61ca4d8dd992c763b47bebb9b5facb68a59ff0a594c2ff215aa4143b593ae9dc

Resubmissions

12/10/2024, 18:08

241012-wq2v5ayanj 7

12/10/2024, 18:07

241012-wqcagayakl 7

12/10/2024, 18:04

241012-wnw7vstcqf 7

Analysis

max time kernel
45s
max time network
36s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
12/10/2024, 18:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

MEMZ.zip
Size

8KB
MD5

69977a5d1c648976d47b69ea3aa8fcaa
SHA1

4630cc15000c0d3149350b9ecda6cfc8f402938a
SHA256

61ca4d8dd992c763b47bebb9b5facb68a59ff0a594c2ff215aa4143b593ae9dc
SHA512

ba0671c72cd4209fabe0ee241b71e95bd9d8e78d77a893c94f87de5735fd10ea8b389cf4c48462910042c312ddff2f527999cd2f845d0c19a8673dbceda369fd
SSDEEP

192:8xI2dw4xXlsUjs1ScK3ZeD6dUqENj710+MZ9R1SVBIpp:b2dHiosKA6OqEx2t9R1SLIL

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
2524	[email protected]
1412	[email protected]
484	[email protected]
4644	[email protected]
436	[email protected]
2780	[email protected]
2960	[email protected]

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	[email protected]

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133732300744852103"	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4756	7zFM.exe
4756	7zFM.exe
1412	[email protected]
1412	[email protected]
484	[email protected]
1412	[email protected]
1412	[email protected]
484	[email protected]
436	[email protected]
436	[email protected]
4644	[email protected]
4644	[email protected]
2780	[email protected]
2780	[email protected]
4644	[email protected]
4644	[email protected]
436	[email protected]
436	[email protected]
1412	[email protected]
1412	[email protected]
484	[email protected]
484	[email protected]
436	[email protected]
436	[email protected]
1412	[email protected]
1412	[email protected]
4644	[email protected]
2780	[email protected]
4644	[email protected]
2780	[email protected]
2780	[email protected]
2780	[email protected]
4644	[email protected]
4644	[email protected]
1412	[email protected]
1412	[email protected]
436	[email protected]
436	[email protected]
484	[email protected]
484	[email protected]
484	[email protected]
484	[email protected]
436	[email protected]
436	[email protected]
1412	[email protected]
1412	[email protected]
4644	[email protected]
4644	[email protected]
2780	[email protected]
2780	[email protected]
2780	[email protected]
2780	[email protected]
1412	[email protected]
1412	[email protected]
436	[email protected]
436	[email protected]
484	[email protected]
484	[email protected]
484	[email protected]
484	[email protected]
436	[email protected]
436	[email protected]
1412	[email protected]
1412	[email protected]

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4756	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeRestorePrivilege	4756	7zFM.exe
Token: 35	4756	7zFM.exe
Token: SeSecurityPrivilege	4756	7zFM.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
4756	7zFM.exe
4756	7zFM.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2524	[email protected]
1412	[email protected]
484	[email protected]
4644	[email protected]
436	[email protected]
2780	[email protected]
2960	[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 2524	4756	7zFM.exe	78
PID 4756 wrote to memory of 2524	4756	7zFM.exe	78
PID 4756 wrote to memory of 2524	4756	7zFM.exe	78
PID 2524 wrote to memory of 1412	2524	[email protected]	81
PID 2524 wrote to memory of 1412	2524	[email protected]	81
PID 2524 wrote to memory of 1412	2524	[email protected]	81
PID 2524 wrote to memory of 484	2524	[email protected]	82
PID 2524 wrote to memory of 484	2524	[email protected]	82
PID 2524 wrote to memory of 484	2524	[email protected]	82
PID 2524 wrote to memory of 4644	2524	[email protected]	83
PID 2524 wrote to memory of 4644	2524	[email protected]	83
PID 2524 wrote to memory of 4644	2524	[email protected]	83
PID 2524 wrote to memory of 436	2524	[email protected]	84
PID 2524 wrote to memory of 436	2524	[email protected]	84
PID 2524 wrote to memory of 436	2524	[email protected]	84
PID 2524 wrote to memory of 2780	2524	[email protected]	85
PID 2524 wrote to memory of 2780	2524	[email protected]	85
PID 2524 wrote to memory of 2780	2524	[email protected]	85
PID 2524 wrote to memory of 2960	2524	[email protected]	86
PID 2524 wrote to memory of 2960	2524	[email protected]	86
PID 2524 wrote to memory of 2960	2524	[email protected]	86
PID 2960 wrote to memory of 2008	2960	[email protected]	87
PID 2960 wrote to memory of 2008	2960	[email protected]	87
PID 2960 wrote to memory of 2008	2960	[email protected]	87
PID 2764 wrote to memory of 4296	2764	chrome.exe	89
PID 2764 wrote to memory of 4296	2764	chrome.exe	89
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 464	2764	chrome.exe	90
PID 2764 wrote to memory of 2892	2764	chrome.exe	91
PID 2764 wrote to memory of 2892	2764	chrome.exe	91
PID 2764 wrote to memory of 2852	2764	chrome.exe	92
PID 2764 wrote to memory of 2852	2764	chrome.exe	92
PID 2764 wrote to memory of 2852	2764	chrome.exe	92
PID 2764 wrote to memory of 2852	2764	chrome.exe	92
PID 2764 wrote to memory of 2852	2764	chrome.exe	92
PID 2764 wrote to memory of 2852	2764	chrome.exe	92

