Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1799s -
max time network
1692s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 15:28
Static task
static1
Behavioral task
behavioral1
Sample
DiscordserviceAdmin.ps1
Resource
win7-20240903-en
windows7-x64
13 signatures
1800 seconds
Behavioral task
behavioral2
Sample
DiscordserviceAdmin.ps1
Resource
win10v2004-20240802-en
windows10-2004-x64
12 signatures
1800 seconds
Behavioral task
behavioral3
Sample
DiscordserviceAdmin.ps1
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
0 signatures
1800 seconds
General
-
Target
DiscordserviceAdmin.ps1
-
Size
7KB
-
MD5
b8102a5e9780fed11bc7d87e953b9407
-
SHA1
b8db32f9e8d71ee6e659a7ccc0420b7a4c05713c
-
SHA256
8f3ac6cdd88765f6ee8def058bc1875e213ad18bc233914a509dc9b1fae9ca6f
-
SHA512
bd8039bfc7dba05fb113491381549afcfd11bfe5346753fefd8e7227e2ffc35f3398bad3075bdc6b8c4af36b9658c6d6e3d3645f87850d17bc3077a01fa6ed2a
-
SSDEEP
192:C1fSFGnbZ9VugofDlphVCN7OXYvQLbwq4dFSJHpebShRp:C1fbUgqCsi6J
Malware Config
Signatures
-
pid Process 2668 powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\MRUListEx = 00000000ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags chrome.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000000000001000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} chrome.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg chrome.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0 = 4c003100000000002359e72a10204c6f63616c00380008000400efbe2359ac292359e72a2a000000000200000000020000000000000000000000000000004c006f00630061006c00000014000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 chrome.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3} chrome.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 chrome.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 00000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0\MRUListEx = ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell chrome.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg chrome.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000000000001000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 chrome.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1400 notepad.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2668 powershell.exe 1672 chrome.exe 1672 chrome.exe 2328 powershell.exe 1672 chrome.exe 1672 chrome.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1804 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2668 powershell.exe Token: 33 2832 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2832 AUDIODG.EXE Token: 33 2832 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2832 AUDIODG.EXE Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe Token: SeShutdownPrivilege 1672 chrome.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1804 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 2632 chrome.exe 2632 chrome.exe 2632 chrome.exe 2476 chrome.exe 2476 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1672 wrote to memory of 1724 1672 chrome.exe 38 PID 1672 wrote to memory of 1724 1672 chrome.exe 38 PID 1672 wrote to memory of 1724 1672 chrome.exe 38 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 1324 1672 chrome.exe 40 PID 1672 wrote to memory of 2548 1672 chrome.exe 41 PID 1672 wrote to memory of 2548 1672 chrome.exe 41 PID 1672 wrote to memory of 2548 1672 chrome.exe 41 PID 1672 wrote to memory of 2276 1672 chrome.exe 42 PID 1672 wrote to memory of 2276 1672 chrome.exe 42 PID 1672 wrote to memory of 2276 1672 chrome.exe 42 PID 1672 wrote to memory of 2276 1672 chrome.exe 42 PID 1672 wrote to memory of 2276 1672 chrome.exe 42 PID 1672 wrote to memory of 2276 1672 chrome.exe 42 PID 1672 wrote to memory of 2276 1672 chrome.exe 42 PID 1672 wrote to memory of 2276 1672 chrome.exe 42 PID 1672 wrote to memory of 2276 1672 chrome.exe 42 PID 1672 wrote to memory of 2276 1672 chrome.exe 42 PID 1672 wrote to memory of 2276 1672 chrome.exe 42 PID 1672 wrote to memory of 2276 1672 chrome.exe 42 PID 1672 wrote to memory of 2276 1672 chrome.exe 42 PID 1672 wrote to memory of 2276 1672 chrome.exe 42 PID 1672 wrote to memory of 2276 1672 chrome.exe 42 PID 1672 wrote to memory of 2276 1672 chrome.exe 42 PID 1672 wrote to memory of 2276 1672 chrome.exe 42 PID 1672 wrote to memory of 2276 1672 chrome.exe 42 PID 1672 wrote to memory of 2276 1672 chrome.exe 42
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\DiscordserviceAdmin.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2668
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2616
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5a41⤵
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DiscordserviceAdmin.ps1"1⤵
- Opens file in notepad (likely ransom note)
PID:1400
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6c49758,0x7fef6c49768,0x7fef6c497782⤵PID:1724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1384,i,12826652688292850668,8681287800074900709,131072 /prefetch:22⤵PID:1324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1436 --field-trial-handle=1384,i,12826652688292850668,8681287800074900709,131072 /prefetch:82⤵PID:2548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1580 --field-trial-handle=1384,i,12826652688292850668,8681287800074900709,131072 /prefetch:82⤵PID:2276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2260 --field-trial-handle=1384,i,12826652688292850668,8681287800074900709,131072 /prefetch:12⤵PID:2452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2272 --field-trial-handle=1384,i,12826652688292850668,8681287800074900709,131072 /prefetch:12⤵PID:2308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1660 --field-trial-handle=1384,i,12826652688292850668,8681287800074900709,131072 /prefetch:22⤵PID:2700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1328 --field-trial-handle=1384,i,12826652688292850668,8681287800074900709,131072 /prefetch:12⤵PID:2424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3440 --field-trial-handle=1384,i,12826652688292850668,8681287800074900709,131072 /prefetch:82⤵PID:1736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3556 --field-trial-handle=1384,i,12826652688292850668,8681287800074900709,131072 /prefetch:82⤵PID:1200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4076 --field-trial-handle=1384,i,12826652688292850668,8681287800074900709,131072 /prefetch:82⤵PID:2004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4052 --field-trial-handle=1384,i,12826652688292850668,8681287800074900709,131072 /prefetch:12⤵PID:2592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3916 --field-trial-handle=1384,i,12826652688292850668,8681287800074900709,131072 /prefetch:12⤵PID:184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=1316 --field-trial-handle=1384,i,12826652688292850668,8681287800074900709,131072 /prefetch:12⤵PID:1364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2788 --field-trial-handle=1384,i,12826652688292850668,8681287800074900709,131072 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1124 --field-trial-handle=1384,i,12826652688292850668,8681287800074900709,131072 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2744 --field-trial-handle=1384,i,12826652688292850668,8681287800074900709,131072 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1804
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1784
-
C:\Windows\syswow64\Windowspowershell\v1.0\powershell.exe"C:\Windows\syswow64\Windowspowershell\v1.0\powershell.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2328 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2704
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6dd4fee9-960b-45a1-91f6-1eb4030e630d.tmp
Filesize6KB
MD54e10be24a7e150a16c6e03fb3133a543
SHA13313c7efa96fe9eae3d7fb92f020b4c1149256a1
SHA256b9ce8945335adabb94a247a310d29ef3465fa0c0fd6a869b4f0abdf14624b94a
SHA512624077f091a37cb561321f8a90006021c812a7379dc8d32e600434287fabafa46624fee9aced39883b440dfb2c00175d52b8b03a03c8257e7d940089be63f2d1
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
6KB
MD55a08d2c132bf4233b7817da209c1b5c4
SHA1b2ed4e9ce649676fb1af60465b3cfbf85e6471b3
SHA256e9f89afa7d59e2542aca64618b45ce0d0094e89ba24ce945ec3f751959dc072f
SHA5124b14d4934522d8a80bb9aafeb78cd3187a69c46ca67dc1f939d6bf2e84d2ed5f7392c1fdf5d7e2effb51662e93c8c3cad7039b66829cc5b6822bb219130149cc
-
Filesize
5KB
MD5d3cbd924d0771caa9fa865067aa11fa2
SHA113255561559c731c3ddefe1827512d30a43d6e8a
SHA256da4a7d42009d5892316e00dd52a0848c998fb5bdec49f08d3a9a4649c8d96807
SHA512f643e10279fd1dd1daea9708758cc9d46b1bb1183dfcc631a06e9c5321d31b080a736eb59627eb88e065855071d8d69f80069166391a33ada156d4a392b26524
-
Filesize
6KB
MD54d8296fbc63f7009a4721de7188f9f43
SHA1981813be441aa7453596921c3e4c90d46b382db9
SHA256f352b1643d8018494b4072f7b8b42cdc2529b28cbdb0429e84c7b0c106a7091a
SHA512790a030d8e960d56f02b4422d23b33bace6297d39e6c7b26a247ceeeb6f67b3afab50aa57816446615c55e20f17866bce0569da55fcb6f12dff3b49113ece8e5
-
Filesize
6KB
MD54ce007760983e7c94591bd5cd0a78565
SHA190576bc6ec31b9f0107d98224ee7590ca8692815
SHA2560a33002c143ba21bd9dbf0cde592e0426f47b88d29c62138fcd4fe166c499bd8
SHA512179b4a127adfc0e692c9579304d15ce0735e656de305206e508cae8dd7c593c31369da355972a01300de1154526033958f563b1e839311b6416321efd5dab719
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Filesize16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2