stormkitty | d633cf3249a08f878a33ef419131e8affd85600923170109317906cefeb1e62f

Analysis

max time kernel
67s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
04-08-2024 21:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Discord-Raid-Tool-Box-main/PussyKiller.exe
Size

74KB
MD5

7acd7ca811c678a92d62d556cae858dc
SHA1

b05d0fd47d2d905234db53614f725e3744c93b3e
SHA256

736f8b467d09e4805d336c56b49ec183355dc433e04b93904d2e8d5876d5b9de
SHA512

24fe70950fc092d9de383f5c80c70bdc4bd5e342b927e2fb495752e0036c3d2eb0547f60467ef5019a686fffd2f8057105d13dd566172f9438ffe4434748166b
SSDEEP

1536:rNtW7bvrmSbUMiuidaw6v3ZfXR6/A8Id0FWGV09auvIUxjFxtbm:rzTyXRKA8Iwg9auvIUhFxty

Score

10^/10

stormkitty discovery persistence stealer

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/2716-1-0x0000000000800000-0x0000000000818000-memory.dmp	disable_win_def

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral1/memory/2716-1-0x0000000000800000-0x0000000000818000-memory.dmp	family_stormkitty

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\nvidiaDValueOn = "C:\\Users\\Admin\\AppData\\Local\\NVIDIA Local Drivers\\DriversUpdateProcess_x64.exe"	PussyKiller.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	checkip.dyndns.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2884	chrome.exe
2884	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2716	PussyKiller.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2788	2716	PussyKiller.exe	30
PID 2716 wrote to memory of 2788	2716	PussyKiller.exe	30
PID 2716 wrote to memory of 2788	2716	PussyKiller.exe	30
PID 2884 wrote to memory of 2320	2884	chrome.exe	34
PID 2884 wrote to memory of 2320	2884	chrome.exe	34
PID 2884 wrote to memory of 2320	2884	chrome.exe	34
PID 3012 wrote to memory of 2876	3012	chrome.exe	36
PID 3012 wrote to memory of 2876	3012	chrome.exe	36
PID 3012 wrote to memory of 2876	3012	chrome.exe	36
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 2968	2884	chrome.exe	38
PID 2884 wrote to memory of 1740	2884	chrome.exe	39
PID 2884 wrote to memory of 1740	2884	chrome.exe	39
PID 2884 wrote to memory of 1740	2884	chrome.exe	39
PID 2884 wrote to memory of 2036	2884	chrome.exe	40
PID 2884 wrote to memory of 2036	2884	chrome.exe	40
PID 2884 wrote to memory of 2036	2884	chrome.exe	40
PID 2884 wrote to memory of 2036	2884	chrome.exe	40
PID 2884 wrote to memory of 2036	2884	chrome.exe	40
PID 2884 wrote to memory of 2036	2884	chrome.exe	40
PID 2884 wrote to memory of 2036	2884	chrome.exe	40
PID 2884 wrote to memory of 2036	2884	chrome.exe	40
PID 2884 wrote to memory of 2036	2884	chrome.exe	40
PID 2884 wrote to memory of 2036	2884	chrome.exe	40
PID 2884 wrote to memory of 2036	2884	chrome.exe	40
PID 2884 wrote to memory of 2036	2884	chrome.exe	40
PID 2884 wrote to memory of 2036	2884	chrome.exe	40

C:\Users\Admin\AppData\Local\Temp\Discord-Raid-Tool-Box-main\PussyKiller.exe
"C:\Users\Admin\AppData\Local\Temp\Discord-Raid-Tool-Box-main\PussyKiller.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2716 -s 916
  2⤵
  PID:2788

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6629758,0x7fef6629768,0x7fef6629778
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1300,i,14674267495795797029,12755478364297575123,131072 /prefetch:2
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1512 --field-trial-handle=1300,i,14674267495795797029,12755478364297575123,131072 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1596 --field-trial-handle=1300,i,14674267495795797029,12755478364297575123,131072 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2128 --field-trial-handle=1300,i,14674267495795797029,12755478364297575123,131072 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2136 --field-trial-handle=1300,i,14674267495795797029,12755478364297575123,131072 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1312 --field-trial-handle=1300,i,14674267495795797029,12755478364297575123,131072 /prefetch:2
  2⤵
  PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1376 --field-trial-handle=1300,i,14674267495795797029,12755478364297575123,131072 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3696 --field-trial-handle=1300,i,14674267495795797029,12755478364297575123,131072 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3788 --field-trial-handle=1300,i,14674267495795797029,12755478364297575123,131072 /prefetch:1
  2⤵
  PID:2004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6629758,0x7fef6629768,0x7fef6629778
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1136 --field-trial-handle=1300,i,4354590377515303279,11309833012691075726,131072 /prefetch:2
  2⤵
  PID:1020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1300,i,4354590377515303279,11309833012691075726,131072 /prefetch:8
  2⤵
  PID:1520

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2016

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x470
1⤵
PID:920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2b7c4110-19fe-4ecb-ad19-e037ef91a869.tmp

Filesize
311KB

MD5
3f4936250a93c65baec8b2fb62362fca

SHA1
faa75346d85122528d6cb363896eed048a4f959d

SHA256
60a9fbc7500cf8cd36ff22a4e9c73cea2e4b782ef36208c0ff77e712bb8ec2c9

SHA512
04d4b7e72dda95b71d2d77d2873494f95bf8ae83410c901dca66975e21c836bd0d6f51a1cd8cfa824112fd605ac64003061fd3a6bd95b4a1c87558a038d9adab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
51b3f2696f2411664a3530ccc1b78570

SHA1
71a56319bbe5a4cc81c9002a32622ecee1539785

SHA256
450844e776ba0af5dcda1885d25fef8f269f1ee79c51e9b42c691a706d8846a9

SHA512
d166c48bea335ef71e9b397c4254d6f129b96703866d19ee380f9967fa93013b4cfcf3e55f70af73debda99a340704d73f1864c71e33681385ed069b7fe691ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
6d5f6da99a2a01578cdf589670345662

SHA1
704e37c65b6dac1223515e15fba6a0faf7e0cd02

SHA256
447309e6a59223a9b9f55dedd1223f4d9ef49716941700e411f4995f3c534d32

SHA512
6fab8a6853d59df4d39004183ebcfce50b77cfb6d7d0750bd8a7ec3ec3311f9e6527d6b8c574db74a2d6c5d14c176e8266e8f4255590c8d4ab22683e315b175c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
eb9883f42a04f1f1c9a7d51d88291d60

SHA1
6c7380bfcdd84be76ef397a71e07b977d6e4b9da

SHA256
c46a263371e9ef2ff76caebfa1a4ae1a59c5eaa89ac94086ff113a8a44d92acb

SHA512
ee59919d77a62b03cb1431b340826ed94cbc767156c43245d56fcfe7c4b465a204006dfd04ca434e218a4e760cf1205c6ba7e9e1e5eaa07fa0bf4051b4d95b8e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
3af171c784905e437274c0efe454434c

SHA1
8e6ddcdb96ce01083991d274dc666a574e9fb637

SHA256
beb8d48b17271c6eb871e399982eb32867e092e825dac3a1b4e22ad31b22fc9e

SHA512
f2b2e0947625d293c9d3a3acd31563d2653b489f25eac02206b915865c9d51afe54f7609668a390da5c07b0efc5d67d271b697aada7c72b0727c3a762d2ffa7f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
665b22d53dad643d749d2260772a633f

SHA1
0ac645e6a173f346ae26c55a8d1a6c6bb4155879

SHA256
4927aea27d1faea2e85bef4774826999ebfc6723f2d24eccc13623a5bf6e94a0

SHA512
c9b4e396a624c3609f2d5494d2ac79b34710c8f55cb93a9f1ac5019b57b7ae0b751cc501b6204fe805181366bc3d19a5d02ab74216703c9bb23863ecb4215537

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
ab19f8d0cf5076ab747f8493f3619a31

SHA1
55c1bea9cf3a79b8fefa688f775123f17edf11c9

SHA256
e8ef808914f97b4678e00b4cf7e08aa445cf654d7bd981d5614843c15ea98df7

SHA512
b7c5760478984c1894021de26bbae09389175a21fffbd884e5eaf7ac8d19402a766f80fe2148826d5a6ee28e45900dcb8e11d171bde2c24d4bfaf72ec7c39c5d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\CURRENT

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
311KB

MD5
b6e793e18c97d11d4e7e1ac4435dfb77

SHA1
227c83e2c3f5dc98dac80c87992e5736f545a638

SHA256
e27e69cf6e6072aa69b6c6e92a081ee1908e95dc556df024098933f740679fd7

SHA512
e0b21ce3f6ef2ad709feeb011a84899ebf0715896246bf6b03806d15075bb2db610a97be64eed68f3eaa71f76011a4ba82d25cd4f6fead88bcfae4a24ade4037

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
f732dbed9289177d15e236d0f8f2ddd3

SHA1
53f822af51b014bc3d4b575865d9c3ef0e4debde

SHA256
2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93

SHA512
b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
85B

MD5
bc6142469cd7dadf107be9ad87ea4753

SHA1
72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c

SHA256
b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557

SHA512
47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c7ee4a79-84ea-4e80-8795-a53e75dea8ea.tmp

Filesize
305KB

MD5
ed839d4674c4ab516e339d59f3b55fd4

SHA1
4b9534d602861f563d41db0d0be36e6fc2ab9f7b

SHA256
6a6ad343be250e5ac1bbe554b34941547aaa7633873c55e41b69de048ef3a7b1

SHA512
e4c639bb347f95609a90591c92404357b21b430383ceee8ed75c4ec5753a362300a0f9c14349b6455050385ca0e24fd051b87e682eb5d79ae1b4f1ae7fd08ac6

Download Submit
memory/2716-0-0x000007FEF4CA3000-0x000007FEF4CA4000-memory.dmp

Filesize
4KB

Download
memory/2716-5-0x000007FEF4CA0000-0x000007FEF568C000-memory.dmp

Filesize
9.9MB

Download
memory/2716-2-0x000007FEF4CA0000-0x000007FEF568C000-memory.dmp

Filesize
9.9MB

Download
memory/2716-1-0x0000000000800000-0x0000000000818000-memory.dmp

Filesize
96KB

Download