Resubmissions
12-10-2024 18:55
241012-xk1asazfrj 1030-11-2023 19:32
231130-x8zddshb2y 1028-06-2021 11:05
210628-3vdg7sx13e 3Analysis
-
max time kernel
670s -
max time network
1728s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
12-10-2024 18:55
windows7-x64
10 signatures
1800 seconds
windows10-2004-x64
2 signatures
1800 seconds
General
-
Target
31.214.157.40_#[email protected]
-
Size
7.1MB
-
MD5
bb1570ca408cf76448102c7ecbbe322c
-
SHA1
0445c648174ca1930c2cdb0b89902cd4e984a9ea
-
SHA256
b0baf071692d63267aaf41bd3db933826523b59e8fca49655e1656ce0c656c71
-
SHA512
53efbbd752d2b0dd1e13231bf8d917a5ac512962860f6ac46f76d6fb618b4a83a54cabdee5295b20805bbd6a9ce343ff2967257679419185ede4b4ab45294a3f
-
SSDEEP
196608:qLcWN3KlidmQtekNXjglGHglGKglG05Pu0uCET7+y:MNxJHgKgBgtM1+y
Score
3/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies registry class 50 IoCs
Processes:
chrome.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48" chrome.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "3" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 000000000200000001000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell chrome.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 chrome.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3} chrome.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} chrome.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU chrome.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193" chrome.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000000000001000000ffffffff chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 chrome.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f44471a0359723fa74489c55595fe6b30ee0000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" chrome.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
chrome.exepid Process 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
7zFM.exepid Process 2716 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
7zFM.exeAUDIODG.EXE7zG.exechrome.exedescription pid Process Token: SeRestorePrivilege 2716 7zFM.exe Token: 35 2716 7zFM.exe Token: 33 376 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 376 AUDIODG.EXE Token: 33 376 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 376 AUDIODG.EXE Token: SeRestorePrivilege 908 7zG.exe Token: 35 908 7zG.exe Token: SeSecurityPrivilege 908 7zG.exe Token: SeSecurityPrivilege 908 7zG.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe -
Suspicious use of FindShellTrayWindow 36 IoCs
Processes:
7zFM.exe7zG.exechrome.exepid Process 2716 7zFM.exe 908 7zG.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
chrome.exepid Process 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
chrome.exepid Process 2404 chrome.exe 2404 chrome.exe 2404 chrome.exe 2404 chrome.exe 2404 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid Process procid_target PID 2104 wrote to memory of 2708 2104 chrome.exe 37 PID 2104 wrote to memory of 2708 2104 chrome.exe 37 PID 2104 wrote to memory of 2708 2104 chrome.exe 37 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 988 2104 chrome.exe 39 PID 2104 wrote to memory of 2516 2104 chrome.exe 40 PID 2104 wrote to memory of 2516 2104 chrome.exe 40 PID 2104 wrote to memory of 2516 2104 chrome.exe 40 PID 2104 wrote to memory of 1544 2104 chrome.exe 41 PID 2104 wrote to memory of 1544 2104 chrome.exe 41 PID 2104 wrote to memory of 1544 2104 chrome.exe 41 PID 2104 wrote to memory of 1544 2104 chrome.exe 41 PID 2104 wrote to memory of 1544 2104 chrome.exe 41 PID 2104 wrote to memory of 1544 2104 chrome.exe 41 PID 2104 wrote to memory of 1544 2104 chrome.exe 41 PID 2104 wrote to memory of 1544 2104 chrome.exe 41 PID 2104 wrote to memory of 1544 2104 chrome.exe 41 PID 2104 wrote to memory of 1544 2104 chrome.exe 41 PID 2104 wrote to memory of 1544 2104 chrome.exe 41 PID 2104 wrote to memory of 1544 2104 chrome.exe 41 PID 2104 wrote to memory of 1544 2104 chrome.exe 41 PID 2104 wrote to memory of 1544 2104 chrome.exe 41 PID 2104 wrote to memory of 1544 2104 chrome.exe 41 PID 2104 wrote to memory of 1544 2104 chrome.exe 41 PID 2104 wrote to memory of 1544 2104 chrome.exe 41 PID 2104 wrote to memory of 1544 2104 chrome.exe 41 PID 2104 wrote to memory of 1544 2104 chrome.exe 41
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\31.214.157.40_#[email protected]"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2716
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2036
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f01⤵
- Suspicious use of AdjustPrivilegeToken
PID:376
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\31.214.157.40_#DarkRadiation_by_@r3dbU7z\" -spe -an -ai#7zMap28767:160:7zEvent198621⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:908
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef70e9758,0x7fef70e9768,0x7fef70e97782⤵PID:2708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1208 --field-trial-handle=1364,i,8671550806106959890,17433269608494516174,131072 /prefetch:22⤵PID:988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1548 --field-trial-handle=1364,i,8671550806106959890,17433269608494516174,131072 /prefetch:82⤵PID:2516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1588 --field-trial-handle=1364,i,8671550806106959890,17433269608494516174,131072 /prefetch:82⤵PID:1544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2320 --field-trial-handle=1364,i,8671550806106959890,17433269608494516174,131072 /prefetch:12⤵PID:2432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2364 --field-trial-handle=1364,i,8671550806106959890,17433269608494516174,131072 /prefetch:12⤵PID:2464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1436 --field-trial-handle=1364,i,8671550806106959890,17433269608494516174,131072 /prefetch:22⤵PID:288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1256 --field-trial-handle=1364,i,8671550806106959890,17433269608494516174,131072 /prefetch:12⤵PID:880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3440 --field-trial-handle=1364,i,8671550806106959890,17433269608494516174,131072 /prefetch:82⤵PID:2872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3432 --field-trial-handle=1364,i,8671550806106959890,17433269608494516174,131072 /prefetch:82⤵PID:760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3700 --field-trial-handle=1364,i,8671550806106959890,17433269608494516174,131072 /prefetch:82⤵PID:2652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3908 --field-trial-handle=1364,i,8671550806106959890,17433269608494516174,131072 /prefetch:12⤵PID:940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 --field-trial-handle=1364,i,8671550806106959890,17433269608494516174,131072 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 --field-trial-handle=1364,i,8671550806106959890,17433269608494516174,131072 /prefetch:82⤵PID:1796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 --field-trial-handle=1364,i,8671550806106959890,17433269608494516174,131072 /prefetch:82⤵PID:1524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=740 --field-trial-handle=1364,i,8671550806106959890,17433269608494516174,131072 /prefetch:12⤵PID:760
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1600
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
351KB
MD506460fb0653891629bdef86142842f47
SHA1345295bfe6bed3b6677e7e326ed6144cbb95a207
SHA2569815209fe89f30601356177d91111d5a09381cd2a4212764f70ad81591044646
SHA512291dd497a4a9909ce1c631340933a33224d4e618d835144f4d2ef74174a09735ffd2864b7a3736f0387a844f170a9960eb61c7b26b2334cf1b5d2cbd470c3240
-
Filesize
72B
MD54c90fe6fa6eeb21dbbbfd58bc3917dd2
SHA1124a2a75b2386b0eb507dc53cb1c4b2f4382e72d
SHA256c2e1d304556cd577c964be47e2327d45280a450f5225f0b09b4f64aa664822b2
SHA5125156ffee5e0dbbd959a0ff744c7ccd3100c31fde972be64397b29c82e64c4b06917a5efbbcca97806be246d45b68a7b6873e8676422949b226e164e6966d9c2a
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
5KB
MD5fcb7d03f6b69d92e0a637309a31afc87
SHA197acc7970ffb4ed856d532cb94ad03f9d8e43ae0
SHA25608688ce93d40548dc1210457cf1d0438ccaa97b182eeff4b29c4c52f3da8df20
SHA5125a36549d54057681a650fd05de5825d014a2b9f2e5431ff9281ea843f27fcd4ce9752977ce2fcfb737719efad604d49349c8127286edecc268739714f57aa98e
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e14a6d47-eaa9-4e3c-951b-40839a5508be.tmp
Filesize5KB
MD59a39f497b493e25d8faaf1c572f91215
SHA1d4b5c9e66c0a78ed06c26bf08ef30bfbffe5b795
SHA25682f4d42e95a970ec907a2d959c39556e6afe77174d650cbd0fbf8ae952be1b3c
SHA512b19cd926ca270ce994ca9d21467a393b3b76e1885219edd33f4b32f41e5af672be9e55219baa6c4d3a0f3ed74da432b836ed0b046800dd026fc71b1c2bc47f93
-
Filesize
177KB
MD575cbf5da4008d9fb56fb30e26a605836
SHA173cc923e55d4cd323924ce78c6b8fd0c590bb476
SHA2567b50a91daef3a3c3c9e6170e26153ab05e90a54757833239d4494ef2448ef951
SHA51224f85126fab239d26a69a800f199f674a177f1901de310ad91bc3850cc766fe144a0168a1c6135c02f90739b346622684e053860950725e4e155f878a11414de
-
Filesize
350KB
MD59d1dd320e49a18bff4f33eee9bd6514f
SHA17173f036c71aba93090feffff0ce0463807e6302
SHA25662523bcd3082d5bb3a6bcbe01ee2ceb6b01e761b7bd4b63ed6d1342d46965c39
SHA5122f5daedd33197dd6133a0d16bbb77d31d21b2bc0745e511adc50d2dc1625f4750dabf32d741e9f15c0b1b90254bf5efc359532d19026a401194e9c91490e8dc4
-
Filesize
368KB
MD5e5ff077d08f425cc19e54d4521f6505d
SHA1afa58568558fde9e2208bcb5d15cbe4fc61aa08f
SHA25693a4eb215ea093ccd7540592c9850633faf7fd9a099c66453d1405e1a9084f96
SHA5120b3c6f57744257d14c7c5e042a4b80c525d58313172c950e730d7a26b2931b7fe40fc50469806f9d919bc129bdd9f50438b52008ae878b784542fcfe4e5eb757
-
C:\Users\Admin\AppData\Local\Temp\31.214.157.40_#DarkRadiation_by_@r3dbU7z\api\supermicro_cr_second.save
Filesize15KB
MD5c55db4b6722cfd651b3cd17e30558c6e
SHA170f9cf0388462fa659216e82ebbf80cc582d1a64
SHA2566f40f2ee97a08d6f4c6eb7995b481f5a2f5aae97e4ab2f776b6e5b64dfa87c12
SHA512d05363ef23efdcaa00a0a5c60ba8b3dba875786f2e7652476ed1941ef0da9ab7cb6092db5a1c915544c3efc00dd58c15d1c9e0992e18945c10cf7e642abc3780
-
Filesize
6KB
MD594a4295cd2d0df00c570a41663729f2b
SHA126ab968b9448ebb8eb98e1fcb22ebf35174a024e
SHA256847d0057ade1d6ca0fedc5f48e76dd076fa4611deb77c490899f49701e87b6dd
SHA512f3636e244cafb6bd57183f7886893b0af6b49f9e081bf8fb679e6d91156e5fe63c89d28a9fecf2f6c6d01affcf38d4452e42a3f59a90c4a148e4b803ea443ef5
-
Filesize
2.3MB
MD53c49e3de249c57d41a318f42f5b2003a
SHA1413c288f927cd130203adede303c9174e4a09093
SHA256f949bebf4a7426d8d90e6fc5cbd13e60a6704fb25d6cab4ed248f456d7424404
SHA51201b4b24ce199010dbc0acaf830dd97aae7ccec1fd12085d20af6945c38564a09bf35b8160a4feb4338d4d8e4bc8a7818cec085655d66a3468e22bb3706445d59
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e