Analysis
-
max time kernel
128s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03-08-2024 11:30
Behavioral task
behavioral1
Sample
2024-08-03_42194b88e5f44d3ba8a5638c29964943_poet-rat_sliver_snatch.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
2024-08-03_42194b88e5f44d3ba8a5638c29964943_poet-rat_sliver_snatch.exe
-
Size
15.2MB
-
MD5
42194b88e5f44d3ba8a5638c29964943
-
SHA1
8cd056cb7fe286c61f3aee0f0f023883798e3459
-
SHA256
26ee4c6a9d41415116ef45cd50d5f574abc160b64f777c4f8968296d57139620
-
SHA512
ba3ad02cd67692950d0fa50f8fd2c000daaf47f6ad202a9c0bbec688c0b16c06dcf6d2d83c2ff5c0070145e49f2d0c77407d9084664ac49a6d0f9f1ccfc159d5
-
SSDEEP
98304:d8/qpQLW6Ok6ePl8jWX1xYGqUZhV5s9hZu+Iua685Nc8R2mimFc2rhQL8LHVJ:iypQqWN8jW729Tu2Mi8RRlY8LH
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-08-03_42194b88e5f44d3ba8a5638c29964943_poet-rat_sliver_snatch.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1184 chrome.exe 1184 chrome.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 880 Process not Found 3240 Process not Found 400 Process not Found 3656 Process not Found 1380 Process not Found 1180 Process not Found 744 Process not Found 2464 Process not Found 3228 Process not Found 224 Process not Found 3436 Process not Found 4472 Process not Found 3972 Process not Found 1456 Process not Found 3644 Process not Found 4536 Process not Found 4828 Process not Found 4952 Process not Found 2280 Process not Found 4656 Process not Found 764 Process not Found 972 Process not Found 4516 Process not Found 1224 Process not Found 2432 Process not Found 1168 Process not Found 1288 Process not Found 4296 Process not Found 408 Process not Found 2760 Process not Found 1712 Process not Found 3284 Process not Found 4840 Process not Found 4912 Process not Found 2580 Process not Found 348 Process not Found 1928 Process not Found 1160 Process not Found 4668 Process not Found 5016 Process not Found 2160 Process not Found 2256 Process not Found 5056 Process not Found 1000 Process not Found 2684 Process not Found 3116 Process not Found 1300 Process not Found 3352 Process not Found 936 Process not Found 876 Process not Found 3768 Process not Found 5004 Process not Found 2624 Process not Found 3296 Process not Found 2044 Process not Found 4572 Process not Found 3476 Process not Found 5068 Process not Found 5108 Process not Found 396 Process not Found 3440 Process not Found 4812 Process not Found 2076 Process not Found 2844 Process not Found -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeShutdownPrivilege 1184 chrome.exe Token: SeCreatePagefilePrivilege 1184 chrome.exe Token: SeShutdownPrivilege 1184 chrome.exe Token: SeCreatePagefilePrivilege 1184 chrome.exe Token: SeShutdownPrivilege 1184 chrome.exe Token: SeCreatePagefilePrivilege 1184 chrome.exe Token: SeShutdownPrivilege 1184 chrome.exe Token: SeCreatePagefilePrivilege 1184 chrome.exe Token: SeShutdownPrivilege 1184 chrome.exe Token: SeCreatePagefilePrivilege 1184 chrome.exe Token: SeShutdownPrivilege 1184 chrome.exe Token: SeCreatePagefilePrivilege 1184 chrome.exe Token: SeShutdownPrivilege 1184 chrome.exe Token: SeCreatePagefilePrivilege 1184 chrome.exe Token: SeShutdownPrivilege 1184 chrome.exe Token: SeCreatePagefilePrivilege 1184 chrome.exe Token: SeDebugPrivilege 3004 taskmgr.exe Token: SeSystemProfilePrivilege 3004 taskmgr.exe Token: SeCreateGlobalPrivilege 3004 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 1184 chrome.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1184 wrote to memory of 948 1184 chrome.exe 86 PID 1184 wrote to memory of 948 1184 chrome.exe 86 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1300 1184 chrome.exe 87 PID 1184 wrote to memory of 1168 1184 chrome.exe 88 PID 1184 wrote to memory of 1168 1184 chrome.exe 88 PID 1184 wrote to memory of 5068 1184 chrome.exe 89 PID 1184 wrote to memory of 5068 1184 chrome.exe 89 PID 1184 wrote to memory of 5068 1184 chrome.exe 89 PID 1184 wrote to memory of 5068 1184 chrome.exe 89 PID 1184 wrote to memory of 5068 1184 chrome.exe 89 PID 1184 wrote to memory of 5068 1184 chrome.exe 89 PID 1184 wrote to memory of 5068 1184 chrome.exe 89 PID 1184 wrote to memory of 5068 1184 chrome.exe 89 PID 1184 wrote to memory of 5068 1184 chrome.exe 89 PID 1184 wrote to memory of 5068 1184 chrome.exe 89 PID 1184 wrote to memory of 5068 1184 chrome.exe 89 PID 1184 wrote to memory of 5068 1184 chrome.exe 89 PID 1184 wrote to memory of 5068 1184 chrome.exe 89 PID 1184 wrote to memory of 5068 1184 chrome.exe 89 PID 1184 wrote to memory of 5068 1184 chrome.exe 89 PID 1184 wrote to memory of 5068 1184 chrome.exe 89 PID 1184 wrote to memory of 5068 1184 chrome.exe 89 PID 1184 wrote to memory of 5068 1184 chrome.exe 89 PID 1184 wrote to memory of 5068 1184 chrome.exe 89 PID 1184 wrote to memory of 5068 1184 chrome.exe 89 PID 1184 wrote to memory of 5068 1184 chrome.exe 89 PID 1184 wrote to memory of 5068 1184 chrome.exe 89 PID 1184 wrote to memory of 5068 1184 chrome.exe 89 PID 1184 wrote to memory of 5068 1184 chrome.exe 89 PID 1184 wrote to memory of 5068 1184 chrome.exe 89 PID 1184 wrote to memory of 5068 1184 chrome.exe 89 PID 1184 wrote to memory of 5068 1184 chrome.exe 89 PID 1184 wrote to memory of 5068 1184 chrome.exe 89 PID 1184 wrote to memory of 5068 1184 chrome.exe 89 PID 1184 wrote to memory of 5068 1184 chrome.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-03_42194b88e5f44d3ba8a5638c29964943_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-03_42194b88e5f44d3ba8a5638c29964943_poet-rat_sliver_snatch.exe"1⤵
- System Location Discovery: System Language Discovery
PID:5044
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe5ab9cc40,0x7ffe5ab9cc4c,0x7ffe5ab9cc582⤵PID:948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,7433592788087895751,18262564539793533206,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1916 /prefetch:22⤵PID:1300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2196,i,7433592788087895751,18262564539793533206,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2440 /prefetch:32⤵PID:1168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2236,i,7433592788087895751,18262564539793533206,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2448 /prefetch:82⤵PID:5068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3180,i,7433592788087895751,18262564539793533206,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:2924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3360,i,7433592788087895751,18262564539793533206,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:1528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4568,i,7433592788087895751,18262564539793533206,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3748 /prefetch:12⤵PID:3504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4852,i,7433592788087895751,18262564539793533206,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4860 /prefetch:82⤵PID:2384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4904,i,7433592788087895751,18262564539793533206,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4924 /prefetch:22⤵PID:3264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3856,i,7433592788087895751,18262564539793533206,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4820 /prefetch:82⤵PID:3356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5044,i,7433592788087895751,18262564539793533206,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5360 /prefetch:12⤵PID:1348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3436,i,7433592788087895751,18262564539793533206,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4204,i,7433592788087895751,18262564539793533206,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4504 /prefetch:12⤵PID:4744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5564,i,7433592788087895751,18262564539793533206,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5572 /prefetch:12⤵PID:4520
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:4304
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4568
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3004
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4876
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3444
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3064
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3356
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3884
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2984
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:4728
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
456B
MD56e34d018bd9bca53a8842a411fe75538
SHA1d357af133d471d3c04dc2d8d07eaf84d0aae3967
SHA2562de39f0e7c0257def8fd8b7d2c8ea3a90e471322f1821f9e2eeed370017b5cad
SHA512f394adc712da6261b590306ed374a6a09413ec23643263945614765131cbd5fccceefdabf85ef5f923315ecfc5a76c7526fafd97cf8489c6bcf174b98ac0f5e7
-
Filesize
4KB
MD529c7e435cb082bc7e048939734f8b99d
SHA1469391777f6cb5ad537f49c9a7856cca5c2e78dd
SHA2569d93c5079c08181cd17092f337d7fe4c362a465ed43534f95ec4ccad13d2642c
SHA5128bd67b32e69f70728c00e5b9440d69c7f3b82bb5b6b82ca8b1b764451788c32915f28713897c2432eb13c69c388be7bd401a5771cda5ad3b789e8c5114e05915
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
690B
MD5cdb690b827fda39255abe79840afbf75
SHA118df15e131eaa0874eb3bc79c272b789b1e57263
SHA2561d56e4dabfadd38c05b60a60a5639b25ae8bb846db2b3d017ab2c49692fef008
SHA51228309bd57144149dde9616c2a65a8985f8a438cf2ca9a27d59c45f02a9e2781a25f523153be4f91c838f70775045bf19017ed7aa08c15021871f9da9be2296c9
-
Filesize
8KB
MD5becc1703ef136201b15e6e33ac84b272
SHA1c7766ce0dc416594d0e48201e6eb2321da648087
SHA256871c754900c37e1c9673a26301c0966c0afc1761fce453f71f44d4dc4c44041b
SHA512ec5fab979e16dabd08f15a047e4e62425fd12cc5146c4d53c51c9d23ed5ea34fa2fd4a38e29e6e32efc96cc58a7001a501eaa884678744e3abfe2973fee232c6
-
Filesize
15KB
MD5fca6f192b5e916b38d431b1ba30f4443
SHA18567f1c2d79f9dd3c9cb5ae02b41494183d86c0d
SHA256a172bb0e7a4a057f0ccf5832007777b30b5cf76919ca86be7fd99c9db7b5b79e
SHA512fe88a12f403f312197b0a0937d8905f8a5e651424fb8bde7a7abc82dd5e2fd261c5ec43e9d37cbc7e174a4da49a3dc751d632ab2b2b584a9109843d8cc9261ba
-
Filesize
195KB
MD5c3a9e09fc2b3884be344bf093956f2f6
SHA13d49d8b3b4486392295946ee5adfca2ecbd671fb
SHA256e156d0ce91d75b0f123d5633887bfa63155f007e37a3b2731e45194a52857d15
SHA51220de97d17a5174de72c16f85cf9043b655d02bb9e3bc88d8fb73ab003bc93ae6d3f5f07c374107a68062ad9845d8f1baef602f96cd1f7a95dd2e757cf1c65b12
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58