Malware Analysis Report

2025-01-23 15:13

Sample ID 240824-c55qsashjj
Target UgPhone_install_1.1.27.exe
SHA256 5df4cc190fc6013894c7f00c9b4ca05757f6579f4bdd10e10c2ea007e87ebe3d
Tags
discovery antivm execution
score
5/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
5/10

SHA256

5df4cc190fc6013894c7f00c9b4ca05757f6579f4bdd10e10c2ea007e87ebe3d

Threat Level: Likely benign

The file UgPhone_install_1.1.27.exe was found to be: Likely benign.

Malicious Activity Summary

discovery antivm execution

Checks computer location settings

Enumerates processes with tasklist

Drops file in System32 directory

Checks CPU configuration

Executes dropped EXE

Loads dropped DLL

Reads CPU attributes

Checks installed software on the system

Browser Information Discovery

Enumerates kernel/hardware configuration

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Reads runtime system information

Command and Scripting Interpreter: JavaScript

Program crash

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Modifies system certificate store

Modifies data under HKEY_USERS

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-24 02:41

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:44

Platform

win10v2004-20240802-en

Max time kernel

133s

Max time network

144s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3200 wrote to memory of 1424 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3200 wrote to memory of 1424 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3200 wrote to memory of 1424 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:45

Platform

win10v2004-20240802-en

Max time kernel

132s

Max time network

135s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4780 wrote to memory of 3844 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4780 wrote to memory of 3844 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4780 wrote to memory of 3844 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3844 -ip 3844

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 636

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 52.111.227.13:443 tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:45

Platform

win10v2004-20240802-en

Max time kernel

134s

Max time network

126s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2324 wrote to memory of 4764 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2324 wrote to memory of 4764 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2324 wrote to memory of 4764 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4764 -ip 4764

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:45

Platform

win7-20240704-en

Max time kernel

42s

Max time network

156s

Command Line

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

Signatures

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2428 wrote to memory of 2108 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2108 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2108 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2840 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2872 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2872 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 2872 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 620 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 620 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 620 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 620 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 620 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 620 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 620 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 620 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 620 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 620 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 620 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 620 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 620 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 620 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 620 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 620 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 620 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 620 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2428 wrote to memory of 620 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fefb8a9758,0x7fefb8a9768,0x7fefb8a9778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1128 --field-trial-handle=1272,i,4542040171586774512,9979699685826158463,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1428 --field-trial-handle=1272,i,4542040171586774512,9979699685826158463,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1500 --field-trial-handle=1272,i,4542040171586774512,9979699685826158463,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2320 --field-trial-handle=1272,i,4542040171586774512,9979699685826158463,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2328 --field-trial-handle=1272,i,4542040171586774512,9979699685826158463,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1124 --field-trial-handle=1272,i,4542040171586774512,9979699685826158463,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3324 --field-trial-handle=1272,i,4542040171586774512,9979699685826158463,131072 /prefetch:8

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp

Files

\??\pipe\crashpad_2428_CERWYAJDCLJEXJGY

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

MD5 18e723571b00fb1694a3bad6c78e4054
SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 5d78ed8e96a15f7fba4ef03914c718bc
SHA1 7af41e3193046b47770e2f80e2c03bd8f29c2f0b
SHA256 caf4a1e36ac6d29912b173187d5c4eac95ae968cb1f5c9735b5a0b91b087b401
SHA512 163e788c4ca8fc4e5938609b9b487aee465d694db9bfcfb74fcd46ceb59fcdd8aa08592b8fe8eed848fc158afde8d9837b057d307cdc534c831c566adfdb13ee

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 a1dd5e96a888924aeb717a1e01596abd
SHA1 66f4d3db32df7edd8a8a1964ee74be8a34bc6ff3
SHA256 03a67b98f1dee8f33ac6d0f39321841ab023b5b92397c836a5324fbd66082731
SHA512 3a7d070afbecfec5bb1edfda82fe41e8aff3987d50982a046291e793dbfbef7fc6c85b0204eb382546891a49049f121d0fd669b1b94e8c49b0e8ff75ade69f18

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 937559384de51217b8887c9bd3ad3dd6
SHA1 ee2871c3938d5fbc970db9b2f7bf4ab0a1defd8f
SHA256 00e9613404dfc96322beb9cb1a05e21dbc9066d26e227b46f665f87f07f22fba
SHA512 b008b4e0365274c089f88e1011fd56e37e6db47faf82b5468438955f85ea7c0ddbdc4cb2141fd7b5d98dbee6bb4fb881a0ebc7c972fb57333f8902788c8b02d6

Analysis: behavioral12

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:45

Platform

win10v2004-20240802-en

Max time kernel

149s

Max time network

155s

Command Line

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

Signatures

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File created \??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133689409637622847" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1992 wrote to memory of 208 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 208 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 2072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 1204 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 1204 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1992 wrote to memory of 4596 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb5cb5cc40,0x7ffb5cb5cc4c,0x7ffb5cb5cc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,12189165558669747468,3298510156429041369,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1912 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2132,i,12189165558669747468,3298510156429041369,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2180 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2220,i,12189165558669747468,3298510156429041369,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2228 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3104,i,12189165558669747468,3298510156429041369,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3140 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3120,i,12189165558669747468,3298510156429041369,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3168 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4620,i,12189165558669747468,3298510156429041369,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4632 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4792,i,12189165558669747468,3298510156429041369,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=728 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 42.215.58.216.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp

Files

\??\pipe\crashpad_1992_BHCNJYEMBQDBEEFO

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 795671adcfecb75891d3a72926d4c74f
SHA1 3fa40619b4f8a083f86cf68c5466b95ca696dad5
SHA256 80fb1997d32a20b2b74c650d675701677eb51f02d75361b22aecf1d731751b40
SHA512 53b2b71b1ea46ae57f7aa5da51ea1a6b1da244109184ef6ab49a23e4ac52623d5feab58ce6e3723cff6bb6858fe65995b1c09abb53510b11a07fdcb5c94bcce8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 7c8e22ac3f7b936b66554505e24ce9c2
SHA1 f4c36c535ecee6431f41e5c2efc5ce46479101c6
SHA256 c79694a90d58b8a274a6182b142bdfe01c9ffa971b677b6ec1db8be1d68b0b7d
SHA512 1fc0a0b3fbb97a2ab9e3b37635b13fd841c69de54986d425ae4588abe1660768a6d28f65653c4d4e151a3afd278cc6d58ffe9aac45311ad6ff6b25b5893c8262

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ac77c043-0e5b-4dab-b491-0a231cdf0673.tmp

MD5 3f563346748f0206748ec38ea7389d06
SHA1 e7357d98fac3154c82e9237854e196875e52e280
SHA256 7a31488d983e61d2ad8e6378599cf7bb94218749f09d82ac362dedefe23c259b
SHA512 d00fe42958e316cd0c5e60d4f75c86c810b7ebd4ff78587d7bde6a664b7e060b83f5095c5787b46f7113ded127eb0a612abe41f10dae52ed65794ede99c43682

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 c5a1160ada9a45ae0774729b8c2c9da3
SHA1 191f6b6186c811840482bd8e054bff88e3761647
SHA256 ff72bf59ff2959e11096329ecd7004a7c564ff2ac228835f976b4093a665a937
SHA512 19a4985649447331cd64bbed3a526f3f2a4eb9698490084eceafe84e45a087e1b5bfc36402c06162840ad494594d637d7af908504ae9c3d557468606f8a0e0c1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 c61b133fa61299bd50d82c3e7a8d7769
SHA1 90fd914babf92d52f9732afa5bef1bb24d989e8b
SHA256 bdbd45c8a2e1a974965d8dcbfaf3c33584b4ebf7b4087a49d463b3355731bfa0
SHA512 19b81624996cf3edc3b27e727ab50dbea71f3899eed7bdc258bd3d5909ffabb29e6199deb977149a51b30284fa6ad8acc9cba5f26ad6d0e0421101f1aadd79f6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 6c1218b887ab11af304a55745a512e9c
SHA1 c58f36d3c720dfbf624a2d23c3ac2b5c847fab9b
SHA256 4231af83434e0ab141c0cadc611974dbefb45da2a8160821639ebe5294e07aea
SHA512 fe55023b42867fde9f595db96efdd7edb75c0ff664b9edd514bb6c6777292ec6cadd512f2056e215d1e246f64e49d250a622f7d676f259e2ad7812f512fb0acb

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 77e48898d40c02f9e08d0b564d4d080b
SHA1 4e2392f2e13ac75bc69dc4098cc3ec4c306cd8b2
SHA256 e765820a8a6cd42290be661a7aba513a11c718ad85597b99d794cc3a40a19ca9
SHA512 5c6cc52ebc622add858cfbc936094a7126405149faef2d1b5578c05dd4932958a50e2025b2db9501819c990a5f39b892e4288b1dff8a27ba5fff625a8a516360

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 8019ec05091849222736a70ff9f8be03
SHA1 0ce2d00dbf9391c6f20e3c31594cc0ef1d4ed065
SHA256 e039efae7977d966493e8ce437de673d051d99da63cca14a10635a9895cc8d67
SHA512 e919f6bfe82383339ce58ba6858ecb463e42a8f6dac41a3ebdda5e98f82b46779bbd82389fc4d44ab1514b2cf222ee83b6826f97188180b4eb5cc6e62aeed4c6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 1325981cf0cc62a25c2f603bcfc4f1b9
SHA1 b7d05392fceb53f21a989f2afeb3271c916d7850
SHA256 ccd2e19d06775c43f8c85faa22922ff90603d08e44b5e872ae3377e53c2fc4f2
SHA512 92bd43bfdba5dd9ac16846ceff4636217da0a35c488bf99fd814fa4b7a03b8238b0e55beb1a523010c01797d167dd972486c35199aa6098be727b42db64f4ed7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 d68cd691e29e47d64f3573425ac7d70c
SHA1 c35a8f381df74bb1df76a681866f80ce08494675
SHA256 3085d4e995e108322ad5c2952ce96873027fb1f8adaaabcc3747d8193f994917
SHA512 aefa2e093d9f9cc803922ab01071243eb9f5ec947a6a2fe9f3dc9f86f61562f8e7669c10fd01c011d456ef1ea5c98921b91b459ef984ddeb063b035893ce66d2

Analysis: behavioral18

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:45

Platform

win7-20240708-en

Max time kernel

120s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:45

Platform

win7-20240704-en

Max time kernel

121s

Max time network

155s

Command Line

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\bin\LICENSES.chromium.html

Signatures

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2888 wrote to memory of 2788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 484 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 484 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 484 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2700 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2700 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2700 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2700 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2700 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2700 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2700 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2700 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2700 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2700 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2700 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2700 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2700 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2700 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2700 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2700 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2700 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2700 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2888 wrote to memory of 2700 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\bin\LICENSES.chromium.html

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fefb8b9758,0x7fefb8b9768,0x7fefb8b9778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1196,i,800460391472383351,1545081585166268355,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1196,i,800460391472383351,1545081585166268355,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1196,i,800460391472383351,1545081585166268355,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2172 --field-trial-handle=1196,i,800460391472383351,1545081585166268355,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2180 --field-trial-handle=1196,i,800460391472383351,1545081585166268355,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1400 --field-trial-handle=1196,i,800460391472383351,1545081585166268355,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2956 --field-trial-handle=1196,i,800460391472383351,1545081585166268355,131072 /prefetch:8

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp

Files

\??\pipe\crashpad_2888_DARSCXDKFCGXRCUL

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

MD5 18e723571b00fb1694a3bad6c78e4054
SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 f6b432919be0383f9a6a58a579e706d5
SHA1 e04bd55615f42f88264a46f34ba7a8aa9d43d346
SHA256 ea52df566a05c1f90360674837c877e7b1a36ecbcafc00fcbc4b9e0b3014e908
SHA512 41b8f5b86a317bcc8189b8d27fc8899d5bc304d813ce750e08a39cc8000497994364b855f21402a275e4384e02a6ad5dd458e5ceadb8616c598f0d9a741031e8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 cc2c452a2581dbcd7f7072e1c5fcf922
SHA1 f47be3cc31d14812f52fe241560ebd18fd24787f
SHA256 cd93ed9dfb5af7cd84792be80f99007a391edf21fae14a8f5cb0ecdbe4a87f8c
SHA512 8913062235fdd3d625028a73c046dfbc86303a70ccf41a2a1b270db5e4819189cd22858b415da88858254896ddfb2bf57b37f15886c48154d7d6dccc1c6ff5e0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 b409a6baba31306a04f11a7cb20986ed
SHA1 17ca1be722974df74b25a22ed50e75a9f51f43ac
SHA256 98fba68936869d86e58295508a3ab4e4b65aaffba2813a87e1f3c47b35b70276
SHA512 9e5bd374f7125349f7224e3e1b4aca7f275c41041d92943a4c8a2a747903cdaf5818d64fcd6798242e311e3db1090f3a1ac15993e4da85dada203330fec9d2e5

Analysis: behavioral3

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:45

Platform

win7-20240705-en

Max time kernel

120s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2732 wrote to memory of 2768 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2732 wrote to memory of 2768 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2732 wrote to memory of 2768 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2732 wrote to memory of 2768 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2732 wrote to memory of 2768 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2732 wrote to memory of 2768 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2732 wrote to memory of 2768 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:45

Platform

debian9-mipsel-20240418-en

Max time kernel

0s

Command Line

[/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

Signatures

N/A

Processes

/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js

[/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/local/sbin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/local/bin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/sbin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/bin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/sbin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/bin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

Network

N/A

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:45

Platform

win7-20240704-en

Max time kernel

143s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.27.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Checks installed software on the system

discovery

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.27.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.27.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.27.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.27.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.27.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.27.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.27.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.27.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.27.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.27.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.27.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.27.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\find.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.27.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 560 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.27.exe C:\Windows\SysWOW64\cmd.exe
PID 560 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.27.exe C:\Windows\SysWOW64\cmd.exe
PID 560 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.27.exe C:\Windows\SysWOW64\cmd.exe
PID 560 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.27.exe C:\Windows\SysWOW64\cmd.exe
PID 2876 wrote to memory of 2788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2876 wrote to memory of 2788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2876 wrote to memory of 2788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2876 wrote to memory of 2788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2876 wrote to memory of 2756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2876 wrote to memory of 2756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2876 wrote to memory of 2756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2876 wrote to memory of 2756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 1172 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe

Processes

C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.27.exe

"C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.27.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq UgPhone.exe" | find "UgPhone.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq UgPhone.exe"

C:\Windows\SysWOW64\find.exe

find "UgPhone.exe"

C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe

"C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe"

C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe

"C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe" --type=gpu-process --field-trial-handle=1032,12605982138425823111,4491184370132210882,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1028 /prefetch:2

C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe

"C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1032,12605982138425823111,4491184370132210882,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=none --ignore-certificate-errors --ignore-certificate-errors --mojo-platform-channel-handle=1324 /prefetch:8

C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe

"C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe" --type=renderer --field-trial-handle=1032,12605982138425823111,4491184370132210882,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Programs\UgPhone1\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1452 /prefetch:1

C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe

"C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe" --type=gpu-process --field-trial-handle=1032,12605982138425823111,4491184370132210882,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1028 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 redirector.gvt1.com udp
FR 216.58.214.174:443 redirector.gvt1.com tcp
US 8.8.8.8:53 r3---sn-aigzrnse.gvt1.com udp
GB 74.125.168.200:443 r3---sn-aigzrnse.gvt1.com udp
GB 74.125.168.200:443 r3---sn-aigzrnse.gvt1.com tcp
US 8.8.8.8:53 www.ugphone.com udp
US 104.18.12.189:443 www.ugphone.com tcp
US 104.18.12.189:443 www.ugphone.com tcp

Files

\Users\Admin\AppData\Local\Temp\nso47AB.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

\Users\Admin\AppData\Local\Temp\nso47AB.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

\Users\Admin\AppData\Local\Temp\nso47AB.tmp\SpiderBanner.dll

MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

\Users\Admin\AppData\Local\Temp\nso47AB.tmp\nsExec.dll

MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

\Users\Admin\AppData\Local\Temp\nso47AB.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

\Users\Admin\AppData\Local\Temp\nso47AB.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

memory/560-233-0x00000000027E0000-0x00000000027E2000-memory.dmp

\Users\Admin\AppData\Local\Programs\UgPhone1\ffmpeg.dll

MD5 c42523771879bdd3f754fbcf2f5d787a
SHA1 55f9496131ba56a00526d92fce1c8b8d669b08c8
SHA256 ce52b08fffbaa142e6c7a376333991086ad5b37a5c1ed7cfcc8ff5c851b3d200
SHA512 ad980e459a86a8d7773cfd19b3b96ecc030a612463e534b2ba250cd15534ecbcea8af0038896dc65069fc66dfcd2b3a7df1471189f448267073a3bba2287116e

C:\Users\Admin\AppData\Local\Programs\UgPhone1\v8_context_snapshot.bin

MD5 8783eb563bab1d720f60f64d38f6ab69
SHA1 41c84e5f448969db07ce505aacad4fe574c9eb8e
SHA256 b53b12b15dbc62c6b1f7884ffacc97a261dfd12cbc5f447ffe270097847b418c
SHA512 f22ecdddf46a2c03f5b122f06a0a760e40b231df0b680b16a4555ec50be436e5921a77b4a15b67b0785aadbb39312fdd361c91f6ee9c47aaa7412b799a003fce

C:\Users\Admin\AppData\Local\Programs\UgPhone1\icudtl.dat

MD5 80a7528515595d8b0bf99a477a7eff0d
SHA1 fde9a195fc5a6a23ec82b8594f958cfcf3159437
SHA256 6e0b6b0d9e14c905f2278dbf25b7bb58cc0622b7680e3b6ff617a1d42348736b
SHA512 c8df47a00f7b2472d272a26b3600b7e82be7ca22526d6453901ff06370b3abb66328655868db9d4e0a11dcba02e3788cc4883261fd9a7d3e521577dde1b88459

C:\Users\Admin\AppData\Local\Programs\UgPhone1\chrome_200_percent.pak

MD5 7d4f330a5443eadf32e041c63e7e70ad
SHA1 26ce6fb98c0f28f508d7b88cf94a442b81e80c88
SHA256 b8704be578e7396ee3f2188d0c87d0ede5c5702e9bb8c841b5f8d458abf1356d
SHA512 f1b9b0dd7396863aa0feca06175b7f9ea0be4122351ecf0a0549ee4c34f85ac8c63cc927d7409a40b6e19fa91d2cb00a145616ba19f47045b2345bfbc2d4802d

C:\Users\Admin\AppData\Local\Programs\UgPhone1\locales\en-US.pak

MD5 af5c77e1d94dc4f772cb641bd310bc87
SHA1 0ceeb456e2601e22d873250bcc713bab573f2247
SHA256 781ef5aa8dce072a3e7732f39a7e991c497c70bfaec2264369d0d790ab7660a4
SHA512 8c3217b7d9b529d00785c7a1b2417a3297c234dec8383709c89c7ff9296f8ed4e9e6184e4304838edc5b4da9c9c3fe329b792c462e48b7175250ea3ea3acc70c

C:\Users\Admin\AppData\Local\Programs\UgPhone1\chrome_100_percent.pak

MD5 03aaa4f8525ba4b3e30d2a02cb40ab7a
SHA1 dd9ae5f8b56d317c71d0a0a738f5d4a320a02085
SHA256 c3f131faeefab4f506bf61c4b7752a6481f320429731d758ef5413a2f71441f7
SHA512 c89a1b89b669602ba7c8bf2c004755cac7320189603fecb4f4c5cf7a36db72da651c7b613607146f0c6da9eec5df412c7fba75475352192351c02aebdaa7d9a9

C:\Users\Admin\AppData\Local\Programs\UgPhone1\resources.pak

MD5 1f95be6a00b153fd2ba5b149c21e3c25
SHA1 d955b861c86e1d3de73024b3383aa11264c87ba4
SHA256 f4ea4113a0da76d70f72bbef82374c4eb7e63936e3f6931cc56b27a7300f9715
SHA512 9bc4ee4344bcbcfca1f6e84606fd730b21e58adbdceb1e47ba23931ff59abdff67db368c912f63c51823a864b91e53699469d52ad9ad33301050d369e79d215e

memory/1636-251-0x0000000000060000-0x0000000000061000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\918e5723-5e59-496e-acb4-a579c27ad604.tmp.ico

MD5 95869702267b1748d648dc6cb57bcf3c
SHA1 89804bd5f6a8b38863e552d0844e21a6fae30b56
SHA256 6c9331e79dabb563d694eaed56450f5b095bf71297d2f5f957b15f2fa729c02d
SHA512 387b9ca64d80a3abacc0c329f9fc5bd071b6479d880e273e6f7fddbc48186c7227ed6285dc0ebce17f8e7d7b7f3933bffe62462a95676e6b8af0578d7814ab1f

\Users\Admin\AppData\Local\Programs\UgPhone1\d3dcompiler_47.dll

MD5 7641e39b7da4077084d2afe7c31032e0
SHA1 2256644f69435ff2fee76deb04d918083960d1eb
SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5

memory/1636-293-0x0000000077A40000-0x0000000077A41000-memory.dmp

\Users\Admin\AppData\Local\Programs\UgPhone1\libEGL.dll

MD5 f3c8fea015b42bac6bdc0ddd3eb0b313
SHA1 176d3bfd15d22835e6bdecb7c39f13e4a29676a4
SHA256 b2d3d398331aee75646b12d94a1a1d383babce09c3c6a3303dd226944c8883d1
SHA512 30072eafd2c3f4a905c40d29cc755b6f50a9357d934f327c0479b15987736699bf443280fc0f6838ad147e2f23c1fbb123e2055756fce7402fdbd11b32a1f7bd

\Users\Admin\AppData\Local\Programs\UgPhone1\libGLESv2.dll

MD5 7969ee5f940eb49840749fbbd4358c44
SHA1 12d827c416ad82f5f622e67683f2f7df65e809e4
SHA256 d8e62dd81dab676139e9e8d7a3ec32bfb07fd5ea66a3ac510c70b5d5d98033b4
SHA512 e0a398d7c7aa44fb01fe39ced317e4706806d3b45fbfa127491e27843efa0093870ea9d82874aec3a9896a6400ce8f40902376069cfa1ee9b130e74d90124395

\Users\Admin\AppData\Local\Programs\UgPhone1\swiftshader\libGLESv2.dll

MD5 fc99fc1d991f1404ca20cc8178b86486
SHA1 15f67bc1d25a0af8ae24dcdf542dbcbfc3b67317
SHA256 7ad5bc738ebc7b58afc31dde170157fb9d0eb40819b12c08e1190669da998310
SHA512 48c1f78d0d002a07bdc76c8d88f8ee76200999d3cdfeba88de49314094da233d5ea9373cd23909189aed29f512d6f322d8c62ef470cfe4a6362310f56019d1e4

\Users\Admin\AppData\Local\Programs\UgPhone1\swiftshader\libEGL.dll

MD5 58124da1da5854be80f519f563cdb331
SHA1 353fa846229bc2c2f3479d774d84aebb66ef3eb7
SHA256 a03a044ea9775d372c4fe7fd82e64ab18e052bcdbc9381c2030ca475bc2ef1d1
SHA512 7f1af1e2237f6fe1eca1c4de4f3319979a6526c1938aadd48d7ee55834b7479de152868288f32084fb3004d3a420affca51091e83bcb4c4840a727664b69ee23

C:\Users\Admin\AppData\Roaming\UgPhone1\Session Storage\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Analysis: behavioral16

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:45

Platform

win7-20240708-en

Max time kernel

117s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:45

Platform

win7-20240705-en

Max time kernel

13s

Max time network

18s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2508 wrote to memory of 988 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2508 wrote to memory of 988 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2508 wrote to memory of 988 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2508 -s 88

Network

N/A

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:45

Platform

win10v2004-20240802-en

Max time kernel

149s

Max time network

154s

Command Line

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\bin\LICENSES.chromium.html

Signatures

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File created \??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133689409526757371" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3720 wrote to memory of 2404 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2404 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 3320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 1356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 1356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3720 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\bin\LICENSES.chromium.html

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffaccd6cc40,0x7ffaccd6cc4c,0x7ffaccd6cc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1656,i,10706109158304228815,3961869243005615536,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1752 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2136,i,10706109158304228815,3961869243005615536,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2196 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2224,i,10706109158304228815,3961869243005615536,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2408 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,10706109158304228815,3961869243005615536,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3164 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,10706109158304228815,3961869243005615536,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3204 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4572,i,10706109158304228815,3961869243005615536,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4588 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4712,i,10706109158304228815,3961869243005615536,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4916 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 106.179.250.142.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 147.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp

Files

\??\pipe\crashpad_3720_LQWNUZXGXHKVJMED

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 a1fa44e8b27092982ec01bc17f129656
SHA1 7c00c120eaa5cddc4484fff119574030f3de421d
SHA256 cbe6a67df5292cdb4546f9b3469ca94f9ca8b9d80451d7b1d6790a98c7cdfdfb
SHA512 c02a2b56086932fa32a870859dcb043e4e397a6dbfe051f25eb1ac200b9c014b4abede9b00a79260a08cba87dd62b95caea99f25abe792be9add7ab47b448f78

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 e7e709e158cf20723c347ccdd4848fcb
SHA1 140345f956260e888cb307262e60e2302e5a1501
SHA256 d45c21f0c66aa68b67e075bfaa525d618a2ddf6dcf5e70ea7f5935c9174b636f
SHA512 1d2ffeff02c7ef70ec0825c42cc683455771094896cabf055a63e7e7276050d339543b3501e87fc8ce0468349390a68bb1de23542aed1e4a6be7c45d93f64ed4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 3755aea6cb63d32cc2510b8ae9298243
SHA1 bcb6867399ea7c54abbab5cc3950c60a13a7098a
SHA256 c2ab6e397cf1eb4680b98af9719bcf9631239211394d4be5c920b8dba660c8d8
SHA512 4f550a58e7376b994c973bff2aeff046d296b5b476694d91fe335ecbbea79b07f2321bc6bbce920a6be086ae82039e9d74b552de76c780f5962c179c6e5df8bd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 d49a05d99a0d6f5116fccdf95d064280
SHA1 11987aae9e927dfe23e435c54a8798f95cf1ac76
SHA256 5b9a17150250f831f6a66c37ee53066c74c2ca0e00adc62deb14be8b31315831
SHA512 3a2c1432816914453da486f2de0384b4ad30eb6259cd8e47f93d594cc093a4cce3b7bc618f9d791e9e301338b99b92a500c6c8837dcb27973d10bbc10ef0bc3d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 97f8f9e9f783d647ed5d5533cdf73435
SHA1 9d6ee0e00dec647df8f11e6b104b4fce1cb7b00c
SHA256 0c85edcc22f2a562b0886a69a25275dabba1aa8c81769434e005758a539428ed
SHA512 1e7a021711e813aec5d089aba52f87ea706daa751aaafc2a24633aaa2a5d97cc045859ce8b748e504de6aa4340b0896b0f516755a57de0363e325089d4560168

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 e9d30fe34e37123e1dfc237db35677b9
SHA1 d265d69111785268bf23d75b3a1fe122515a710a
SHA256 64577d7f34b6e2068148f30f2119a6567a70f68dd1e65e494031e7c349f4e661
SHA512 eec4cb49bde7fe86036a4621b55728e2fac36c1be567ed71de4ceec345740dbd3979b0dbf2ac93abdcf72f2a3408cee6f89028f2c0002f446303bc2fed44f25d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 fc5937075a44a2331481aca6ff1b4ebd
SHA1 bb11804eac4ec2eeb53d3badb963b18ee011d62a
SHA256 0891e2ef844e279907b664f93015ef87a9f770b000429975908ba97d3c37d58e
SHA512 0c622022c0c45c5d994de7dcd5358ffea2ca7633c825e6a31cb2040c9317c00d30d0170a9e1164964e7a095c8c3edd4aab298e807761faf8f4af10dfbf95e145

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 b52acac8104c69abddd943cff3fa8af0
SHA1 7ae5fb6c07e30557b2e8aa67f4eb5d7e2b2f2ef1
SHA256 d36594b59939d5cc72298a33ab11aba0fdd395cbe2d13ded4a9aa43781207e64
SHA512 f2c6a13de13f1638abf5cd68c749918d78c18a0015ffcc718fc71443bb5f5a63a871f2d3c638c11ad8b06c99031c3b8ca2f9f7481da5fdc8f224e80892ddc073

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 781fb602862aec459350a1caee420691
SHA1 b8bb53b129079f3b078c59ebd04d470680c48fb0
SHA256 d4b8b4de565a2e185b092c908fcaa3b9d83f6cfabbf2f1675092e7e11df25a85
SHA512 ad0a9489a15f25568255e310a27702d57b181e936dabf0e5b7be745041056e18c7181945c4543546269821a765c20d5c3d4f867ebddf8d493d72046c0347f5c4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 0c2c564a4caa6d928c9acc39d97fd578
SHA1 fe088fcc0fdd98055899f09d837ff95319f38688
SHA256 338d2969dce7557606f3ce7197f42bfbac5599912cc5725db69ffc3b970bd53e
SHA512 3b7308e48eabbe0b1c7ae479fc10e4a94fe59a387ca14d6dc44b343e1e9bac07f889fac0f0d91f011e41c92e84dcfca5a61603abe28249244254c144462db4af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 f3f4fb8b28040ac19aac3b5e47c7544c
SHA1 aa40bb435da4f3e3ab33cca07d63492ce75f1eb6
SHA256 3aebf359e6276dd99531a5a25dbb04fb375152d2cd5e6b49407bccf91f3db1d6
SHA512 c76e7eb15c93b0f8962094ba6dc1e86746002c0d41213224fc8d4b0b8f3be6b48602380f31ff322d5800d2d0174da658dac721d0fe6fb9a4a73aed1602ad587c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 8e9d0231e4004d8044c339cb4b46618e
SHA1 e7f14e5c1eb03338203a7e2e78296c08c51a0e5a
SHA256 239c9de8fd99e43272b9123f9603ca3db93a672fff023e0ada0f5c0811893b2c
SHA512 2dba5e62168451076bf67559d7dbe385a5f158720ffc1bcafc7faf8717ae65f23ccf295fdbb7ddf776209c8e4b79b3e6b36df04a2dc196668296cb7478643d4c

Analysis: behavioral27

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:45

Platform

win10v2004-20240802-en

Max time kernel

137s

Max time network

144s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\bin\ffmpeg.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\bin\ffmpeg.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 147.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:44

Platform

win10v2004-20240802-en

Max time kernel

129s

Max time network

135s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2416 wrote to memory of 3720 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2416 wrote to memory of 3720 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2416 wrote to memory of 3720 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3720 -ip 3720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:45

Platform

win10v2004-20240802-en

Max time kernel

149s

Max time network

156s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:45

Platform

win7-20240729-en

Max time kernel

119s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\bin\chromedriver.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\bin\chromedriver.exe

"C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\bin\chromedriver.exe"

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:45

Platform

win10v2004-20240802-en

Max time kernel

148s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.27.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.27.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\find.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.27.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4668 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.27.exe C:\Windows\SysWOW64\cmd.exe
PID 4668 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.27.exe C:\Windows\SysWOW64\cmd.exe
PID 4668 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.27.exe C:\Windows\SysWOW64\cmd.exe
PID 2684 wrote to memory of 4408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2684 wrote to memory of 4408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2684 wrote to memory of 4408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2684 wrote to memory of 4068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2684 wrote to memory of 4068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2684 wrote to memory of 4068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 4960 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe

Processes

C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.27.exe

"C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.27.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq UgPhone.exe" | find "UgPhone.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq UgPhone.exe"

C:\Windows\SysWOW64\find.exe

find "UgPhone.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3956,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=1040 /prefetch:8

C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe

"C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe"

C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe

"C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe" --type=gpu-process --field-trial-handle=1608,491657090296321485,7353992137648640149,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1288 /prefetch:2

C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe

"C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1608,491657090296321485,7353992137648640149,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=none --ignore-certificate-errors --ignore-certificate-errors --mojo-platform-channel-handle=2148 /prefetch:8

C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe

"C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe" --type=renderer --field-trial-handle=1608,491657090296321485,7353992137648640149,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Programs\UgPhone1\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2232 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe

"C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe" --type=gpu-process --field-trial-handle=1608,491657090296321485,7353992137648640149,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2676 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 www.ugphone.com udp
US 104.18.13.189:443 www.ugphone.com tcp
US 104.18.13.189:443 www.ugphone.com tcp
US 8.8.8.8:53 189.13.18.104.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 201.64.52.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nslFE60.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

C:\Users\Admin\AppData\Local\Temp\nslFE60.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

C:\Users\Admin\AppData\Local\Temp\nslFE60.tmp\SpiderBanner.dll

MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

C:\Users\Admin\AppData\Local\Temp\nslFE60.tmp\nsExec.dll

MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

C:\Users\Admin\AppData\Local\Temp\nslFE60.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

C:\Users\Admin\AppData\Local\Temp\nslFE60.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

C:\Users\Admin\AppData\Local\Programs\UgPhone1\ffmpeg.dll

MD5 c42523771879bdd3f754fbcf2f5d787a
SHA1 55f9496131ba56a00526d92fce1c8b8d669b08c8
SHA256 ce52b08fffbaa142e6c7a376333991086ad5b37a5c1ed7cfcc8ff5c851b3d200
SHA512 ad980e459a86a8d7773cfd19b3b96ecc030a612463e534b2ba250cd15534ecbcea8af0038896dc65069fc66dfcd2b3a7df1471189f448267073a3bba2287116e

C:\Users\Admin\AppData\Local\Programs\UgPhone1\v8_context_snapshot.bin

MD5 8783eb563bab1d720f60f64d38f6ab69
SHA1 41c84e5f448969db07ce505aacad4fe574c9eb8e
SHA256 b53b12b15dbc62c6b1f7884ffacc97a261dfd12cbc5f447ffe270097847b418c
SHA512 f22ecdddf46a2c03f5b122f06a0a760e40b231df0b680b16a4555ec50be436e5921a77b4a15b67b0785aadbb39312fdd361c91f6ee9c47aaa7412b799a003fce

C:\Users\Admin\AppData\Local\Programs\UgPhone1\icudtl.dat

MD5 80a7528515595d8b0bf99a477a7eff0d
SHA1 fde9a195fc5a6a23ec82b8594f958cfcf3159437
SHA256 6e0b6b0d9e14c905f2278dbf25b7bb58cc0622b7680e3b6ff617a1d42348736b
SHA512 c8df47a00f7b2472d272a26b3600b7e82be7ca22526d6453901ff06370b3abb66328655868db9d4e0a11dcba02e3788cc4883261fd9a7d3e521577dde1b88459

C:\Users\Admin\AppData\Local\Programs\UgPhone1\chrome_200_percent.pak

MD5 7d4f330a5443eadf32e041c63e7e70ad
SHA1 26ce6fb98c0f28f508d7b88cf94a442b81e80c88
SHA256 b8704be578e7396ee3f2188d0c87d0ede5c5702e9bb8c841b5f8d458abf1356d
SHA512 f1b9b0dd7396863aa0feca06175b7f9ea0be4122351ecf0a0549ee4c34f85ac8c63cc927d7409a40b6e19fa91d2cb00a145616ba19f47045b2345bfbc2d4802d

C:\Users\Admin\AppData\Local\Programs\UgPhone1\chrome_100_percent.pak

MD5 03aaa4f8525ba4b3e30d2a02cb40ab7a
SHA1 dd9ae5f8b56d317c71d0a0a738f5d4a320a02085
SHA256 c3f131faeefab4f506bf61c4b7752a6481f320429731d758ef5413a2f71441f7
SHA512 c89a1b89b669602ba7c8bf2c004755cac7320189603fecb4f4c5cf7a36db72da651c7b613607146f0c6da9eec5df412c7fba75475352192351c02aebdaa7d9a9

C:\Users\Admin\AppData\Local\Programs\UgPhone1\resources.pak

MD5 1f95be6a00b153fd2ba5b149c21e3c25
SHA1 d955b861c86e1d3de73024b3383aa11264c87ba4
SHA256 f4ea4113a0da76d70f72bbef82374c4eb7e63936e3f6931cc56b27a7300f9715
SHA512 9bc4ee4344bcbcfca1f6e84606fd730b21e58adbdceb1e47ba23931ff59abdff67db368c912f63c51823a864b91e53699469d52ad9ad33301050d369e79d215e

C:\Users\Admin\AppData\Local\Programs\UgPhone1\locales\en-US.pak

MD5 af5c77e1d94dc4f772cb641bd310bc87
SHA1 0ceeb456e2601e22d873250bcc713bab573f2247
SHA256 781ef5aa8dce072a3e7732f39a7e991c497c70bfaec2264369d0d790ab7660a4
SHA512 8c3217b7d9b529d00785c7a1b2417a3297c234dec8383709c89c7ff9296f8ed4e9e6184e4304838edc5b4da9c9c3fe329b792c462e48b7175250ea3ea3acc70c

C:\Users\Admin\AppData\Local\Temp\2211698e-564b-45e3-addd-3123cdbaee11.tmp.ico

MD5 95869702267b1748d648dc6cb57bcf3c
SHA1 89804bd5f6a8b38863e552d0844e21a6fae30b56
SHA256 6c9331e79dabb563d694eaed56450f5b095bf71297d2f5f957b15f2fa729c02d
SHA512 387b9ca64d80a3abacc0c329f9fc5bd071b6479d880e273e6f7fddbc48186c7227ed6285dc0ebce17f8e7d7b7f3933bffe62462a95676e6b8af0578d7814ab1f

memory/2832-236-0x00007FFC92560000-0x00007FFC92561000-memory.dmp

C:\Users\Admin\AppData\Local\Programs\UgPhone1\libEGL.dll

MD5 f3c8fea015b42bac6bdc0ddd3eb0b313
SHA1 176d3bfd15d22835e6bdecb7c39f13e4a29676a4
SHA256 b2d3d398331aee75646b12d94a1a1d383babce09c3c6a3303dd226944c8883d1
SHA512 30072eafd2c3f4a905c40d29cc755b6f50a9357d934f327c0479b15987736699bf443280fc0f6838ad147e2f23c1fbb123e2055756fce7402fdbd11b32a1f7bd

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Local\Programs\UgPhone1\libGLESv2.dll

MD5 7969ee5f940eb49840749fbbd4358c44
SHA1 12d827c416ad82f5f622e67683f2f7df65e809e4
SHA256 d8e62dd81dab676139e9e8d7a3ec32bfb07fd5ea66a3ac510c70b5d5d98033b4
SHA512 e0a398d7c7aa44fb01fe39ced317e4706806d3b45fbfa127491e27843efa0093870ea9d82874aec3a9896a6400ce8f40902376069cfa1ee9b130e74d90124395

C:\Users\Admin\AppData\Local\Programs\UgPhone1\d3dcompiler_47.dll

MD5 7641e39b7da4077084d2afe7c31032e0
SHA1 2256644f69435ff2fee76deb04d918083960d1eb
SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5

C:\Users\Admin\AppData\Roaming\UgPhone1\Session Storage\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

memory/2832-319-0x000001E5F7370000-0x000001E5F749A000-memory.dmp

memory/2832-325-0x000001E5F7370000-0x000001E5F749A000-memory.dmp

memory/2832-328-0x000001E5F7370000-0x000001E5F749A000-memory.dmp

memory/2832-329-0x000001E5F7370000-0x000001E5F749A000-memory.dmp

C:\Users\Admin\AppData\Roaming\UgPhone1\Network Persistent State

MD5 55c27488a6cb0b3d088f2cd1b1fc6619
SHA1 fba84859e385865e7c16f16d66de31852338ca96
SHA256 d4687fb74330e49a39c70ec2483c7729c2b3b07488b9b416290c1b88e77acf3e
SHA512 35da27b00123fb942cf86566de4997bf31f8876f60d5baa27b501f3f2ae47426c3cab7aec88a51fa796bafafef9ea099024e4e79a387a544b52edade085cef73

C:\Users\Admin\AppData\Roaming\UgPhone1\Network Persistent State~RFe6436df.TMP

MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

memory/2832-348-0x000001E5F7370000-0x000001E5F749A000-memory.dmp

Analysis: behavioral19

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:45

Platform

win10v2004-20240802-en

Max time kernel

137s

Max time network

144s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 192.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:45

Platform

ubuntu1804-amd64-20240729-en

Max time kernel

0s

Max time network

129s

Command Line

[/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

Signatures

Enumerates kernel/hardware configuration

Description Indicator Process Target
File opened for reading /sys/fs/cgroup/memory/memory.limit_in_bytes /usr/bin/node N/A

Reads runtime system information

Description Indicator Process Target
File opened for reading /proc/meminfo /usr/bin/node N/A

Processes

/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js

[/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/local/sbin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/local/bin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/sbin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/bin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/bin/chromedriver

[/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/bin/chromedriver]

Network

Country Destination Domain Proto
GB 185.125.188.62:443 tcp
GB 185.125.188.62:443 tcp
US 151.101.193.91:443 tcp
US 151.101.193.91:443 tcp
GB 89.187.167.38:443 tcp
N/A 224.0.0.251:5353 udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:45

Platform

win7-20240705-en

Max time kernel

121s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 220

Network

N/A

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:45

Platform

win7-20240704-en

Max time kernel

145s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\UgPhone.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\UgPhone.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\UgPhone.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 C:\Users\Admin\AppData\Local\Temp\UgPhone.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde C:\Users\Admin\AppData\Local\Temp\UgPhone.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2244 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe

Processes

C:\Users\Admin\AppData\Local\Temp\UgPhone.exe

"C:\Users\Admin\AppData\Local\Temp\UgPhone.exe"

C:\Users\Admin\AppData\Local\Temp\UgPhone.exe

"C:\Users\Admin\AppData\Local\Temp\UgPhone.exe" --type=gpu-process --field-trial-handle=1076,12063580709172806941,12476198140634726401,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1092 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\UgPhone.exe

"C:\Users\Admin\AppData\Local\Temp\UgPhone.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1076,12063580709172806941,12476198140634726401,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=none --ignore-certificate-errors --ignore-certificate-errors --mojo-platform-channel-handle=1252 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\UgPhone.exe

"C:\Users\Admin\AppData\Local\Temp\UgPhone.exe" --type=renderer --field-trial-handle=1076,12063580709172806941,12476198140634726401,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1280 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\UgPhone.exe

"C:\Users\Admin\AppData\Local\Temp\UgPhone.exe" --type=gpu-process --field-trial-handle=1076,12063580709172806941,12476198140634726401,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1092 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 redirector.gvt1.com udp
FR 216.58.214.174:443 redirector.gvt1.com tcp
US 8.8.8.8:53 r3---sn-aigzrnse.gvt1.com udp
GB 74.125.168.200:443 r3---sn-aigzrnse.gvt1.com udp
GB 74.125.168.200:443 r3---sn-aigzrnse.gvt1.com tcp
US 8.8.8.8:53 www.ugphone.com udp
US 104.18.12.189:443 www.ugphone.com tcp
US 104.18.12.189:443 www.ugphone.com tcp

Files

memory/1132-1-0x0000000000060000-0x0000000000061000-memory.dmp

memory/1132-37-0x0000000077D40000-0x0000000077D41000-memory.dmp

C:\Users\Admin\AppData\Roaming\UgPhone1\Session Storage\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Analysis: behavioral14

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:45

Platform

win10v2004-20240802-en

Max time kernel

148s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\UgPhone.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\UgPhone.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\UgPhone.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 3484 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 3484 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 1128 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe

Processes

C:\Users\Admin\AppData\Local\Temp\UgPhone.exe

"C:\Users\Admin\AppData\Local\Temp\UgPhone.exe"

C:\Users\Admin\AppData\Local\Temp\UgPhone.exe

"C:\Users\Admin\AppData\Local\Temp\UgPhone.exe" --type=gpu-process --field-trial-handle=1632,12615312533795244114,2831304294961506881,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1640 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\UgPhone.exe

"C:\Users\Admin\AppData\Local\Temp\UgPhone.exe" --type=renderer --field-trial-handle=1632,12615312533795244114,2831304294961506881,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2084 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\UgPhone.exe

"C:\Users\Admin\AppData\Local\Temp\UgPhone.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1632,12615312533795244114,2831304294961506881,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=none --ignore-certificate-errors --ignore-certificate-errors --mojo-platform-channel-handle=2200 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\UgPhone.exe

"C:\Users\Admin\AppData\Local\Temp\UgPhone.exe" --type=gpu-process --field-trial-handle=1632,12615312533795244114,2831304294961506881,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1120 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 www.ugphone.com udp
US 104.18.12.189:443 www.ugphone.com tcp
US 104.18.12.189:443 www.ugphone.com tcp
US 8.8.8.8:53 189.12.18.104.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 15.173.189.20.in-addr.arpa udp

Files

memory/4512-2-0x00007FF8BD0A0000-0x00007FF8BD0A1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Roaming\UgPhone1\Session Storage\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Roaming\UgPhone1\Network Persistent State

MD5 55c27488a6cb0b3d088f2cd1b1fc6619
SHA1 fba84859e385865e7c16f16d66de31852338ca96
SHA256 d4687fb74330e49a39c70ec2483c7729c2b3b07488b9b416290c1b88e77acf3e
SHA512 35da27b00123fb942cf86566de4997bf31f8876f60d5baa27b501f3f2ae47426c3cab7aec88a51fa796bafafef9ea099024e4e79a387a544b52edade085cef73

C:\Users\Admin\AppData\Roaming\UgPhone1\Network Persistent State~RFe58b198.TMP

MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Analysis: behavioral29

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:46

Platform

debian9-armhf-20240611-en

Max time kernel

2s

Command Line

[/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

Signatures

Checks CPU configuration

antivm
Description Indicator Process Target
File opened for reading /proc/cpuinfo /usr/bin/node N/A

Reads CPU attributes

Description Indicator Process Target
File opened for reading /sys/devices/system/cpu/online /usr/bin/node N/A

Enumerates kernel/hardware configuration

Description Indicator Process Target
File opened for reading /sys/fs/cgroup/memory/memory.limit_in_bytes /usr/bin/node N/A

Reads runtime system information

Description Indicator Process Target
File opened for reading /proc/meminfo /usr/bin/node N/A

Processes

/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js

[/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/local/sbin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/local/bin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/sbin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/bin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/bin/chromedriver

[/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/bin/chromedriver]

Network

N/A

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:45

Platform

win7-20240704-en

Max time kernel

120s

Max time network

125s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\download-chromedriver.js

Signatures

Command and Scripting Interpreter: JavaScript

execution

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\download-chromedriver.js

Network

N/A

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:45

Platform

win7-20240708-en

Max time kernel

117s

Max time network

119s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 220

Network

N/A

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:45

Platform

win10v2004-20240802-en

Max time kernel

144s

Max time network

155s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 214.143.182.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:44

Platform

win7-20240704-en

Max time kernel

121s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 220

Network

N/A

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:48

Platform

debian9-mipsbe-20240611-en

Max time kernel

1s

Command Line

[/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

Signatures

N/A

Processes

/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js

[/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/local/sbin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/local/bin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/sbin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/bin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/sbin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/bin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

Network

N/A

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:45

Platform

win10v2004-20240802-en

Max time kernel

134s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\bin\chromedriver.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\bin\chromedriver.exe

"C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\bin\chromedriver.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 192.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:45

Platform

win7-20240705-en

Max time kernel

120s

Max time network

126s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\bin\ffmpeg.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\bin\ffmpeg.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-08-24 02:40

Reported

2024-08-24 02:45

Platform

win10v2004-20240802-en

Max time kernel

142s

Max time network

154s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 192.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

N/A