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\MEMZ.zip"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Users\Admin\AppData\Local\Temp\7zO492D8D97\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\7zO492D8D97\[email protected]"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Users\Admin\AppData\Local\Temp\7zO492D8D97\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\7zO492D8D97\[email protected]" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1412
- - C:\Users\Admin\AppData\Local\Temp\7zO492D8D97\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\7zO492D8D97\[email protected]" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:484
- - C:\Users\Admin\AppData\Local\Temp\7zO492D8D97\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\7zO492D8D97\[email protected]" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4644
- - C:\Users\Admin\AppData\Local\Temp\7zO492D8D97\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\7zO492D8D97\[email protected]" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:436
- - C:\Users\Admin\AppData\Local\Temp\7zO492D8D97\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\7zO492D8D97\[email protected]" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2780
- - C:\Users\Admin\AppData\Local\Temp\7zO492D8D97\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\7zO492D8D97\[email protected]" /main
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:2008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc4c29cc40,0x7ffc4c29cc4c,0x7ffc4c29cc58
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1756,i,17972055003210292840,7426080729200348323,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1752 /prefetch:2
  2⤵
  PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2028,i,17972055003210292840,7426080729200348323,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2104 /prefetch:3
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2192,i,17972055003210292840,7426080729200348323,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2152 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3104,i,17972055003210292840,7426080729200348323,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3160,i,17972055003210292840,7426080729200348323,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4452,i,17972055003210292840,7426080729200348323,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4440 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4716,i,17972055003210292840,7426080729200348323,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4740 /prefetch:8
  2⤵
  PID:4008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4572,i,17972055003210292840,7426080729200348323,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4556,i,17972055003210292840,7426080729200348323,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4272,i,17972055003210292840,7426080729200348323,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5084,i,17972055003210292840,7426080729200348323,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4728,i,17972055003210292840,7426080729200348323,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5364,i,17972055003210292840,7426080729200348323,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5324,i,17972055003210292840,7426080729200348323,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:3432

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
6771cad492a83285e31d0be017dba066

SHA1
80bb7ed53ca79aaba1d576b847bba9ca7e31a20c

SHA256
810fb576cae12853f9572d789c8be10cdb83df60a1f5645173e3fc7a6fcaedca

SHA512
0f1bd479ca8c3c8537cf6f284e1a1d74b9a573202192e1829289cb4c56fc0ef3f4f8000101b3651961e21b74c1fa4d17b5d6d014b2af30c659baba014d76739f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
0c2c7660d8c4f82712af5db9ba78119b

SHA1
883acbeef62b4e96ac9638323d86ee7038936db8

SHA256
0981e5fd96becc9c159035979582c74655bcf5a28b960ad60234a5f583a094ad

SHA512
7d8d03579621dbd6f66286f1f63c3da349939e6fb57d2a3bcf67bfc07a366e2edcb0a5707074c62132ed1b7efe6d98196ac6e9a801c310faa1977adf696c4545

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e3fee6c066af5ac19d3ee71028a04169

SHA1
3ae7b3961def49dbad29204f32fd81271089ea04

SHA256
3d82f16b01430d85b1d76213f666ce5c591a22bfea73d29cb9091f6a00475555

SHA512
cb8d199409a16836ad72872961e84ea96be6421ac1a5b590a2e5237e67a67bce7f5f20d81d92e83704c4f395fe5ef575183cd8ac6bba3f27ff4c81bd22a0edad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
682c60d4e4d0644d00f9281cf90df621

SHA1
17eac76b0f112975d1114b12dda22824841efc62

SHA256
ddaf8364698c77727fb999f8a99998a9ce90bae9f7301e0a1c40f5a993e51883

SHA512
91e652eb89d305527563446f997b01519aef987a5bcdcf06e9b4cf9f3c1cea4e019f0d1605f10435b2ea3508415ce6595f41c4dc60d49124178cf87050057425

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
34fcbde056ded8c0ba6b79ac360eecba

SHA1
1e39d03b84aa0240056dd663b093de63666609db

SHA256
a25c23edcda2ebbec6bf4639b4486e65aa13088d75e7d86480139609a8cbb987

SHA512
4975fd4ac60f38d7da10478d60eefc017c7ca5bd57007bd026357b20fe1844e6b03f81d7bd909f601bfea896ebfb59dc26e3b3dbbce76b5aaf3d4770cb9d4038

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO492D8D97\[email protected]

Filesize
14KB

MD5
19dbec50735b5f2a72d4199c4e184960

SHA1
6fed7732f7cb6f59743795b2ab154a3676f4c822

SHA256
a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

SHA512
aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit