Overview
overview
9Static
static
3CampPinecrest.exe
windows11-21h2-x64
9$PLUGINSDI...er.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3$PLUGINSDIR/app-64.7z
windows11-21h2-x64
3LICENSES.c...m.html
windows11-21h2-x64
5WorldWars.exe
windows11-21h2-x64
9d3dcompiler_47.dll
windows11-21h2-x64
1ffmpeg.dll
windows11-21h2-x64
1libEGL.dll
windows11-21h2-x64
1libGLESv2.dll
windows11-21h2-x64
1locales/af.ps1
windows11-21h2-x64
3locales/uk.ps1
windows11-21h2-x64
3resources/...nts.js
windows11-21h2-x64
3resources/...ent.js
windows11-21h2-x64
3resources/...ode.js
windows11-21h2-x64
3resources/...age.js
windows11-21h2-x64
3resources/...med.js
windows11-21h2-x64
3resources/...rse.js
windows11-21h2-x64
3resources/...ver.js
windows11-21h2-x64
3resources/...ver.js
windows11-21h2-x64
3resources/elevate.exe
windows11-21h2-x64
3vk_swiftshader.dll
windows11-21h2-x64
1vulkan-1.dll
windows11-21h2-x64
1$PLUGINSDI...ec.dll
windows11-21h2-x64
3$PLUGINSDI...7z.dll
windows11-21h2-x64
3$R0/Uninst...rs.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3$PLUGINSDI...ec.dll
windows11-21h2-x64
3Resubmissions
02/09/2024, 21:14
240902-z3rgpsxcnm 902/09/2024, 21:08
240902-zyvnkaxbqj 902/09/2024, 20:57
240902-zrx54sxapk 902/09/2024, 20:52
240902-znsffsxajm 9Analysis
-
max time kernel
300s -
max time network
298s -
platform
windows11-21h2_x64 -
resource
win11-20240802-fr -
resource tags
arch:x64arch:x86image:win11-20240802-frlocale:fr-fros:windows11-21h2-x64systemwindows -
submitted
02/09/2024, 20:57
Static task
static1
Behavioral task
behavioral1
Sample
CampPinecrest.exe
Resource
win11-20240802-fr
Behavioral task
behavioral2
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win11-20240802-fr
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20240802-fr
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240802-fr
Behavioral task
behavioral5
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20240802-fr
Behavioral task
behavioral6
Sample
$PLUGINSDIR/app-64.7z
Resource
win11-20240802-fr
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win11-20240802-fr
Behavioral task
behavioral8
Sample
WorldWars.exe
Resource
win11-20240802-fr
Behavioral task
behavioral9
Sample
d3dcompiler_47.dll
Resource
win11-20240802-fr
Behavioral task
behavioral10
Sample
ffmpeg.dll
Resource
win11-20240802-fr
Behavioral task
behavioral11
Sample
libEGL.dll
Resource
win11-20240802-fr
Behavioral task
behavioral12
Sample
libGLESv2.dll
Resource
win11-20240802-fr
Behavioral task
behavioral13
Sample
locales/af.ps1
Resource
win11-20240802-fr
Behavioral task
behavioral14
Sample
locales/uk.ps1
Resource
win11-20240802-fr
Behavioral task
behavioral15
Sample
resources/app.asar.unpacked/node_modules/hbo-dnsd/constants.js
Resource
win11-20240802-fr
Behavioral task
behavioral16
Sample
resources/app.asar.unpacked/node_modules/hbo-dnsd/convenient.js
Resource
win11-20240802-fr
Behavioral task
behavioral17
Sample
resources/app.asar.unpacked/node_modules/hbo-dnsd/encode.js
Resource
win11-20240802-fr
Behavioral task
behavioral18
Sample
resources/app.asar.unpacked/node_modules/hbo-dnsd/message.js
Resource
win11-20240802-fr
Behavioral task
behavioral19
Sample
resources/app.asar.unpacked/node_modules/hbo-dnsd/named.js
Resource
win11-20240802-fr
Behavioral task
behavioral20
Sample
resources/app.asar.unpacked/node_modules/hbo-dnsd/parse.js
Resource
win11-20240802-fr
Behavioral task
behavioral21
Sample
resources/app.asar.unpacked/node_modules/hbo-dnsd/server.js
Resource
win11-20240802-fr
Behavioral task
behavioral22
Sample
resources/app.asar.unpacked/node_modules/hbo-dnsd/util/null-server.js
Resource
win11-20240802-fr
Behavioral task
behavioral23
Sample
resources/elevate.exe
Resource
win11-20240802-fr
Behavioral task
behavioral24
Sample
vk_swiftshader.dll
Resource
win11-20240802-fr
Behavioral task
behavioral25
Sample
vulkan-1.dll
Resource
win11-20240802-fr
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20240802-fr
Behavioral task
behavioral27
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20240802-fr
Behavioral task
behavioral28
Sample
$R0/Uninstall WorldWars.exe
Resource
win11-20240802-fr
Behavioral task
behavioral29
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20240802-fr
Behavioral task
behavioral30
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240802-fr
Behavioral task
behavioral31
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20240802-fr
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20240802-fr
General
-
Target
LICENSES.chromium.html
-
Size
7.9MB
-
MD5
8303b3a19888f41062a614cd95b2e2d2
-
SHA1
a112ee5559c27b01e3114cf10050531cab3d98a6
-
SHA256
9c088caac76cf5be69e0397d76fe9397017585cffdba327692ff1b3a6c00d68f
-
SHA512
281b2ecc99502a050ee69e31256dec135e8cb877d1a6ba9f1c975fcfb11c062980ee6061d2368b62f91e392953ae6235dd726a9d98e6efc1302f7ed713099179
-
SSDEEP
24576:dbTq6T06T5kJWSIRWnBIl70mfT76y6E65606F/HXpErpem:t4scj
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_01cf530faf2f1752\display.PNF chrome.exe File created \??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_01cf530faf2f1752\display.PNF chrome.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133697844202435210" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 3732 chrome.exe 3732 chrome.exe 3732 chrome.exe 3732 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2796 chrome.exe 2796 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeCreatePagefilePrivilege 2796 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2796 wrote to memory of 3192 2796 chrome.exe 77 PID 2796 wrote to memory of 3192 2796 chrome.exe 77 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 4996 2796 chrome.exe 78 PID 2796 wrote to memory of 5092 2796 chrome.exe 79 PID 2796 wrote to memory of 5092 2796 chrome.exe 79 PID 2796 wrote to memory of 556 2796 chrome.exe 80 PID 2796 wrote to memory of 556 2796 chrome.exe 80 PID 2796 wrote to memory of 556 2796 chrome.exe 80 PID 2796 wrote to memory of 556 2796 chrome.exe 80 PID 2796 wrote to memory of 556 2796 chrome.exe 80 PID 2796 wrote to memory of 556 2796 chrome.exe 80 PID 2796 wrote to memory of 556 2796 chrome.exe 80 PID 2796 wrote to memory of 556 2796 chrome.exe 80 PID 2796 wrote to memory of 556 2796 chrome.exe 80 PID 2796 wrote to memory of 556 2796 chrome.exe 80 PID 2796 wrote to memory of 556 2796 chrome.exe 80 PID 2796 wrote to memory of 556 2796 chrome.exe 80 PID 2796 wrote to memory of 556 2796 chrome.exe 80 PID 2796 wrote to memory of 556 2796 chrome.exe 80 PID 2796 wrote to memory of 556 2796 chrome.exe 80 PID 2796 wrote to memory of 556 2796 chrome.exe 80 PID 2796 wrote to memory of 556 2796 chrome.exe 80 PID 2796 wrote to memory of 556 2796 chrome.exe 80 PID 2796 wrote to memory of 556 2796 chrome.exe 80 PID 2796 wrote to memory of 556 2796 chrome.exe 80 PID 2796 wrote to memory of 556 2796 chrome.exe 80 PID 2796 wrote to memory of 556 2796 chrome.exe 80 PID 2796 wrote to memory of 556 2796 chrome.exe 80 PID 2796 wrote to memory of 556 2796 chrome.exe 80 PID 2796 wrote to memory of 556 2796 chrome.exe 80 PID 2796 wrote to memory of 556 2796 chrome.exe 80 PID 2796 wrote to memory of 556 2796 chrome.exe 80 PID 2796 wrote to memory of 556 2796 chrome.exe 80 PID 2796 wrote to memory of 556 2796 chrome.exe 80 PID 2796 wrote to memory of 556 2796 chrome.exe 80
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x110,0x114,0x118,0xec,0x11c,0x7ffece76cc40,0x7ffece76cc4c,0x7ffece76cc582⤵PID:3192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1932,i,4739135566687478,10925236175506427616,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1928 /prefetch:22⤵PID:4996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1384,i,4739135566687478,10925236175506427616,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1968 /prefetch:32⤵PID:5092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2184,i,4739135566687478,10925236175506427616,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2200 /prefetch:82⤵PID:556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3068,i,4739135566687478,10925236175506427616,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3080 /prefetch:12⤵PID:904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3084,i,4739135566687478,10925236175506427616,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3128 /prefetch:12⤵PID:4052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4612,i,4739135566687478,10925236175506427616,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4636 /prefetch:82⤵PID:4220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=232,i,4739135566687478,10925236175506427616,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4664 /prefetch:82⤵PID:4160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4820,i,4739135566687478,10925236175506427616,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4796 /prefetch:82⤵PID:2064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4684,i,4739135566687478,10925236175506427616,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4632 /prefetch:82⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3732
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:1964
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2024
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5b5ad5caaaee00cb8cf445427975ae66c
SHA1dcde6527290a326e048f9c3a85280d3fa71e1e22
SHA256b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8
SHA51292f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f
-
Filesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
Filesize
1008B
MD5d222b77a61527f2c177b0869e7babc24
SHA13f23acb984307a4aeba41ebbb70439c97ad1f268
SHA25680dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747
SHA512d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1aad4c4a-efb0-4dea-9dcb-a1dad175dcfa.tmp
Filesize9KB
MD55ce09c792e525a4e625cfceaa25102ee
SHA19f29adcbce360d12f6d990d6e97e976c56ce2253
SHA2562fdc6406c8c773594131f2733ea65a8988f91667543db512e7ebdbfb1c82fcee
SHA51292dbedf42b2c08ca53624ac66c11666ba9dfaf48afc544d90965d3487aff8be1ff4cc6db3b4428b310e42ac0cfe7faf2dc4e923b1c84249333e7d358aa96f1be
-
Filesize
649B
MD53d57e5bb5ea083c08d90f0a93719b46e
SHA164800cd894cd4971485c397c555299a8af3b836c
SHA256f5f8d66cc5a2dab5e796b01b1ad2974209e68ba3265222b4ec51607f42c150c4
SHA512a05a5b06fa1de729b0ba95b2851ce5064af98de21f29318afbba53a2495a76387955757a35d8ba0fa3e5a4d32ee423a4481f8e4559841acdcc7bb6676e7c8c36
-
Filesize
962B
MD599fefaadd15b93320e39cbc1e0f5e0d3
SHA17c971260ed39d0094f40698992429ec1e5543f06
SHA2561f7df294f72e67735368246ee3cd268c9126a34e6361dc496b6e88ab5f562797
SHA512a9d45e8df2b36c35b0954abd51691dba37076faa3bf5e0d8ae0451bd687acd672a2290644a3aac18a843a3b59bc33e7dc35f28db79a4aa29b90df892124d3394
-
Filesize
1KB
MD5bf9baccc83f3b9493a51f7c930c83212
SHA1ce9d50833c63d72bfd7906501098350e54f56088
SHA25606c77c3fb1ae9a1fa40cfed9d9d206e252d82893c702399db04d549bf4d93652
SHA512619673a9bd53782f692a0888522268af99d96a6aff89297a4c17bd97512d12838563b417eb3f68b1ca7102e7952a1ee00915eca1cb14a630a02b19aa9c46da26
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
9KB
MD5528d657cdbcffb242570c100d85aaa9f
SHA10c94102c24321140b05bf548a3a2fc960e9e2efa
SHA25683051057531d12dcfbd5cb8fe4f0789d3806c4f4c44b66966ec180fbbb8d7bfd
SHA512a715f624842b919f0627cffb2b95255b340405546d7f2c5fcd5762fc5b72734f4e935734b74841a73304ef9af91ab7255414d0ddc6f1686e6c6dead585e35ac5
-
Filesize
9KB
MD5f29ed787e46de17271734e618b4e676a
SHA1d6cc9ee78cfe56672ae2d3e6355b77c358dd5d4b
SHA2567893935d6266005dcc73990ba083881ae94f7394daccc7948866f01618ad335e
SHA512acd78d49b9ece145174cea7d881144e07b7f8990ade70aa8f4e379f2c3669215093813af218e60793018d1dffbc994293d7ffbff33fc3256f2077740b0ee0b99
-
Filesize
9KB
MD5eb1cca3fa914d6bbecdd221ede9e8ff8
SHA11ec3973a90188919b824d476c6e05dda6608e10f
SHA256343cba8a07c97cf163bcd4b7d2e958ea02d1bfdf08715cd1eaf5ed5f35fd2920
SHA512594048781c017c4e1f50768aa9a00d35371afca493eca3aa0f37c711341c56468833bf4bb1f3d19863b4fe53e287f5983618621c84a239d23d5eb1bee8c49b9d
-
Filesize
9KB
MD577b7af3c3fe673c3895169ab4e3e62eb
SHA19e45a75165244bc98a74dfb3354b096a5bdbf79b
SHA256cd5d1885e854802d7e3d091eb616b30f489daf0098a7f91fc61f196d9e6ad77e
SHA512b30c70fbece810fc42642c2b0ddc63378977c8ffdac71b793004c8ed33811d800b7f5d87ab086d88dec9373669cea3f8dc8b84ab207d85c97a559367ee719a3c
-
Filesize
9KB
MD5cdb6b79e62fa6f4e4a72cff2a27ed8a9
SHA1cdd1b7ce49a89b20433dd7b91b4eced956558e32
SHA256edec002bb25e7774c26566e2a4e45313bdf0de2e5d3552cbe3c8cf1c12ebceb8
SHA512e7a429e912dab2a5f3091b2a49a0af575f1fb36a4ead68e2e5b64b65a64860eec87eabdb755a77838a507e26a3d59d14aff1baf69670f72e752826a7694e6863
-
Filesize
9KB
MD5df0af67783cfe15214246d02c0030e76
SHA13ad7c224c020dafe3a3d00c71555235c15a295ba
SHA25625167520e8b60ac0284c5b9debb346e470c49252ba45ce6a1a18b08a03b84691
SHA5123300758fc4746652d6942556433e511eaab00b99b56ca5902b0ec7e29dd26c3828b883938eced60aa069f8802f31674a758b158774c7565177c009e7a1eaf82e
-
Filesize
9KB
MD532a8a40831de2b98d2cc641efb28a227
SHA1d0a44671595a57d29a6fbb34320e4963f42d4430
SHA256d0d27b6250ab360def504c466dbc58a0b8c982be8731b586eb4c1aab5d775d5a
SHA5128db27bec409b3c094ed5752b2d8025fd0ba2bfe50a9cef28830c10891d29296c95078fabae0f3d95683ab06f6e4174f64041938a6f12047bfbac19bfffa7f6f9
-
Filesize
9KB
MD5a0eabcf4e64432ce74e3f7b2f5fd6d41
SHA1d1446db302dafcc746ec48f5bd0483fdf6c2d175
SHA256b7bdf1c14494be955bd15036fdd4eb2163c2b30b24a5f1b01ca354c31313238c
SHA51252d3fab49b5bead6d43789d944fc11fe43d5205bd7580f03c00f8d02faf8ef0877b9579b9b573c7901215f5b88bf7ccb4140399d836fead605b0c7f16093fdd3
-
Filesize
9KB
MD585c3d6608fcf886408581cefacd9aade
SHA1cf51c0c2dd1385bc783411049d59a835372e11e0
SHA256a08a83cdf8c3ca477089b2a06fdb3b98e7c4673f16053b275dd378537cb2c3e7
SHA5128847d35b8022354e98de3cbd5a7ecb40b328f77ac7965b32d06a0267029b781780e130cc0d0148ecf4b08c865f4016b4bd64d744660f4a8ec7834a48775c28b6
-
Filesize
9KB
MD52f9635ff813715bd0d8343f2dcd38b08
SHA1b793a1497a57029e8e8a93e4121e5c48545d0521
SHA25678a9fd24c613eacbc1ee4e17d58bcef45dfbb1160aef55be3e3b8481dd5055fa
SHA512c81c721b0669742a720d83c0814b299b18eae26dc10ce6016e7cb9a81ad6148039b1abad0ed1472fa4b926ed0e1fc498bffe803edc1e0497e396ab592af89945
-
Filesize
9KB
MD5c9bc61ced01add104d0c40183ea393dd
SHA1cf52d7a2e82895fe9f89315cd156b33b47c9fb77
SHA256414a32b12f7577e1375fb17f5f2ce86dc2c4feecda531b89643f4d7cde91bd93
SHA512b80dd7f08753d55b206d0f0d298b1d1d86d241fe71808b37fcff8c2edb5d4b1514f978059dc479e7b59834e66bc05347f9ea40073aaed95e26df3402b57e89f8
-
Filesize
101KB
MD5a9f9bea7500f88e6fb087b63bc06cb57
SHA1b8cc825724cf3478df4bda21d40d37994f5c0028
SHA256eec20e8e704e17dc46b6311f710d94b9346584f947f40747e7f014ea455c058d
SHA512d3fa63eaa0ae4fc5976c498c6c79231b0e7d70ae8a35010f56fa7105810904e2f9ff8b0f8f42f0bd4e0036d69b45bea30617caa336284df7fbb1857040e64a41
-
Filesize
101KB
MD528dcf54ce0f85725b00aa41feb5d5072
SHA1e209f4bed1a9305348e575189a3179b2774a2a14
SHA2569fe0c8ab30c16c9c10369624ecfcd17c1f5d98e8904718cc019e6b8be42a54d7
SHA5121278f634f11abed6db7671390204f6d47c974f849b3550adced6023b8804a1bc1fffd50949a23ab51675f96a92a6058ef4f8afdde9e0799f59171640a60d77b9
-
Filesize
130KB
MD572f0c946e6a15b1d750dcf359ab94d30
SHA134b494761ac70ad86c9822e479e6911a5696c2fc
SHA25660a7b8e9a4ef89d49391516a2cea6fd73efe646196e17c28f624f3b33e11edb1
SHA512f3364b9114c92002fe83ed6ae21ae437839214bee7f16df58e20c0f0a02b72c8cfdd87685de59a18073577eed33fe9e051fd3157a066ab286f9cc4fc349dd8aa
-
Filesize
101KB
MD5aed514bcccabf900105bdcb99f9d5eea
SHA1549a0437e58e6d6db2ef6813805d9461e77d7a0b
SHA25659aa9ee826b188a5880348455eca990a82ab3bd9bd59114def8767aabadc5fa0
SHA512d9b3426696bd935a971676efbcf304944348b54815f1e2544fc6ea0024579489ff347863742646f18d1d5b2b898fdaaf2bc0920f38354a95bb087747e1219959
-
Filesize
101KB
MD5a6a4d8ba8979d47ed49ffcb43152ffc1
SHA181e41bd2e6124ace2dc7ac1e9dc6f98691ba8fe4
SHA2567bbc5da92f9d5ab9d8b9d062df85013d457022428031626ddc2b85638cf1c729
SHA512aaf19b0bfd034f1eb0957b720995ae7dcaa083422c336cbaae123ee71b3e8ec2fe673d2390660789094e4b14af553f58da98df52c8026b09b3e4204de7322058