Analysis
-
max time kernel
73s -
max time network
71s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 09:17
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.explainplaysettwisting.com
Resource
win10v2004-20240802-en
General
-
Target
https://www.explainplaysettwisting.com
Malware Config
Signatures
-
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files\Crashpad\metadata setup.exe File opened for modification C:\Program Files\Crashpad\settings.dat setup.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133690510617673898" chrome.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3944 msedge.exe 3944 msedge.exe 1932 msedge.exe 1932 msedge.exe 4652 identity_helper.exe 4652 identity_helper.exe 2560 chrome.exe 2560 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs
pid Process 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 1932 msedge.exe 2560 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe Token: SeShutdownPrivilege 2560 chrome.exe Token: SeCreatePagefilePrivilege 2560 chrome.exe -
Suspicious use of FindShellTrayWindow 51 IoCs
pid Process 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe 2560 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1932 wrote to memory of 1560 1932 msedge.exe 84 PID 1932 wrote to memory of 1560 1932 msedge.exe 84 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3560 1932 msedge.exe 85 PID 1932 wrote to memory of 3944 1932 msedge.exe 86 PID 1932 wrote to memory of 3944 1932 msedge.exe 86 PID 1932 wrote to memory of 2516 1932 msedge.exe 87 PID 1932 wrote to memory of 2516 1932 msedge.exe 87 PID 1932 wrote to memory of 2516 1932 msedge.exe 87 PID 1932 wrote to memory of 2516 1932 msedge.exe 87 PID 1932 wrote to memory of 2516 1932 msedge.exe 87 PID 1932 wrote to memory of 2516 1932 msedge.exe 87 PID 1932 wrote to memory of 2516 1932 msedge.exe 87 PID 1932 wrote to memory of 2516 1932 msedge.exe 87 PID 1932 wrote to memory of 2516 1932 msedge.exe 87 PID 1932 wrote to memory of 2516 1932 msedge.exe 87 PID 1932 wrote to memory of 2516 1932 msedge.exe 87 PID 1932 wrote to memory of 2516 1932 msedge.exe 87 PID 1932 wrote to memory of 2516 1932 msedge.exe 87 PID 1932 wrote to memory of 2516 1932 msedge.exe 87 PID 1932 wrote to memory of 2516 1932 msedge.exe 87 PID 1932 wrote to memory of 2516 1932 msedge.exe 87 PID 1932 wrote to memory of 2516 1932 msedge.exe 87 PID 1932 wrote to memory of 2516 1932 msedge.exe 87 PID 1932 wrote to memory of 2516 1932 msedge.exe 87 PID 1932 wrote to memory of 2516 1932 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.explainplaysettwisting.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd2e0146f8,0x7ffd2e014708,0x7ffd2e0147182⤵PID:1560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,6756603441158764945,4265888547957280854,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:3560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,6756603441158764945,4265888547957280854,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,6756603441158764945,4265888547957280854,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:82⤵PID:2516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6756603441158764945,4265888547957280854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:12⤵PID:3448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6756603441158764945,4265888547957280854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:12⤵PID:884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6756603441158764945,4265888547957280854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:12⤵PID:3692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6756603441158764945,4265888547957280854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:12⤵PID:3616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,6756603441158764945,4265888547957280854,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:82⤵PID:1776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,6756603441158764945,4265888547957280854,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6756603441158764945,4265888547957280854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:12⤵PID:1072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6756603441158764945,4265888547957280854,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:12⤵PID:1788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6756603441158764945,4265888547957280854,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:12⤵PID:1260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6756603441158764945,4265888547957280854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:12⤵PID:604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6756603441158764945,4265888547957280854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:12⤵PID:3088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,6756603441158764945,4265888547957280854,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5792 /prefetch:82⤵PID:372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6756603441158764945,4265888547957280854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2776 /prefetch:12⤵PID:4776
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3648
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:548
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2560 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd1dd5cc40,0x7ffd1dd5cc4c,0x7ffd1dd5cc582⤵PID:5096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1908,i,10367948047360881447,9676864683227223397,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1888 /prefetch:22⤵PID:5248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2076,i,10367948047360881447,9676864683227223397,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2064 /prefetch:32⤵PID:5264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2272,i,10367948047360881447,9676864683227223397,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2512 /prefetch:82⤵PID:5320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3164,i,10367948047360881447,9676864683227223397,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3184 /prefetch:12⤵PID:5472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3404,i,10367948047360881447,9676864683227223397,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3416 /prefetch:12⤵PID:5480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4580,i,10367948047360881447,9676864683227223397,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4572 /prefetch:12⤵PID:5704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4396,i,10367948047360881447,9676864683227223397,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4688 /prefetch:82⤵PID:5860
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level2⤵
- Drops file in Program Files directory
PID:5924 -
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x7ff723674698,0x7ff7236746a4,0x7ff7236746b03⤵
- Drops file in Program Files directory
PID:6000
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5072,i,10367948047360881447,9676864683227223397,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5068 /prefetch:82⤵PID:5992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4912,i,10367948047360881447,9676864683227223397,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5168 /prefetch:12⤵PID:6116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4724,i,10367948047360881447,9676864683227223397,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5292 /prefetch:12⤵PID:3840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3420,i,10367948047360881447,9676864683227223397,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:5808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5060,i,10367948047360881447,9676864683227223397,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5432 /prefetch:12⤵PID:5780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3212,i,10367948047360881447,9676864683227223397,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5436 /prefetch:12⤵PID:5720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5368,i,10367948047360881447,9676864683227223397,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4072 /prefetch:12⤵PID:5736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4640,i,10367948047360881447,9676864683227223397,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5244 /prefetch:12⤵PID:6076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=3560,i,10367948047360881447,9676864683227223397,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5280 /prefetch:12⤵PID:1712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5416,i,10367948047360881447,9676864683227223397,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4080 /prefetch:12⤵PID:5684
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:5612
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5932
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD584b5d4cc20c01b110a11ead4277b4036
SHA14a8813e34a8b32d4411f5780adc2cfc59ca2bc2c
SHA256406a41dbe5a406b52fc3064f53ecf63a34640288c3ffca704bd46697a862c133
SHA5121238a808fdef6342541c00591baa2d94b1cea97362239f83bebb454a793b334ca9fb90c87cf02a95c16ca72eb64a3617762665cd8f0175136495c163149aa772
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
356B
MD518310621c32c6f5a2f883168a6f4f83e
SHA199caaabe48baa49c5088b89ebe2ae8de78dd521f
SHA2565918646a916ba14e163e45dc17e889f76bb9d26f04859abbf4f34982249c3955
SHA512bebfd22c9cd126200043155d41a0fd337bb0f70538e8a320193531cb919d20853d505e89174c5a87d25d5b6653f5011d02175b44ef587adda528bfd434de9e1c
-
Filesize
356B
MD5341cd7b860de580514855e83d96457cf
SHA17464a3d913f0cdc04c1b6a62d849f448cb6bdb67
SHA2563694f4d0f5525ff869d9a83b99d9197ced703a495f9383605c136442f6e9f176
SHA512c4e579a38e901afc50d1c97e0c05798fedd7d2439f0fe6d081231d351fc591df36349e0e5f191bcb3b4f4105b406bde009c78b51c95caa76b659feaf058040ae
-
Filesize
9KB
MD5621639793006d5e8d130db258203bcd8
SHA1c8e56e2974b6ca339f578207bcb9c0a2c0fedff6
SHA256e5eaefeb245b21a5807d546e61ce1a3c820454fdc9d5fd4921fb55b04e6def00
SHA512d1e7590835f89f2157356ef3799b4a2a59cee1b25b1482406046bb9b4b8933f09750cbaeb47eec460fbd82f0399fee3e3015412a315656c60c84ef08f1da6e61
-
Filesize
9KB
MD547d363240c2c2dfe58432bb9d9dd7d72
SHA1b2ef67a8edff465690dc2a71059d739173bd5ad7
SHA256926af285d5e4e60f511e57eca2521ea73b558de6007882a07c8cbdcd227342ac
SHA51230c161d47094f2d887249e26c946d3e6e483dfe789fbaab5e360149c830cc2dc6eb002c6b5e0c1cbeed87acd13bc0b8aa1d3e78b50ad1e3e0576c6a258bc1c99
-
Filesize
9KB
MD5182121c8898c62cdca745fc2fabbaea3
SHA13cf6da3ce388d849d43a7e4ca87fa3c67e95f160
SHA2563f6d12675ca751ee7dd5591de8c946dea7c270c1d653857b9e665ed1cdf10253
SHA5122226090229e599e7069f5b9178eebb6e64959cec96b075bd58a8dca22418adf285891e6fbe2ef53b166c986dd679ab0e92e86810d0cff1d4e9d40ca238b9b882
-
Filesize
15KB
MD58f7db55f2ad9bf99123f5a78d422fba1
SHA13171df987cbd1d498418a7c04abe2f76a0e0243c
SHA256aaebb6ca5d845cb277c974a2a6f2b7e2b819ecfdbe8d0230e572a01d2236e2eb
SHA512838c48d056d498471c44fc203abaaf384c143e439d01eccd5b37e32428000614beff62ac0491ead4359b93a4fde96bf5c4d8e95a457a75e75ffc893a849a6d37
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ab510408-4258-4ec4-b2b2-e70fa3c7678c.tmp
Filesize9KB
MD5d2394d464d1d62934820564dcd1f5a1c
SHA160278c7972377b9af5f9f654530924a2cb97ec6f
SHA256dc4af0f18b5dc6c7e9a3435a362908cf413797223a64313a99b6bdbb0e5e6833
SHA512abab4a273dfc50eb444519b08a63262e77291c66286858f8d1277b0883e428f4ee2685818cb80e2b6c7b1ee4e6b9a72fcad83e319977983a6fad717f88a9ae30
-
Filesize
198KB
MD524d63d57905cb9e6c4a81c2bdeb22034
SHA19a38d2e6e456879694530655c4948e78c1c45842
SHA256db95510f8c787d00f44d9d2d732d69da1a6b4de7ca393446c7837269fc27e6b1
SHA5128a84f8c35ba2c8b45799e1f5e2591f9a185b47668ec40a3d58685c9986608b34f008e99af79b606800a91fe24a60d526e3f46d10e61df42ba1e744c9345c4ab6
-
Filesize
198KB
MD56e8b0806098d562c0410056a06e7f068
SHA1a25224792ea28b40e48958dca4eddc8789f2ebec
SHA256e4946d1c8d22ad29a40c5c71ac93f39850de705ac71b6bbbd4914cc6f45cc24c
SHA51268cdaaedff144ec7c2eaed6ab7f8d53f1377ecee96567b0c7f67767af0d23ab724c72c0867266454940126a05c9d4a972702d42b2ef0c78e554c34aad8b2e31e
-
Filesize
198KB
MD59d858280e7fa0f1ae96005998283b44b
SHA187ec7581d91d8312a1510ffc18b4d8e348ba83f0
SHA2569b6181e651be2057fcffdede5da1087b6e56c75904bbaba7ef2a094d5add6bd3
SHA5123caaf7b492b9bd5acff2e3abe54b955ae63a38ed25484a51d54cba32beda5ca515b5fcd37dc058d59e795cf643e44d998680d27fe4bf80421d34581bbf7e74ca
-
Filesize
152B
MD5eeaa8087eba2f63f31e599f6a7b46ef4
SHA1f639519deee0766a39cfe258d2ac48e3a9d5ac03
SHA25650fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
SHA512eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
-
Filesize
152B
MD5b9569e123772ae290f9bac07e0d31748
SHA15806ed9b301d4178a959b26d7b7ccf2c0abc6741
SHA25620ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
SHA512cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
-
Filesize
5KB
MD535e81455923334cda8b98d41e9fc393a
SHA121f93b3dd7bbe5c277701888a9cd97d5f5404028
SHA2560d897da44f03a0671e1a354b715154ac2d7e5e675b8b2087162577774644f1a2
SHA512322c1d9b6d68fa304373b5dc5bb0a6a5a614674db9b929e8429730783dbb43bb86c6c7bf5b35ca5d07d94567b585f1dfc67ad50eeef692fa0412e0142e2271c6
-
Filesize
6KB
MD5ea3a1e2745740ab2aa2c76572df2076a
SHA13a501a1e131cfedb762f33be9754451e10d0e354
SHA2562f652a248e23684e2be7c2d2f5f4ade31eeb082b7a8dea20da1c65ab0ca8a915
SHA512b74d5cbba56c1551d4984a68345bab202a9ae8dda61ad658e542759a62abdd6f238ce4a211bf2ca8caf9bc29534005f483c81839633bacacfc384ced9aa48a44
-
Filesize
6KB
MD5869f25b42ca94a5035c064eda6c7d006
SHA1c28582b1087b1d67935d3e6aabc3bb808f933555
SHA256baf73ce27e7503e79a719c0527383ed4c71db103152413aa51a3ad66beda3149
SHA5123efd07b77a4c75d6c617c92e0b485d47b168748bee0b777acffe9bb074db7234b74051cc9ab056feaa7cf735a92ceb52a881dd64a66b01c61fe8d4862e4d3525
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD509120fcd3defb5df3002b1d74619eee7
SHA10a7bdab9ea3e7442048a17a9b26e4795f8d78e8e
SHA256b47de6b406d3cdfecfc29669d24af616f913ca26a2634407aab792266ed18039
SHA512fcc5650d0337d903ef5e54b2c687dd6a23bbadfe67b247c4c905e20c2fe086657ca158a45f83d902c7a9389a731c7710a36620074c49bd913e7b2303a6aa7f82
-
Filesize
11KB
MD5bf3e69ac5afcdac66481816a65f580aa
SHA19911c2bd428b1ecba762d3659b89a88691ce8908
SHA256208aaab9d2133d26bf10b79edded8b802cabc967769156f4402239d7d919785e
SHA51254f2cba2020be1ed7ed485da2ccf8967b59bb5fe3e0830ba859d65e8c09f52bd65c2325ceeaa5408d7bb66dd39b0cbd79fe768b07ae607b5d7b32aa16ac7f881