kernel
1779s
max time network
1703s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 19:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://GOOGLE.COM
Sample240802-ydewyascrb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E0A61E1-5107-11EF-960D-6A8D92A4B8D0} = "0"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
2796	iexplore.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2796	iexplore.exe
2796	iexplore.exe
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2740	2796	iexplore.exe	29
PID 2796 wrote to memory of 2740	2796	iexplore.exe	29
PID 2796 wrote to memory of 2740	2796	iexplore.exe	29
PID 2796 wrote to memory of 2740	2796	iexplore.exe	29
PID 2668 wrote to memory of 2624	2668	chrome.exe	32
PID 2668 wrote to memory of 2624	2668	chrome.exe	32
PID 2668 wrote to memory of 2624	2668	chrome.exe	32
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 1240	2668	chrome.exe	34
PID 2668 wrote to memory of 2312	2668	chrome.exe	35
PID 2668 wrote to memory of 2312	2668	chrome.exe	35
PID 2668 wrote to memory of 2312	2668	chrome.exe	35
PID 2668 wrote to memory of 2328	2668	chrome.exe	36
PID 2668 wrote to memory of 2328	2668	chrome.exe	36
PID 2668 wrote to memory of 2328	2668	chrome.exe	36
PID 2668 wrote to memory of 2328	2668	chrome.exe	36
PID 2668 wrote to memory of 2328	2668	chrome.exe	36
PID 2668 wrote to memory of 2328	2668	chrome.exe	36
PID 2668 wrote to memory of 2328	2668	chrome.exe	36
PID 2668 wrote to memory of 2328	2668	chrome.exe	36
PID 2668 wrote to memory of 2328	2668	chrome.exe	36
PID 2668 wrote to memory of 2328	2668	chrome.exe	36
PID 2668 wrote to memory of 2328	2668	chrome.exe	36
PID 2668 wrote to memory of 2328	2668	chrome.exe	36
PID 2668 wrote to memory of 2328	2668	chrome.exe	36
PID 2668 wrote to memory of 2328	2668	chrome.exe	36
PID 2668 wrote to memory of 2328	2668	chrome.exe	36

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://GOOGLE.COM
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2796 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef75d9758,0x7fef75d9768,0x7fef75d9778
  2⤵
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1300,i,9922130801606333900,3455882849996792240,131072 /prefetch:2
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1344 --field-trial-handle=1300,i,9922130801606333900,3455882849996792240,131072 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 --field-trial-handle=1300,i,9922130801606333900,3455882849996792240,131072 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2324 --field-trial-handle=1300,i,9922130801606333900,3455882849996792240,131072 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2344 --field-trial-handle=1300,i,9922130801606333900,3455882849996792240,131072 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1584 --field-trial-handle=1300,i,9922130801606333900,3455882849996792240,131072 /prefetch:2
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1580 --field-trial-handle=1300,i,9922130801606333900,3455882849996792240,131072 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=2484 --field-trial-handle=1300,i,9922130801606333900,3455882849996792240,131072 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 --field-trial-handle=1300,i,9922130801606333900,3455882849996792240,131072 /prefetch:8
  2⤵
  PID:1988

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3044

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:1256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f_000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001
Size 209KB
SHA256 27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
MD5 3e552d017d45f8fd93b94cfc86f842f2
SHA1 dbeebe83854328e2575ff67259e3fb6704b17a47
SHA512 e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
SSDEEP 6144:ewpSHs6ljYg6trFqiSAprekukr20IgIgR:OHvhlo8XGus2oR
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e7fd5a7200929e805034c350f6878f597be0fa189449d72505a2f52e7b1c6e12
MD5 8392179fbb48923a5ae28399235545ac
SHA1 18b811d114301409d8058a8ab1aa28c0c781fc79
SHA512 58efb15e1c2ff1e01927714acafc48f16135277bf4e98ef94d206243f64924a904c4db636616ef6851851e0f65cdb06b860b45a52b82a8cb536c3cc81aa4c211
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 987B
SHA256 86ec8a6f8c2f2f8baaa0772c8b4967662e67f384d0f418cfd8d6180bfa4b44a6
MD5 92c54f98069b7a9b0bca869a9ed0f152
SHA1 fc382b75967e42bcc35a46266e14482bf2e3b50e
SHA512 c874207155693e08f64a70322314d33a0d9103065eb1e910d231733f78ee7eca97ee908dd8c910ea1a724a34c608b639296336bf3f13a60f30945e887cf02bfc
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 987B
SHA256 dc1c3b663c855d355fd115862bfc5cae7c144ba761836c60332ad95b42ef2d20
MD5 1428ffdfe4b6e8467cdcc0912a8f25d8
SHA1 3bf92b6a5beab38f0d407aa344cbd41cf30613a9
SHA512 999ea0d5275f7b8bba6a15391f9e5f5066f32ad2cdfd6fb97af44d355f66e8cfe784bb7cb6275fb599736b15ac3f0228cb74cc221b5d75529751f8bf7e77b2e3
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8f460344ddda1f0bf3c2190ff8007effd12c0c1dbc1988dc1c2c2f520e84f99f
MD5 492e469916efd1f17716ea16d739a197
SHA1 c144fbfd180c2147ca8d387963e53464fa28ea48
SHA512 47f06e881b689f728ebf9a12d5eb1baa097179741376171c8c05162fb3632e25abf1d020b496d2c4d04f987c5d373864034d19348498a00e53550110574cdea7
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 987B
SHA256 b834362c5afff75ada9b7636a378232a45e25919b1989ac694202e0cd5dceaf5
MD5 58bd91376d17c2a473f988234f4dc2ab
SHA1 eb6cef18eee297aa3e28486c00617998842a2f4d
SHA512 adbfcb25df0a15ea958caa2393bd2449fc40ca9c371c94024c7e7f8253b2c12ba863b724469965e3ea33ac77311e34e7429f3cf491c1d96813f771a3c28c592c
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 363B
SHA256 d7b18c0c10dccc31b58f709571616ef954be6c169d0da855da045ae1f81c30d8
MD5 e7c98317bae5ee45d85a5c401967718f
SHA1 a7789e2ce2048af171ff0207fc9689bd19624f49
SHA512 4180bdd54848ea4942db63b14d5504e782061de38a6fd02e168ea32b4c444bfe0929c1726b7e343f101743b9e69adc207a6d14c115f8e6562c6925b82fd4f148
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 4KB
SHA256 53d75d3153592e227434e17ce9e3915cac0063c49e2d1f1d6dabbe83c7847aa8
MD5 5f5785ae74623eb0c1f787dab03e1ba4
SHA1 bff16e9c53694082dfb356686c331dca60cbe5cd
SHA512 ada42ad66b0cdbd960607524619f7502a64d8ddbdf2d3a9695e25b0d255d8d84462559db5d898a7715decb436aa12aa54796e1dcfac8a1fec173256eeb63a1f5
SSDEEP 96:2IZDIKIU/l8d8iZRy7Di+6MsmdehIOQhAjV39:2cIF8syy+F49b
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 4KB
SHA256 1861492cf9ba8f939a4fa2293a7ce6069db807975cddbbff910b0e7930f2bc04
MD5 6743673f22516e85c10bb2eb13554a03
SHA1 b05d67c1f67dccb88b891e1a7579bc969ac982e2
SHA512 4d36b27cd4ca9bc2a16e10e70057a7d328ace159e6c812fe095f34d4962b4392d35e37235d2c590262d9bddc222f3dc5d7ba52d287c018813aa2d2212ae9c481
SSDEEP 96:2Ix3TDIKIU/l8d8iZRy7Di+6MsmderOQhAjV39:2c3IF8syy+FTb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 4KB
SHA256 67618695c8395d9d04152a6aba46d20b62270a9e61a208cda3d510e38a0435a5
MD5 052e15096d04357607bb0d768bdb7a70
SHA1 f81c1980f18ee08857c46331d9ef18d7090d7794
SHA512 bd15155e77b81b245671c6af57d8645a5cde77c33ebc906228ec3e650fac5125857db11da873fbec2750f27af4afcda02d7803a5b6f2b94e3b99ada1496ded4f
SSDEEP 96:2IJDIKIU/l8d8iZRy7Di+6MsmdehIOQhAjV39:2OIF8syy+F49b
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 4KB
SHA256 1f2189aa24a99c05c8e0a3780beadc4cdec984698dc68ad29bf2d7e898b439a1
MD5 838210ccc71de180d06b4d04944ce573
SHA1 f1e3a2909e9bcdb5499ff0500b75f25aefdc3c5e
SHA512 de2bca6f1a74d4d46004b5a941587d90fcb0ba9e5bdcdce4854ef8b091ad0144826ce95e4411a17ede0d55782b56ee5397e4010141eae70ded6d8dddfff18dc9
SSDEEP 96:2IbDIKIU/l8d8iZRy7Di+6MsmderOQhAjV39:2UIF8syy+FTb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 4KB
SHA256 95cb775dbcd2d2214f2d7f2a3eb047f24dc920f71fbff908ae04366e89c32e7e
MD5 f50a9467b52b4018978d372193fd1af4
SHA1 4bc80d7d54648a2eb0e921f5dfb1141928d33924
SHA512 e2cbb58bf527320125886a4eb7d4e96681b182089765688888b2badfaa5a495b1ff129afddaa9d71345b58118f4f87aac46d2fea3f8ff6395e8ad21e054fa541
SSDEEP 96:2IxgTDIKIU/l8d8iZRy7Di+6Msmde4OQhAjV39:2p3IF8syy+FCb
MD5 SHA1 SHA512 SSDEEP

Submit Download

000007.dbtmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Size 16B
SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
MD5 18e723571b00fb1694a3bad6c78e4054
SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
MD5 SHA1 SHA512

Submit Download