d5bfbbde88053f2df56c53dde271a0fded0ed6b2ec9b81c9c0f95d7d13f82c48

Analysis

max time kernel
52s
max time network
155s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

index.html
Size

591B
MD5

f5b5610061da00913cd26209f31d4025
SHA1

38459cbe624341073ee3828551387e704f729ca4
SHA256

d5bfbbde88053f2df56c53dde271a0fded0ed6b2ec9b81c9c0f95d7d13f82c48
SHA512

2d542aeb6c735441397239658f522879207ccbf815a03fe4657b44215b00817a4f82deb5195aefe22db1b061f5367bba35032fbe43c7d706845e5137f3b1818c

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 501045675c0adb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000000e7591ffe79549edb8fe58c096118512996facef2583c935bba67137a90582f6000000000e80000000020000200000004fd3cbef3f27c25905b5ee7490d9e30042708a9c3a8b9651be5ac9e28aaef40f20000000fdf929a6f6d0a2f467f4ce626421adbd58cf05eda8edfce2938174d69cf56d1640000000d784bc29bbb2efe213c58cb18ba7887be6ac4f3cb9cbfd253ff55ef293c016555d923c2352117d4b6882b04dab68cf7c0993b73eb6b6a86280059d4df692bf2e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9216D2F1-764F-11EF-8EF2-FE6EB537C9A6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000450421adfcf996101da7dd0d79b327bdee3face822e896985014ab40c3757145000000000e8000000002000020000000eb93052618bda8d89fbb8fc6c0c3c4e91915c71b1b054808748bec71b9811c41900000007cbf44240bb84dc8fb52f4924479a7dc9dc10325d51baa8b9a5f4825be63b50382ee32dbf3c0bffff5870f424fa3cea0dfda9f42f5720c8e3384cd8b9c48c2af6acb38e33e33a7062b5a659c533c3a863ace520d0ca2821f5f451060fc7856e0849902faa4840a7691c5a0937c35ca27ec129e6442bcdce2b01ac6524ad5217ffc9a707826855aca5d9cd067ff2f74b74000000020c33975231f87361e4651a358f4f6cea31760ba592a436fda5928291c92286c484d28b567b6d20d929e3d4777a27eb8c30717812e630373e412377c55044eb7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1044	chrome.exe
1044	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3012	iexplore.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3012	iexplore.exe
3012	iexplore.exe
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2840	3012	iexplore.exe	30
PID 3012 wrote to memory of 2840	3012	iexplore.exe	30
PID 3012 wrote to memory of 2840	3012	iexplore.exe	30
PID 3012 wrote to memory of 2840	3012	iexplore.exe	30
PID 1044 wrote to memory of 528	1044	chrome.exe	33
PID 1044 wrote to memory of 528	1044	chrome.exe	33
PID 1044 wrote to memory of 528	1044	chrome.exe	33
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 3004	1044	chrome.exe	35
PID 1044 wrote to memory of 1252	1044	chrome.exe	36
PID 1044 wrote to memory of 1252	1044	chrome.exe	36
PID 1044 wrote to memory of 1252	1044	chrome.exe	36
PID 1044 wrote to memory of 940	1044	chrome.exe	37
PID 1044 wrote to memory of 940	1044	chrome.exe	37
PID 1044 wrote to memory of 940	1044	chrome.exe	37
PID 1044 wrote to memory of 940	1044	chrome.exe	37
PID 1044 wrote to memory of 940	1044	chrome.exe	37
PID 1044 wrote to memory of 940	1044	chrome.exe	37
PID 1044 wrote to memory of 940	1044	chrome.exe	37
PID 1044 wrote to memory of 940	1044	chrome.exe	37
PID 1044 wrote to memory of 940	1044	chrome.exe	37
PID 1044 wrote to memory of 940	1044	chrome.exe	37
PID 1044 wrote to memory of 940	1044	chrome.exe	37
PID 1044 wrote to memory of 940	1044	chrome.exe	37
PID 1044 wrote to memory of 940	1044	chrome.exe	37
PID 1044 wrote to memory of 940	1044	chrome.exe	37
PID 1044 wrote to memory of 940	1044	chrome.exe	37

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7a49758,0x7fef7a49768,0x7fef7a49778
  2⤵
  PID:528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 --field-trial-handle=1296,i,13748914775165933660,15279701700563536507,131072 /prefetch:2
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1484 --field-trial-handle=1296,i,13748914775165933660,15279701700563536507,131072 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1592 --field-trial-handle=1296,i,13748914775165933660,15279701700563536507,131072 /prefetch:8
  2⤵
  PID:940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2332 --field-trial-handle=1296,i,13748914775165933660,15279701700563536507,131072 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2340 --field-trial-handle=1296,i,13748914775165933660,15279701700563536507,131072 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1564 --field-trial-handle=1296,i,13748914775165933660,15279701700563536507,131072 /prefetch:2
  2⤵
  PID:1724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2204 --field-trial-handle=1296,i,13748914775165933660,15279701700563536507,131072 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3836 --field-trial-handle=1296,i,13748914775165933660,15279701700563536507,131072 /prefetch:8
  2⤵
  PID:2848

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37f770c16434b5f2ba44aa804e716824

SHA1
7234a8bd6d957f00f0f022e2cbd1b6c001728d18

SHA256
c12d5bde300135a7a5fb0b90198a8ff32062e3af2fbd1c8be63c706447c47b34

SHA512
e8205528b548197562c2108db73c137f33047201fd66607540b5c77eb77379f9fd235ea6ac6c22250542107ab6dbe7b604c71fa05a2e25271dc6639b178a0a0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4c6bb7c0103dfc6eb232f9d19f41824

SHA1
350ee80dbdebc81f502d7181e269175b1f694b86

SHA256
8ae2a463594d9f9911bfb55930bc7076fdf4fd64a1cb624878d3cfc2b921f8ec

SHA512
a98ba6638f1db535b783c3733c03cab6eaa38410201472dbfb1da070fd96a9fcae7b917ebba4edb3f51750ed0f4f42b2b47a06871c7ec1b8d31a3d9dc34e6ef6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5ffa1d4836b19a8f52a1feebbc2f7a4

SHA1
38b0b1dd9632c5dbea8aac922fd23dd77403e072

SHA256
c0b16e6795d2a05ed2f34fff8b719103b9fc73e5fedc8e4f4c5e2a0e6878106f

SHA512
199c9bfd321b29951d5c186a352251354d4cfe9e5d5420ae97b44e254d6b3d424cba33e2c8082b218e67cb3ef5ae0212175e434d0abe5cc436dc09f1ce637346

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
345970a4ceba8bd25e4f425492636bb0

SHA1
2239b79b8500b4bb82670e3e20bdb3d59dbe08f8

SHA256
b9902afb0cc72f57f1442de6e14c80ea980baa115d97da495001b6cf7641489c

SHA512
a9e678b235471c77514b6b1bb04b15d54f66eb9ef8d705e7b099944ff253b866d80ace4e3d75c4d49661272e37eaf19aa621f80634f0ef2e213496003e229d6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ac55fc52f12cc2d4fa0515a87bc6101

SHA1
0ee637422a59a78320070d687cee667181407021

SHA256
e734f862c18ed80c8e41c914cdeb47d839ee56ca624a7a3ad5c29a86800cd305

SHA512
f5162bed2270089910a9064bc006ef6b97f1ed46c0cf2a960d2e57a6bb297485d6c4c56c7d7fcb2a48a33eac76edb898389c7dd75d2389ddeaaac66500629691

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d390a007761f15ac544a3c45ba17c51

SHA1
07323b505c1214f25b0751cfc2623791e155bcfe

SHA256
35039c676313d98d7819a6ca16948dbe061d5cfa31c6e2b0792a35e0a441544b

SHA512
bb87b98a4a1709c4773be0714263b006acb5acebfc558328a9dc293a6a0540d7ca1783f5aa14bc263ab6511e9c7fc403e22d6802c739c1ff95d52c18e82206f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
803c066a6a1c4babfd8c2bb39619aadd

SHA1
fac212a2e5ecb613165d072d0ada166a6b781eb7

SHA256
ba445e3263d8b52f1c563fa357bb4ba351a2ad005434501454ff9873f322752e

SHA512
292c027306a5f241fb2471d3150b078ea586ed6314e332b4bc1708134aa8c019728e88456809417e00fb4c4c6b868036a842d6772f9bc8d60a0f16374ffc420c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a941fc789c46781e8a558656ccd67c7

SHA1
29b05783782d108a9c567e5b6db00a90e2d0d1b8

SHA256
4cf3f0d857c1a267caffa710138f407d94ef39c114da90cc3c7429d10d85c6bd

SHA512
a79ff5d990fab98bd5978f5c4e84449cbde3e956a414f5bed0b10761c074c376c31287cca003bbd8172e451618c6c9d610664c05a42bbad5116e1d054f6ba11c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b65d9f8da0d231bc4ee352d60e44e095

SHA1
14afe169e46b3883694ad3adafe9501ea2d4a3ed

SHA256
eb4e4ceac3cafcc1aa0a317f77ff5d5fdd825dd17d5ccf542142eb4eb63a614a

SHA512
9593de3d923f8f4c0876a9432233c01d071728f7df40b78003834e9372f57d355c06fbc2f001dd823e5d45a230c0aaea71ae0d273416c2892ef85581938e66e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8cfc5c414f9f7a40de239823ccb3170

SHA1
5c8c67104bf139ae6170a2bcf789ec016c83b142

SHA256
23df17d80986e6be2b99928a1a6fb75ee7cc531d46ac044efbea1d3ba8d3fbb9

SHA512
65c3dfe881317386074d6d16cffb24c4df0ec8257fb325e24c440a8de36aeb349294035abb961bb6d2f76faee8cf3a1ac63744b0c9aca55c65b9eacde2fd3098

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
efc479bb61a6e48ae58d7c9f13860de3

SHA1
e3ca7849b3f379dd8be8dd3882ceba2556e73296

SHA256
1b37856d069414a6d42e551d6d272fee0f828d78fd1c9b12e751a4ae12b5e3aa

SHA512
3a84697864e698098730075fd4f74a4348325519d23178377ccfc06bed2630097af83b7e38524d9c41756a664e0b2e71e688d7cd542dba12a98011b3e4b8331b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2e3f24da5a738d86e290646b003dfae

SHA1
d6d493996d44afc1c71c0edc8cfa504fb97527b4

SHA256
3335262b19c460b22842bf86e4b8a667720ff8bbffe27ba363546120a3e45568

SHA512
aa5c6e553c8dc57eb6da15cf7439d44f7536ac2f97d820aa8cf408e946d25e626f19c9645f5e4b89c62da7e87234d76ab077f65c2650b56d2a11149844679299

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a9f5af0eccf676ae491c783fa2724b2

SHA1
3b07e8121cb5aaa17fad358b501b22306f96f2fd

SHA256
583c923a1201131f27bab9ab8c891d8505dea3cab926cb0114a3b4dbdf5c4e7b

SHA512
9018b07bef7399b7a9bf127d46fbb02a174b7323bd3abdd6f358657e5a61fc274067ced856c7f662450b7d743b7635460016b7796fa37302b3d2ddd129221faf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
326e6657e7b60b88eb8b1f8dc71a4581

SHA1
3eb534a77d7f59fb11add7a6af2871f6a69e70f9

SHA256
88924cc99e4cad8cee91834ca3ba6e00624c451500032b10b7205ba070eb3f5b

SHA512
65b2a85cc90190ce7ab4b5c97a6bc805774a485dca2dc8ea8307c4d898f65b3779d2932334c68f94e242c0ea11e032ebe1aad6a00d6af536f528ec764c44ae42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a06f486be17c79a26dcdc29c4e50c60f

SHA1
c5dae2a807e54133cbf45bc7b235175b4d1174d2

SHA256
c5990994f14eebc187f48e6db145083bf5000a83f7375c5d6c3d8fddab46774b

SHA512
3d22794c0ce46f37832b2159024807b7ea6a71135ad047fb8a19d961a30a8c937a7a7410b6174723c804f17aeb1d2d755b65d69807cd512c294fa04de0646ce8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ae9be46b92d95a75cb88ce4606ceb46

SHA1
65c6d27ec521075d7a6de17f7f4a1b1ed509ce1a

SHA256
0a1e49c368aefa25102d34dba5d6dc0e6241f408d6325b770bd723cb9dd27933

SHA512
86e94c933db6a9d8ca222bfb719bafea291ea6e9668b551ea81b5a0556eece3b311f52cfbdf7eab4d694a08f45ec20225f4c4d90634a9087f576b3c00ea5231e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34de2de9ba605c38d23bd2764826ec17

SHA1
6b166a18dd78d709eeb4996fbd915312cdf3814d

SHA256
ab855b85d0a9ec912487906345ca3ba15ac7bb676330eeda2d29df6a1e356171

SHA512
b4d44f4bf9c82eda3ca721ec9c5481255dee2835e7d26d2d9d959b1d4cc6f4770292798df161118daa1fa9e7c9db333fe637128c3dca72440b117516e64ebec2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc8a4be28250ab7ceb12492dea3b4a21

SHA1
b05d2f2fd95a0b5472704ee04da84f8cdf089172

SHA256
9cb50ec5582f68a0443cff93cf311576fa1e0a5a207c757da929b00271759b8d

SHA512
eedccacdad0795c4ca0c42747700fc941b9b017ee4d0923020720ae406d07e30e154fd59be7c9bf6fd22d9d980e180590303f684c88f12942299228fa8304e13

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
987B

MD5
ebce898d70d8a87d8542d4d0118c3a74

SHA1
7b32c34d1e037edce51d6e01962927c0e2d61f05

SHA256
511b758482bfebfc62b6896df1102e86d6f6bcf5d6b980b3016844889e2d2edf

SHA512
cd6938603140f7b70321930f549e5fcc9ef700ace86dc98b0535c36879fb367462e6ebaceea0c5de7360a92b2df3ee363056826c469cbdee384b0dbf33a35f89

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
86afdabaf16976a9dc79962f02027442

SHA1
2ba9a1effc2c4fdf3c626f24603d140ec0973bbd

SHA256
c1c1eb12c5dd664b2835af135436a00186687ca58a77998d066f1f3e68dc559c

SHA512
a2933226c11bab5e66be25a491702d4c4dbc43e0c1f488b22e2a7430b0aaa4fe49eaf766b3576d4c9206b58da05e2b1b465c7a3bc4867195eaea14bd9761d056

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
fa15d40f076efb9d4098573038064178

SHA1
31e932e465749bcf26f190afb1ceb0e532bf332d

SHA256
e3210c80c7b3de7942fc86abdd0ff836c3ec223b905d96eef8248558e6070ce2

SHA512
5bb7cbf3cbe0496382b65d8bda62e69e5f8e938c2a84fe35d85bb0a65bcc6e75e67b4aa64eda7439c1da08846baaf719bdc47091525a8418d419a2111dea07a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5E58.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5F27.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit