b1b4d89ca9c56263a615e59c1c5d74e9264136c421ea3f427482059f79a776bd

Resubmissions

07/08/2024, 17:12

240807-vqwtfavarg 3

07/08/2024, 17:10

240807-vp6l9a1djl 3

07/08/2024, 17:07

240807-vm2khsvang 3

07/08/2024, 17:04

240807-vlb88svamb 10

Analysis

max time kernel
106s
max time network
107s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
07/08/2024, 17:04

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Justice.png
Size

2KB
MD5

dc7afebab639601c46c7f8cab69e0ae2
SHA1

8874b5daf7ead50b72f24d255284f2d5c14ec2d1
SHA256

b1b4d89ca9c56263a615e59c1c5d74e9264136c421ea3f427482059f79a776bd
SHA512

5fd5bdf419e9250c3e8556a059a2613a50ef5d12505030f9d183a3ad789307e17ab112b80ae85845e4107bd4ee7cc2595c6d833801b97f8f28c37f56ec834d20

Score

10^/10

defense_evasion discovery evasion persistence ransomware trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\launch.exe"	reg.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Downloads MZ/PE file

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
3060	attrib.exe
3920	attrib.exe

Executes dropped EXE 1 IoCs

pid	Process
3128	No Escape.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
41	raw.githubusercontent.com
12	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Control Panel\Desktop\wallpaper = "C:\\hello.jpg"	reg.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\date.txt	No Escape.exe
File created	C:\Program Files (x86)\hello.jpg	No Escape.exe
File created	C:\Program Files (x86)\mover.exe	No Escape.exe
File created	C:\Program Files (x86)\shaking.exe	No Escape.exe
File created	C:\Program Files (x86)\launch.exe	No Escape.exe
File created	C:\Program Files (x86)\msg.exe	No Escape.exe
File created	C:\Program Files (x86)\mypc.exe	No Escape.exe
File created	C:\Program Files (x86)\	No Escape.exe
File opened for modification	C:\Program Files (x86)\	No Escape.exe
File created	C:\Program Files (x86)\erode.exe	No Escape.exe
File created	C:\Program Files (x86)\hello.bat	No Escape.exe
File created	C:\Program Files (x86)\hello.reg	No Escape.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\No Escape.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	No Escape.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133675238944694171"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "14"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1420	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\No Escape.exe:Zone.Identifier	chrome.exe

Runs .reg file with regedit 1 IoCs

pid	Process
4832	regedit.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4664	chrome.exe
4664	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3128	No Escape.exe
2232	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 3952	4664	chrome.exe	83
PID 4664 wrote to memory of 3952	4664	chrome.exe	83
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 2380	4664	chrome.exe	84
PID 4664 wrote to memory of 4444	4664	chrome.exe	85
PID 4664 wrote to memory of 4444	4664	chrome.exe	85
PID 4664 wrote to memory of 1032	4664	chrome.exe	86
PID 4664 wrote to memory of 1032	4664	chrome.exe	86
PID 4664 wrote to memory of 1032	4664	chrome.exe	86
PID 4664 wrote to memory of 1032	4664	chrome.exe	86
PID 4664 wrote to memory of 1032	4664	chrome.exe	86
PID 4664 wrote to memory of 1032	4664	chrome.exe	86
PID 4664 wrote to memory of 1032	4664	chrome.exe	86
PID 4664 wrote to memory of 1032	4664	chrome.exe	86
PID 4664 wrote to memory of 1032	4664	chrome.exe	86
PID 4664 wrote to memory of 1032	4664	chrome.exe	86
PID 4664 wrote to memory of 1032	4664	chrome.exe	86
PID 4664 wrote to memory of 1032	4664	chrome.exe	86
PID 4664 wrote to memory of 1032	4664	chrome.exe	86
PID 4664 wrote to memory of 1032	4664	chrome.exe	86
PID 4664 wrote to memory of 1032	4664	chrome.exe	86
PID 4664 wrote to memory of 1032	4664	chrome.exe	86
PID 4664 wrote to memory of 1032	4664	chrome.exe	86
PID 4664 wrote to memory of 1032	4664	chrome.exe	86
PID 4664 wrote to memory of 1032	4664	chrome.exe	86
PID 4664 wrote to memory of 1032	4664	chrome.exe	86
PID 4664 wrote to memory of 1032	4664	chrome.exe	86
PID 4664 wrote to memory of 1032	4664	chrome.exe	86
PID 4664 wrote to memory of 1032	4664	chrome.exe	86
PID 4664 wrote to memory of 1032	4664	chrome.exe	86
PID 4664 wrote to memory of 1032	4664	chrome.exe	86
PID 4664 wrote to memory of 1032	4664	chrome.exe	86
PID 4664 wrote to memory of 1032	4664	chrome.exe	86
PID 4664 wrote to memory of 1032	4664	chrome.exe	86
PID 4664 wrote to memory of 1032	4664	chrome.exe	86
PID 4664 wrote to memory of 1032	4664	chrome.exe	86

