5916e82e6c2481afbe68eaca27cddae6f8300129ac852ccd11934c48f7544973

Analysis

max time kernel
147s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
03/08/2024, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
MantiWPF.zip
Size 143.6MB
Sample240803-cbr8layhlp
SHA256 5916e82e6c2481afbe68eaca27cddae6f8300129ac852ccd11934c48f7544973
MD5 db4727bc9096d9cc413a276ca91a0d29
SHA1 393a7c204648780b5c02e1cbbe9eb5ca983078b3
SHA512 e34215938ea5384c8f93fafed8fd8fed90885a7bd0a4682681b132e21cc5da7fbdae87dcbe37776a9af107d4454209ef5fa61effb6b6135dc4625016d69a7f5a
SSDEEP 3145728:sf9M/68VqnUlAzc7/NmSMZJU5I0hIUQC9TiAh7qP0Byxb:s1ilb/NmT05IcTV7PBy9
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 16 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "225"	LogonUI.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2892	vlc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2892	vlc.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
676	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
2892	vlc.exe
2892	vlc.exe
2892	vlc.exe
2892	vlc.exe
2892	vlc.exe
2892	vlc.exe
2892	vlc.exe
2892	vlc.exe
2892	vlc.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
2892	vlc.exe
2892	vlc.exe
2892	vlc.exe
2892	vlc.exe
2892	vlc.exe
2892	vlc.exe
2892	vlc.exe
2892	vlc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2892	vlc.exe
4816	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 1388	4304	chrome.exe	81
PID 4304 wrote to memory of 1388	4304	chrome.exe	81
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 1112	4304	chrome.exe	82
PID 4304 wrote to memory of 4760	4304	chrome.exe	83
PID 4304 wrote to memory of 4760	4304	chrome.exe	83
PID 4304 wrote to memory of 4900	4304	chrome.exe	84
PID 4304 wrote to memory of 4900	4304	chrome.exe	84
PID 4304 wrote to memory of 4900	4304	chrome.exe	84
PID 4304 wrote to memory of 4900	4304	chrome.exe	84
PID 4304 wrote to memory of 4900	4304	chrome.exe	84
PID 4304 wrote to memory of 4900	4304	chrome.exe	84
PID 4304 wrote to memory of 4900	4304	chrome.exe	84
PID 4304 wrote to memory of 4900	4304	chrome.exe	84
PID 4304 wrote to memory of 4900	4304	chrome.exe	84
PID 4304 wrote to memory of 4900	4304	chrome.exe	84
PID 4304 wrote to memory of 4900	4304	chrome.exe	84
PID 4304 wrote to memory of 4900	4304	chrome.exe	84
PID 4304 wrote to memory of 4900	4304	chrome.exe	84
PID 4304 wrote to memory of 4900	4304	chrome.exe	84
PID 4304 wrote to memory of 4900	4304	chrome.exe	84
PID 4304 wrote to memory of 4900	4304	chrome.exe	84
PID 4304 wrote to memory of 4900	4304	chrome.exe	84
PID 4304 wrote to memory of 4900	4304	chrome.exe	84
PID 4304 wrote to memory of 4900	4304	chrome.exe	84
PID 4304 wrote to memory of 4900	4304	chrome.exe	84
PID 4304 wrote to memory of 4900	4304	chrome.exe	84
PID 4304 wrote to memory of 4900	4304	chrome.exe	84
PID 4304 wrote to memory of 4900	4304	chrome.exe	84
PID 4304 wrote to memory of 4900	4304	chrome.exe	84
PID 4304 wrote to memory of 4900	4304	chrome.exe	84
PID 4304 wrote to memory of 4900	4304	chrome.exe	84
PID 4304 wrote to memory of 4900	4304	chrome.exe	84
PID 4304 wrote to memory of 4900	4304	chrome.exe	84
PID 4304 wrote to memory of 4900	4304	chrome.exe	84
PID 4304 wrote to memory of 4900	4304	chrome.exe	84

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\MantiWPF.zip
1⤵
PID:1916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff81330cc40,0x7ff81330cc4c,0x7ff81330cc58
  2⤵
  PID:1388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1872,i,16219559443529682750,5924745114536866990,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1864 /prefetch:2
  2⤵
  PID:1112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2152,i,16219559443529682750,5924745114536866990,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,16219559443529682750,5924745114536866990,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2196 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3128,i,16219559443529682750,5924745114536866990,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3156,i,16219559443529682750,5924745114536866990,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4432,i,16219559443529682750,5924745114536866990,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4464 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4708,i,16219559443529682750,5924745114536866990,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4844,i,16219559443529682750,5924745114536866990,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4412 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=212,i,16219559443529682750,5924745114536866990,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5044,i,16219559443529682750,5924745114536866990,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3756 /prefetch:8
  2⤵
  PID:2588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4992,i,16219559443529682750,5924745114536866990,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3540,i,16219559443529682750,5924745114536866990,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5112,i,16219559443529682750,5924745114536866990,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3716

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4720

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2284

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:1700

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:4412

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ClearInitialize.3gp2"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2892

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a2b855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f_000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001
Size 209KB
SHA256 27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
MD5 3e552d017d45f8fd93b94cfc86f842f2
SHA1 dbeebe83854328e2575ff67259e3fb6704b17a47
SHA512 e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
SSDEEP 6144:ewpSHs6ljYg6trFqiSAprekukr20IgIgR:OHvhlo8XGus2oR
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 7a588ab8dad4a4bc8348bb914da7f11e32054d9b6b4b8993ecf5adbc1552c02c
MD5 2e2a89b4d02b3b923c05e4436ec79d5a
SHA1 b44f4837d84bb5bb2b8138d26f13fbbf3f65e8bc
SHA512 0f0a92472e23c31e569a408e3d1b0fc68d0385530d909ac481a8c9649fdc2a60e954afa126e51433f61b96d9922f4175b1f7e2395ab632e98e3197a440e6c21e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 40a41bdf9637c362303ef03a50cc3cf0e20c5b3c88746e68b0af1ecb1b231d8d
MD5 ed17d3cde1e05d8ffa65ac0654b73bb8
SHA1 dadac0b7fd93041d94c73df988cfa3e1750351a8
SHA512 4819269e036526d1493032ee53a3f856a74ad65ab8ec0d44a9ced0569dbb5a5ef3da43226d416f70f88c38c94d0fb2713eaeee679e9c85f3f1b0a54df2db6a48
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c019e9ae18cd0ab04e80ec5398207ca5b68baa6460974eb1a9f4a45e8b779627
MD5 b943d02480ff105a90e96cc95e554c76
SHA1 3f199d7121283b18ec506b270103cacef2524966
SHA512 c3a52537c4acc3606f7c46a2f1e9e404804df4a057a6810ddbb57996a6acfa7d6a190cc9693adfd955b65d9b9557ec3bedc205a996f8b316c377c72d52304e55
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 354B
SHA256 55702c734b3dd365c70eada42d005a9e3a67ef4ea2833ef3b3f7219bb05dddf6
MD5 64d75085ec9ce3eb37768b96168d705d
SHA1 903d5e94b85600794b5d3ab2c83dd71a937872d7
SHA512 6961070a78a4a935aa60b78bbe6d9fe073a533453a34cc12ea750b8afac0da78853a738b5d0148826fa23ecabdd784a9854934caef1edadc5e447f67089c7307
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 354B
SHA256 51790f876bd13474a72a42e58d4d16ce876923d316bec06f0229a81b40ce00dc
MD5 89aed9532a3d765d04d43c62030aa294
SHA1 c2081b064e7d8f697cb23d8273bb954cae8219be
SHA512 0633f25a6ccb7dcf8a4b1db2838670d486f9a81553f078f810ab40863dd3340b9acef3b81237fe881eb967c95b2278b95b093116ab4663bc1e1b6c37ee7cd9ea
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 354B
SHA256 d7063f0eea1ae469154bea1a82e70148413325095703c8f1ad2d2f96ee7cb58c
MD5 605a800a2a84cc6cf5c30f220ffa91a6
SHA1 0d9b6470a8cd1265ed18422f303a8e4bae436f9e
SHA512 bee22c49cab8f1aa5d1927083c9aa60e01941eab30ee4c4e8f342ee64b8041abf2ba26c2fda1105e842b94cd2acbeda0a0cf2f758dc2a8b55b4a42046de5dea2
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 6fb78d559193176de556888f40894a3d4686471d54fd4bf6abf62f301f6976d6
MD5 2b2fa0cd98c05b58e6c5559ba36a6a35
SHA1 0fcf5c4c12b5e3057d07bc0338e304f8b4a6417b
SHA512 353237b65b12e4746e264f8fd4c27a8d05144daef547c220d16c3a35fbd88a53b86f0fec1a7e47a9392370e570875bb9809489a7e004718c8946d6f6522594fd
SSDEEP 96:UKX58S20XZ1AS0aKIfuBCCqBeY16Z7iH7/x+6MhmuecV5O9l4TmM2MoAy8yIsnVB:UKXB20foaJejiHV+FRExMPo6yIsnVdg4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 76983e0bbad938ae84708d47547f9e125102102d3c4abdf8d0d6e1fb2c057029
MD5 b22e5b862688bb7bbda1de3980ff2fca
SHA1 e8325fd8b4b8f297a6acd2c82456a8fd0d24708d
SHA512 011c82a1c62a776c5602821e502a62ad2210f5394aec636a90872f64d936dfd2ccf5d0fc3f833c28b39277e5cbbd67da8fb06c1997d1b9fe4a65c47bbaddfa22
SSDEEP 192:UKXB20foaWeAAiHV+FUmzk00xMPo6yIsnVdg4:UKXozAGGUwk06A4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 0978a44962b4a9a8ad9965292defc8bf6d905673312b19d92b8bdc90ab9b7784
MD5 160098c6a646b8e4c421dc6a6703c198
SHA1 691323302881b2d8d945b1939ce29ab207a5cb14
SHA512 f47f1a1ccf753d51d99e1f58165a18fed65e04c5e8ee77b649ef7789bef9aecb0e3ef2fa099e75b9ddf469b9226646e50e68cc057227124204393a38191a059c
SSDEEP 96:UKX58S20XZ1AS0aKIyChqBeY16Z7iH7/x+6MhmuecVp2O9TmM2MoAy8yIsnVqAh/:UKXB20foaOejiHV+FR3kMPo6yIsnVdg4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 bdaa783e8584637fc96cfd13ed3a350bfd359acd09a7827dff02643aa8dff97a
MD5 e1020260b2a512ce36a17ffb605ebbfd
SHA1 e91a38e73f065a16179a0dc6fd2c9f32a396e01a
SHA512 1e67a4394b54037bb7069272fd41566aea4be6826941d6bcf41591baafa2545f9ab5746283857a10810e62319750e5308e3a51def0f0dffa24a0a6f2a073b195
SSDEEP 96:UKX58S20XZ1AS0aKIyCqqBeY16Z7iH7/x+6MhmuecVp2O9TmM2MoAy8yIsnVqAh/:UKXB20foaVejiHV+FR3kMPo6yIsnVdg4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 6318c05e7e18bf7acfa4a60d24065bef39fbaf8158d7df4282e5365937dbfcad
MD5 ade100d7e6ba7a0192ef411ce7864d20
SHA1 246ec9a53734fa3dbbd0c33a62dfeb849d02dbde
SHA512 5c35b29b43e3a9390857240474e65a8ceb14ffc75696b6d6c1559e88de05a22bf67b7675a4b18e7af1a3b4308eaeb2a592ac2e9129bbda2e22806f4bcc321048
SSDEEP 192:yKXB20foa0eAAiHV+F3dsdxMPo6yIsnVdg4:yKXo5AGGts3A4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 e0147a71deda292dcce03e06d15391d0797ff4b581e1d999b53a8063db532694
MD5 f8e36e46d515294b63acb28ff44f08fd
SHA1 9e4e0cbc26c8a04f746df333000dd52f12efb171
SHA512 c113c2598389d9325b2655f4c5a6269ca59d2f5ba7bde575d919f754531eae2a39e885698e2c5a934456bdbfb053713d351fb844544eb59a03cb7108d25dc941
SSDEEP 3072:b1iMausf0pMIAfelh5DHz/TOaEne1iTaFPOjfLWzGH03oe35YUG0TFrmf7lJaQoZ:vhXnt7X0ewWFmjf5U3o310MBdodSq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 197KB
SHA256 7c6042ad36c8368c59043697aff239c8287d71a1a2faa33b11599e8ec3c7b97e
MD5 fbee955ad60f44f0f393530198f749e4
SHA1 a807a9c85fdde598f089d450f9c7be200f4ac438
SHA512 b4e24470651b1a0844e47231070a8e9a8e56b8bce36168aae57b5efb415598204bd1c902723defebb7ea7679ff4be61795a827f4495a0f1928414e6ff101f01e
SSDEEP 3072:d6UY1dFvj9CXpgL3QJOWpCRBT975wAQJiMausf0pMIAfelh5DHz/TOaEne1iTaFc:78zvpCcWor6AEhXnt7X0ewWFmX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 226KB
SHA256 259a4c432c835e9aac05db0660302b1d13d96d30409b7dd83f3a78ba0f0b84e2
MD5 352e2ab8134b3381bd3d69363ac39440
SHA1 915dc64da329555d22d28cc095cba011cb4a4c73
SHA512 6b85f43a829f8ed2515e22e5cf82dc6e20faf43c4c0509cddb9a900ed9bef3b17e467c25b63b47c8b46bae4a361abf98f6ed286d4fbc5254bad3955f950122fa
SSDEEP 6144:Bvz2bRou8zvpCcWor6AEhXnt7X0ewWFmX:Bvz+3+UcBq3UZX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 206KB
SHA256 099d00e02fea03acb389b16c72f2314fa55af94e7d984d01039ed4e41d499f9e
MD5 470dac15d315405e2cc9b914d3518f9c
SHA1 d4a89eaad64f997c980807381f2b6bb7290d257d
SHA512 7de8501ab7133854ec6137eb0d8b38f4e22d3cdbdae972f5e4a401c6d024f358096fd436bb46c2755947d76ffe14f9c219bba10a8046867cd6f43dfe9c8f82b6
SSDEEP 3072:1LmWhepfYUY1dFvj9CXpgL3QJOWpCRBT975wAQJiMausf0pMIAfelh5DHz/TOaE1:1Lm1pr8zvpCcWor6AEhXnt7X0ewWFmX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 197KB
SHA256 a477a52ab6f7e7bb6462f98aa423f3f80a7c96cdd841788020e0d3bb22348270
MD5 ce6848358bead89bbe2ffa9cc77addef
SHA1 14d31a3972d415138258f42fef694f2f9ae97004
SHA512 f09b8c5c0df7588d1c8c322e24bba26f241f15d95b27c4c538455f976d56345f92265dbebf23715feea711fa73a268abf96e187fcd84df00563f312f2c4758c8
SSDEEP 3072:8f5UY1dFvj9CXpgL3QJOWpCRBT975wAQJiMausf0pMIAfelh5DHz/TOaEne1iTai:828zvpCcWor6AEhXnt7X0ewWFmX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 197KB
SHA256 6099f05f1e588d5ca831f9ba44cbbc53685ca0fc3e395488454b8534f186a9f5
MD5 7717261509e4d3cc3b411de62ee4495b
SHA1 41f2535ff47a59f4ec8bf7ce8838de3d09c3a5b9
SHA512 c41e342c2478a5c653334696cb8d6097548f6b412e03108a774b877551ecfd54825cffc4af69c1d1fa255fb9bd8ea5f4746106a2eb928177024018cfdfacb1ba
SSDEEP 3072:w6UY1dFvj9CXpgL3QJOWpCRBT975wAQJiMausf0pMIAfelh5DHz/TOaEne1iTaFc:O8zvpCcWor6AEhXnt7X0ewWFmX
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 11bc364a0355ec380015738a320d37ab668559755988e8cb669903ecd50087b8
MD5 3b3e8694c0a868a465034d46b84e00e5
SHA1 4d9d5e069dfe370ffa20dbd88d065ace36a1b3fa
SHA512 97f1eb2467cd57b9741288e53aab39dcadb2dc906103187c640ad3749dc420b7e421d3a8190000ad6eb312e045cb042101a2974eca7108ace3a1d7b22e7187e7
SSDEEP 3:MsEllllkEthXllkl2zE/lAKl/:/M/xT02zkl/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2892-308-0x00007FF813670000-0x00007FF8136A4000-memory.dmp

Download

memory/2892-307-0x00007FF716F30000-0x00007FF717028000-memory.dmp

Download

memory/2892-309-0x00007FF812F20000-0x00007FF8131D6000-memory.dmp

Download

memory/2892-310-0x00007FF800A10000-0x00007FF801AC0000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads