c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 01:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
Size

1.1MB
MD5

55ad212ef14e1d3a99251ba84d4c3497
SHA1

5f7127f6f859cae4b9d19f700196cb207a6ddd87
SHA256

c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33
SHA512

8199e1b9e83ea7f028c6f851b886d3cac829c533489c5e3292bc74b94df2900c7e4168dadec1f4ac0e12bff8a08679433586f79b719a240bb94cb816df5b5c76
SSDEEP

24576:yqDEvCTbMWu7rQYlBQcBiT6rprG8arB2+b+HdiJUK:yTvC/MTQYxsWR7arB2+b+HoJU

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133719617304464805"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1804	chrome.exe
1804	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1804	chrome.exe
1804	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 1804	448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe	82
PID 448 wrote to memory of 1804	448	c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe	82
PID 1804 wrote to memory of 3068	1804	chrome.exe	84
PID 1804 wrote to memory of 3068	1804	chrome.exe	84
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 2028	1804	chrome.exe	85
PID 1804 wrote to memory of 632	1804	chrome.exe	86
PID 1804 wrote to memory of 632	1804	chrome.exe	86
PID 1804 wrote to memory of 1788	1804	chrome.exe	87
PID 1804 wrote to memory of 1788	1804	chrome.exe	87
PID 1804 wrote to memory of 1788	1804	chrome.exe	87
PID 1804 wrote to memory of 1788	1804	chrome.exe	87
PID 1804 wrote to memory of 1788	1804	chrome.exe	87
PID 1804 wrote to memory of 1788	1804	chrome.exe	87
PID 1804 wrote to memory of 1788	1804	chrome.exe	87
PID 1804 wrote to memory of 1788	1804	chrome.exe	87
PID 1804 wrote to memory of 1788	1804	chrome.exe	87
PID 1804 wrote to memory of 1788	1804	chrome.exe	87
PID 1804 wrote to memory of 1788	1804	chrome.exe	87
PID 1804 wrote to memory of 1788	1804	chrome.exe	87
PID 1804 wrote to memory of 1788	1804	chrome.exe	87
PID 1804 wrote to memory of 1788	1804	chrome.exe	87
PID 1804 wrote to memory of 1788	1804	chrome.exe	87
PID 1804 wrote to memory of 1788	1804	chrome.exe	87
PID 1804 wrote to memory of 1788	1804	chrome.exe	87
PID 1804 wrote to memory of 1788	1804	chrome.exe	87
PID 1804 wrote to memory of 1788	1804	chrome.exe	87
PID 1804 wrote to memory of 1788	1804	chrome.exe	87
PID 1804 wrote to memory of 1788	1804	chrome.exe	87
PID 1804 wrote to memory of 1788	1804	chrome.exe	87
PID 1804 wrote to memory of 1788	1804	chrome.exe	87
PID 1804 wrote to memory of 1788	1804	chrome.exe	87
PID 1804 wrote to memory of 1788	1804	chrome.exe	87
PID 1804 wrote to memory of 1788	1804	chrome.exe	87
PID 1804 wrote to memory of 1788	1804	chrome.exe	87
PID 1804 wrote to memory of 1788	1804	chrome.exe	87

C:\Users\Admin\AppData\Local\Temp\c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
"C:\Users\Admin\AppData\Local\Temp\c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffd50dcc40,0x7fffd50dcc4c,0x7fffd50dcc58
    3⤵
    PID:3068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1928,i,1215246375798268292,16086301546359138616,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1920 /prefetch:2
    3⤵
    PID:2028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2068,i,1215246375798268292,16086301546359138616,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2120 /prefetch:3
    3⤵
    PID:632
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2276,i,1215246375798268292,16086301546359138616,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1772 /prefetch:8
    3⤵
    PID:1788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3128,i,1215246375798268292,16086301546359138616,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3148 /prefetch:1
    3⤵
    PID:2444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3136,i,1215246375798268292,16086301546359138616,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3172 /prefetch:1
    3⤵
    PID:4436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4500,i,1215246375798268292,16086301546359138616,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4524 /prefetch:8
    3⤵
    PID:2740
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4456,i,1215246375798268292,16086301546359138616,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4672 /prefetch:8
    3⤵
    PID:3536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=728,i,1215246375798268292,16086301546359138616,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5000 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4520

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
3df6e543100e45a087305ffe7bb71e67

SHA1
44867ed1cb70f750a1513384c9033ec46a79dcbe

SHA256
76248bf17eac5676ce452a92e69c42b996dd890ca281d8807e42bf0721b6dd62

SHA512
274401399659e8e1d5bbb780be0cf183766113416ff6f2cb6559f7ae2eeabb85984ab418ef7f7d42b0cbd7713ef66c51b465458c6709addbdfed6deac140d71d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
55435a143b590d4300244cdcfd12e6de

SHA1
154c3bb916d2647d91a2fbe276b407679b77e25c

SHA256
bb1ace259e1a6df2bf65044eb460631725725e8eaa722dc86f7c2594e04de749

SHA512
6e89a7975db746a31261fe6710840db60110cfb77f9b909ebacf40c5b1b66fe2b1986a16456adee95b489ee20f945f3913059da069eae2ad0700c2fb41b372da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
1fcce7f6b6bd5a53a84c33a43146dd8f

SHA1
9a5b934135e36ebb2bd5fa326605d23e1490f9db

SHA256
931ba44428de0370867d7311ca4f1715469fe2a634b81b20e10cfff0b73f0728

SHA512
52dacbb92b1bdb515e8644d2e0db52af67cd3f891eb95d082255fadcb568c021b293af989b5568cb4438fcf7c8e12b1279c7ce3bb4db6a2ffc03c253257fcc82

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
3a62cee8b2518bfec129ee6b13f0f0b0

SHA1
c97201e67cba3218dbdffd8c9572aaf180bf8cf8

SHA256
fba384a8830dee2c8a1d7bc49d794e3b3de2a4681f01b99b7d46093547087e3f

SHA512
ed03426b691dd06ead9200f7ec49092325892b6e71b1901394e57abb8cff811bd14da587f87d91866c6c386b4a22fd119ee02a5d62de65a3e72f4e1593ad068a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
857B

MD5
815dc00fb66e36e59d453217e7f1de81

SHA1
ffac3c1285506d5d97568243cea0d95bd8973634

SHA256
4eb0f81a81e0f8c073a421688f12b074a3e556a710212c0c1d0aea1979085e27

SHA512
af68d9c1429a802251fbeaf606377dc431c6c9bc9db8ec10ce58106d368b4be97f5fcb35add7117aee96811d58a18b04b79efafc01e5c45ca05c69c138bfb3fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6176ec0d7f3ece137e71e3f063c38689

SHA1
94b8aac8db94a3da4c3ad09dd40269d778a9e0ab

SHA256
05eac3206ac2261860051649695d795060307b795c91878dd64bea4aba0d582c

SHA512
8dd6a4cc7626cf95c7a47b193b3ce13e61a004577d307c5d5221be06704d5a82f7194541a0c046df3d3c8e41ab9d7cbb105a40f397665eb90502874332f4eb6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
36c21bdf134c8ca3152ec37df1ab3081

SHA1
41897f733800f75c446fdde794d0dfd0e22108a4

SHA256
8a0a208c7a8dba2a1bec9a40475141901c82745adbac7dfcebd0651483824fa7

SHA512
6c8dae2dc4024bc2283f98cfda80608cf85682d0643be9b4c8596580d23a03ee22a08e8fce7053cc3d36f5c76e0dbbd25db5c0184c64651ba685a0ffc4ec3f5d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c62254dcec11a6638c9be34a852b2f8a

SHA1
8911328b92dacbd5c9ae12fc805a4b97db83c2a1

SHA256
90e53305fc991e1e30fbeb7abe11b16e14c4c7c6d7a31cf7619a16a9be38da3c

SHA512
758bc436184fc762b20d8745283eee659a62f81c6b4773323fe64aeb924050b9e678a67c63205b23a8fd4efd70f081b8e1d6a93e5ed7ebc0582d1e37454869d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4c5e3dc09406ea052029970a07700a45

SHA1
033ebae169ba87a79b7b0ce9a932aea9f81ed942

SHA256
3054f66c9fdb91dd36d50f0d88737d045141299814ab7c999640b79a390227c7

SHA512
d50781fd2fbc5a4a7b1e548a1c8487bd01f4e4400ee749761111ebdcaba0117434640ce3f0541ae1ff1f4c442bc1c3760784f9ee3aa8e3a5c7f39ac022c02268

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
742eb2e674c5b75e3cf90caff8cd2d54

SHA1
755f0cbd04f46510fd03a1c5de19540d6d5ae7aa

SHA256
25c39623a3009f9c641053dcb91c898c06b8378c03854a5ccc071ac2a11a8cd2

SHA512
ac4ba61fc1cc53cac449fb15c7fde23615b092e1b65870c1ea9603b09510c8624fe587280ae824969fcc01721fe664d12c9ad46d7cfbeb3d2636ee66b6cf9294

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
0ad19c49afad32694faef1b9a8f4fc10

SHA1
6b55173309d205e8f8746d62229a8dc1248eaacd

SHA256
1753880ffde36dd0de982338c67837dabbf23e44611483c81c6fb611f0f03412

SHA512
27fb5981c068a9cbd9e94b5fbedb50c80fe1ab7f49d5042bafea31a36579d570a69f5600b466de50bfa37b49413420f6aea7c4d63c3f80f6138a2bb84bef129f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
c28a0b8faf86e9dfb2ac12c85017897b

SHA1
7aa7a2793796f81885c8adcebfab88d34648cde0

SHA256
1a130310abd3430159740dbf23a49438ea2a0005cb4e3bed6f883fcaab30f898

SHA512
56cb239f93c872f3571f4f16c93aeae2988ba432fd00d015de10c0bebd7be93564d5a060e1a640757b9ad5da49739bbccdaa050ea74838200d2b30baec1e3e3f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
212KB

MD5
83ea309e206de94121b3e257fe474ab4

SHA1
2d129cc5ad2d6c54bbae63aa1cfaba601ede6d3a

SHA256
ea4430946b5a2d7cb5ecd7aa7601f0466161e14a74f0796c8c3d0174fe56a52b

SHA512
a027f42d8c6674f7ef8232eb6945db78475ca74d7b4f8f4aec207b8eabb62edb0b53d7fdb785146ad39019e950887ef4f59700639d04a6d027f2bdf6fa13faf2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
212KB

MD5
de26e2ec91cede1f11a771a1b5835be5

SHA1
1f23e6ba449a894e12ac6333dbff53be6b6159bf

SHA256
d75408e0e4fa310f20bf3a65f72a7c8649ea70048f083df475f6af06d2c20931

SHA512
fe0776b1a38fc425bf4aa6d39ed6036cf5108f34acb2bb05edd451b33c2b82c77562f84a7373417176f612f474514fb3d94619af46e596707f93fa5f728822c9

Download Submit