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3060	attrib.exe
3920	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Justice.png
1⤵
PID:676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff840f6cc40,0x7ff840f6cc4c,0x7ff840f6cc58
  2⤵
  PID:3952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1836,i,13286275808456412470,13194307164651201518,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1828 /prefetch:2
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2128,i,13286275808456412470,13194307164651201518,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2216,i,13286275808456412470,13194307164651201518,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2220 /prefetch:8
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3104,i,13286275808456412470,13194307164651201518,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3136,i,13286275808456412470,13194307164651201518,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4540,i,13286275808456412470,13194307164651201518,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3108 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4820,i,13286275808456412470,13194307164651201518,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4980,i,13286275808456412470,13194307164651201518,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4864 /prefetch:8
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4296,i,13286275808456412470,13194307164651201518,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3336,i,13286275808456412470,13194307164651201518,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3300 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3312,i,13286275808456412470,13194307164651201518,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4632 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3332,i,13286275808456412470,13194307164651201518,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3244 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:5016
- C:\Users\Admin\Downloads\No Escape.exe
  "C:\Users\Admin\Downloads\No Escape.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3128
- - C:\Windows\system32\wscript.exe
    "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\2ABF.tmp\2AC0.tmp\2AC1.vbs //Nologo
    3⤵
    PID:2072
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\hello.bat" "
      4⤵
      PID:3684
    - - C:\Windows\system32\attrib.exe
        
        attrib +s +h C:\msg.exe
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3060
    - - C:\Windows\system32\attrib.exe
        
        attrib +s +h C:\launch.exe
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3920
    - - C:\Windows\regedit.exe
        
        regedit /s hello.reg
        5⤵
        Runs .reg file with regedit
        
        PID:4832
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System /v DisableLogonBackgroundImage /t REG_DWORD /d 1
        5⤵
        
        PID:4692
    - - C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d C:\Windows\system32\userinit.exe,C:\launch.exe /f
        5⤵
        Modifies WinLogon for persistence
        
        PID:4756
    - - C:\Windows\system32\reg.exe
        
        reg add "HKEY_CURRENT_USER\control panel\desktop" /v wallpaper /t REG_SZ /d C:\hello.jpg /f
        5⤵
        Sets desktop wallpaper using registry
        
        PID:4964
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoChangingWallPaper /t REG_DWORD /d 1
        5⤵
        
        PID:3516
    - - C:\Windows\system32\reg.exe
        
        reg ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        UAC bypass
        
        PID:2612
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2
        5⤵
        
        PID:4532
    - - C:\Windows\system32\reg.exe
        
        REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
        5⤵
        Disables RegEdit via registry modification
        Modifies registry key
        
        PID:1420
    - - C:\Windows\system32\net.exe
        
        net user Admin death
        5⤵
        
        PID:4172
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user Admin death
        6⤵
        
        PID:3588
    - - C:\Windows\system32\shutdown.exe
        
        shutdown /t 0 /r
        5⤵
        
        PID:3172

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:600

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a22855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\date.txt

Filesize
120B

MD5
255a8e245b6ad378558b90cbe3dbc3d0

SHA1
6eb73f9f2034c113a2a6b1aab9a440a21928cfc2

SHA256
d3195bde888f9b8a71f2eb840222f1586b652d0ede9f39841a180ead03633ca9

SHA512
67e03d7bffa0dec32535b6da46d5b7f38d94a7c9a231aa2fa625b81485d41c1ecac95b08fe5b7a605fcfe1c7e37c55ee716c9045df90ea6e030b86e52ec09edf

Download Submit
C:\Program Files (x86)\hello.bat

Filesize
1KB

MD5
b86fddd2b764f079615be5d4dc3e158d

SHA1
2510479054db1fe52cc2dcd3c7033d91204cb367

SHA256
2b2114784d15b0b0d5475256851b4d0d4da7181198c2a93a304ecedb98eaf091

SHA512
915363bc9f6e665358c8d25f5f5f51d64c53cb755be999013217162b126705ce641ea809047bc84511db7e3e383b848ec3932924baa8926d51a51d0037a5ca63

Download Submit
C:\Program Files (x86)\hello.jpg

Filesize
110KB

MD5
057ea45c364eb2994808a47b118556a2

SHA1
1d48c9c15ea5548af1475b5a369a4f7b8db42858

SHA256
6e1115188aa00fb5ff031899100bacb0d34819707e069bca3eb53935ebb39836

SHA512
582c7ecf2d0c33c8706ff3f39aa926780aa8f0dc0ff5d563905a5100254b81b89def22206abee0871ab339a3d463de9e6ec1782d92198e8f386f173654b6e760

Download Submit
C:\Program Files (x86)\hello.reg

Filesize
3KB

MD5
81427e9d5d10657b9edffd22e7b405bb

SHA1
f27ab62f77f827dbb32c66a35ac48006c47f4374

SHA256
bb21001c1c468e6e372d836952c3efb7fbdc98e9a20a1bfdcc4beb1b7a1e7f83

SHA512
b0ee65bcef13be7c17db6e06b96cd44774fcebe6f4a411b0073493ff53f795e3b7c49e921c3bd2e41256638bc161f5218d1c51b589c3e10164f8f2c0d1db1592

Download Submit
C:\Program Files (x86)\launch.exe

Filesize
92KB

MD5
b4acc41d0e55b299ffeec11a8a20cf08

SHA1
bbee20882bdd9dcd24b54b6af6c48cf5efc8c6fa

SHA256
34bc0d5b6029a74b9cda56b72434ec1b55b6742ff5ef832d36027a987a63cd42

SHA512
d4fa9900d703ea12d508929718433f97581a23b63458e5070ff7749871a7f60889db45098ec2972687b864ba97ab4fc307e8c80c4450dee79c0a5738818d2794

Download Submit
C:\Program Files (x86)\msg.exe

Filesize
9KB

MD5
331a0667b11e02330357565427dc1175

SHA1
d84c1ae0bf2c8ca1f433f0086ca86e07f61204c2

SHA256
fc7174e44a1d34040c3bc05ce24e648742a38a3accce22e8300d7059e4d12431

SHA512
1c47f0438dce58d473d93c10f233650df3e86d7e762a08b3a933da37683e76a079d275db4a1b4028d903f7e43f487173ba8bb25c4cff6f3e1161d0a5b2b18cec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
6db8b596607766e3e7b96fbe5e8e30a0

SHA1
50677f2c94b4cd8715be1bd81bbcc048a7985262

SHA256
00ebb9eadd6f2044db9cc0cd3dc5185ca76ed795625ef9ba96c169809d4163a1

SHA512
bef1a353881053ec10ead2ba60fda9dfc5ceb424e34284cdea3bb269c2e4206401d8e1f28fba1ca4f8641bb22ecece4bfaed64ee7929008bdb34faa33d8ae63e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
24bd18ad7b893d3aa63b30cda9be535e

SHA1
5fbb62eb302aed9bf74341fe51a00e009b9d80c5

SHA256
a0b840183eff7c4921de009cca5254210a7c0ef78c2035a1d28474bb912ea66c

SHA512
4a20fb21194c7b21fdec2235b0c986c1cb76ccd42a6f7d3c4b40314259080c3dd4b6431400ccb0bc1ec8ab7a105f11f1483148385db3f50f434e9679b8ec5d67

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
82958cd419f6c739854fc875b3b6503f

SHA1
46e07d0831282273a0806dd73566d6c8e9ffbeb5

SHA256
18d3c9a5bb5ce65d958092e394e0ca93bc3f02d109d3720e19999e4cc2fe1fc9

SHA512
43fca18b91b6d021514c4d134bf821695d08a0a541d67e81813ade70c3327098a8bca1c9cbc64ca7f74887b4cdba684ccb9fe8944aeadff05cda4a8ba7b15692

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
00c93ff5c3c177c3c0e912283160e2a1

SHA1
7346e6811e83f419f2fbbfce06598dc173c8b04c

SHA256
fcd1538b3c8325e650ababc26cc6c94c615979c1c8fcdd6303e43f65ff374933

SHA512
d77c26d2f7aa43e3241dcbf1f5eba9f25bf840eb1b47ce60080f0145b65187d136a3a5c54783786150f8c61651265779c13bf470b0838539888c42f09d637dd9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
a0ddcace1b551d8ce29b05ae951481fe

SHA1
726a3dc49ceddae3ca64d9ebf3764fac06f8112f

SHA256
d25aa78991b02711738b3d334d789c91b308cf1c32308a0ddb9c96af8c936177

SHA512
bb95724c873fba982417cc64c08f0e54259bc9cf30cc00cf72f93cbbb7fc246f475c622c40224a9a76dfbaff58e059971f38337ff527affa6d10ac6c8a25cfc0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
cae644cd854b863341d599a1bb8d1fed

SHA1
012e14a6aedc3de599a4af34b7418fb82a962d56

SHA256
be4b513ffa822096651d7f04433f17701e9dcafcadcc661e564e09a297bb836c

SHA512
5620d2a686c92492f11afc8d735e14574123a8c79edc1ba06aa8f56a18ba9bd25d5ff409e148f4e5bea0ba569030cedc0246ecf44a4204009734c3cb10f90030

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
a633723de522d422531a7066fdf978a0

SHA1
90a1f379e468860d0601b5327ae9db82160da1a9

SHA256
d23a917d14a101ba4359a268886f7d85d00c98a7cc4c76aab1d44a40eacbdf54

SHA512
389885681e7195d73121d21276e35f5c2a89956e7df3024cf565a5f0913f08526a8751ab1a02993c1955962e8f9391f6232e7ddc4fd7514edae3295eb1eeb1f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
8f8a120d99df03bd0a7c07e4656e842f

SHA1
f68301477e82cff37f121c7d007c2d45a24400bb

SHA256
ebd2324ea6f5c1463d6381d26ded9d6fd97ec43bc35e5583140ae997c4c01968

SHA512
51201ba1f99fcd8db205cfd7b6a9b2035a2078a23eec63b40139ea5e95cc92b57b112b6e9b685447d520a965c733b55617035f50f2bf191013a2e5bed24e589e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
80e9a2a7fae56fd46a3215077641f9f7

SHA1
2dff4fbec4f505da7683996afd3235f129532443

SHA256
19a664d4c1109be852af94e4ac20e7d9ab095ff6350861f9530fdb0bb1446052

SHA512
327a76f2fa20d11ef3548d4eb5b5717360f71abcaadf123fada2ca395adbae86ef74c347d950fbb5f54032758ac0293d26aeb7e0dcfe207929d7a3762a772de3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e047a699c074cd4d7fd143e7e1c29ba5

SHA1
10465eb981415e973843cfb284dbe2d02f8d4bb2

SHA256
51dc6836cd89423cbc34ce9b1882668e95336ab3ebb36c387124c7d37346a619

SHA512
f5b29600666aec1939b9b63594c4007525f6970c58d9ee9b67021cd717593b52c06c3c006e3073800bed4a3e7b4e0121f5da665dc7a75eb3624bdc17cf29728b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
bf824a46df08fb94821171076012b123

SHA1
6d38d5d649bc36ed2bfc8606235346a93d81eeb1

SHA256
74588c225685f665379c83573147114dd07b083062cb78dc65ecfbc3bf72e85b

SHA512
6a6921c24fba78ad5ee202074449214ef4a0e42b87193e1abb444bd6146314435128f070148f49076ba795aeb44be453d66549110a47e6abba5faa7de5286c4d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
1784d40e398ff8bb86ab7781ad3f8977

SHA1
213e6aa0450f2419fb20f960b68b42dbb394c410

SHA256
71cc20a31a7f65a6fde9c5f263e5083f21f4907dff25df80c58de11ba3fb3b71

SHA512
980c4946d1d47123f7ac5b3c9885ad051dc55fbd25a014063b8980a1ec34b3fa08e84386deb4307216576f6d48733fc306455510bf20c314ac7dadb38832fc21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
195KB

MD5
5a9f4ea420bd0691192aae8ccf0496e1

SHA1
5db48f021274628cd7624f090736fbd9bd304b99

SHA256
d6065990a616caf7dd8d492cfb393c212324fc076f6d22912d311e7cc25a1325

SHA512
36a026e4ef0379c5d04d058c92b54859e647a79dcec5bc5d1b21d744e7749e7cd91ff3ecc29765457d65476ad024be68d65535069697d39065268211c727f63b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
195KB

MD5
631a4d994ecb733dfbebf2021c19abfc

SHA1
27156af7582de0a6d78ad7afc5c86a3c0abfbdf0

SHA256
0eb446807d1ec12288e80539e6b42d81e822c10131ec6482a68a321f08e02a13

SHA512
7f06cae94524d79a0596dc8dc631792dfb8cb896e486e5af41e31782c356ee7e2b46084cad1a9b4212acab009abacfef18f4d7e94f55dc9e6da585293547d7b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
195KB

MD5
5b4345e5ec9cbbaa4a4a567294501195

SHA1
d425a34223fc372b352e148a10c99f54d90a9c26

SHA256
0b6f5f5e1b6d7a17655a3ec16f939480aa00d332eb5378f9f4e96212ea588776

SHA512
dc8083f2cf35f96b1a4ce9249d09292f36596941385240c05049059177ce1485bc7ce0b74f137a0c5e41bba34fe9a3245be658c7ea454663a183b056239d2691

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ABF.tmp\2AC0.tmp\2AC1.vbs

Filesize
588B

MD5
67706bca9ceaba11530e05d351487003

SHA1
3a5ed77f81b14093a5f18c4d46895bc7ea770fee

SHA256
190a0d994512ed000cf74bd40fb0502988c2ac48855b23a73fd905c0305fc30f

SHA512
902ac91678d85801a779acbc212c75beba72f8da996b0ed1b148a326c2dd635b88210f9a503fbbffa5271335483eae972e6a00acbc01ec013cf355c080444598

Download Submit
C:\Users\Admin\Downloads\No Escape.exe

Filesize
771KB

MD5
2782877418b44509fd306fd9afe43e39

SHA1
b0c18bdf782ca9c4fa41074f05458ce8e0f3961b

SHA256
56d612e014504c96bb92429c31eb93f40938015d422b35765912ac4e6bd3755b

SHA512
8826881b3ab406ee4c1fabd4848161f8524aeaeb7c4397384d36840f947ef95c8560850b2409fbf761ff225cdc8ac6eb875b705476fe9574b23c7a5478505a86

Download Submit
C:\Users\Admin\Downloads\No Escape.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads