Analysis

  • max time kernel
    132s
  • max time network
    127s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    16/10/2024, 01:16

General

  • Target

    http://rottenbypass.shop

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of NtCreateThreadExHideFromDebugger 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 8 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • NTFS ADS 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://rottenbypass.shop
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3324
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa748cc40,0x7fffa748cc4c,0x7fffa748cc58
      2⤵
        PID:4556
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1832,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1820 /prefetch:2
        2⤵
          PID:2304
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2056,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2100 /prefetch:3
          2⤵
            PID:3588
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2168,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2184 /prefetch:8
            2⤵
              PID:3672
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2992,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3020 /prefetch:1
              2⤵
                PID:4920
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3004,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3044 /prefetch:1
                2⤵
                  PID:1872
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4484,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4536 /prefetch:8
                  2⤵
                    PID:1168
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5004,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5064 /prefetch:8
                    2⤵
                      PID:4820
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4844,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5208 /prefetch:8
                      2⤵
                        PID:856
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4596,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5352 /prefetch:8
                        2⤵
                        • Subvert Trust Controls: Mark-of-the-Web Bypass
                        • NTFS ADS
                        PID:2556
                      • C:\Users\Admin\Downloads\antifekas.exe
                        "C:\Users\Admin\Downloads\antifekas.exe"
                        2⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: GetForegroundWindowSpam
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SetWindowsHookEx
                        PID:4028
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe"
                          3⤵
                            PID:3644
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe"
                            3⤵
                              PID:4476
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe"
                              3⤵
                                PID:4940
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                3⤵
                                  PID:4464
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                  3⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Loads dropped DLL
                                  • Writes to the Master Boot Record (MBR)
                                  • Suspicious use of NtCreateThreadExHideFromDebugger
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious behavior: GetForegroundWindowSpam
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1592
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5432,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5212 /prefetch:8
                                2⤵
                                  PID:3484
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4416,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5460 /prefetch:8
                                  2⤵
                                    PID:2068
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5320,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5620 /prefetch:8
                                    2⤵
                                    • Subvert Trust Controls: Mark-of-the-Web Bypass
                                    • NTFS ADS
                                    PID:1972
                                  • C:\Users\Admin\Downloads\bl.exe
                                    "C:\Users\Admin\Downloads\bl.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of SetWindowsHookEx
                                    PID:1184
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5456,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4776 /prefetch:8
                                    2⤵
                                      PID:1444
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5052,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5168 /prefetch:8
                                      2⤵
                                        PID:768
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5144,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5440 /prefetch:8
                                        2⤵
                                        • Subvert Trust Controls: Mark-of-the-Web Bypass
                                        • NTFS ADS
                                        PID:856
                                      • C:\Users\Admin\Downloads\kirogga.exe
                                        "C:\Users\Admin\Downloads\kirogga.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of SetWindowsHookEx
                                        PID:3836
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5280,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5076 /prefetch:8
                                        2⤵
                                          PID:2948
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5092,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5468 /prefetch:8
                                          2⤵
                                            PID:4896
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5636,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5572 /prefetch:8
                                            2⤵
                                            • Subvert Trust Controls: Mark-of-the-Web Bypass
                                            • NTFS ADS
                                            PID:4108
                                          • C:\Users\Admin\Downloads\love.exe
                                            "C:\Users\Admin\Downloads\love.exe"
                                            2⤵
                                            • Executes dropped EXE
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of SetWindowsHookEx
                                            PID:3060
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5572,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5140 /prefetch:8
                                            2⤵
                                              PID:1144
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5488,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5512 /prefetch:8
                                              2⤵
                                                PID:3872
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5452,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5548 /prefetch:8
                                                2⤵
                                                • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                • NTFS ADS
                                                PID:4832
                                              • C:\Users\Admin\Downloads\mata.exe
                                                "C:\Users\Admin\Downloads\mata.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of SetWindowsHookEx
                                                PID:1256
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5592,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5152 /prefetch:8
                                                2⤵
                                                  PID:2020
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5444,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5700 /prefetch:8
                                                  2⤵
                                                    PID:4736
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4928,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5808 /prefetch:8
                                                    2⤵
                                                    • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                    • NTFS ADS
                                                    PID:3984
                                                  • C:\Users\Admin\Downloads\rivero.exe
                                                    "C:\Users\Admin\Downloads\rivero.exe"
                                                    2⤵
                                                    • Executes dropped EXE
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:4144
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5148,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5740 /prefetch:8
                                                    2⤵
                                                      PID:2608
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5712,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5768 /prefetch:8
                                                      2⤵
                                                        PID:3980
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5736,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5864 /prefetch:8
                                                        2⤵
                                                        • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                        • NTFS ADS
                                                        PID:2788
                                                      • C:\Users\Admin\Downloads\soto.exe
                                                        "C:\Users\Admin\Downloads\soto.exe"
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:416
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5516,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5504 /prefetch:8
                                                        2⤵
                                                          PID:4688
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5768,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5536 /prefetch:8
                                                          2⤵
                                                            PID:856
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5792,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5788 /prefetch:8
                                                            2⤵
                                                            • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                            • NTFS ADS
                                                            PID:2736
                                                          • C:\Users\Admin\Downloads\zjosee.exe
                                                            "C:\Users\Admin\Downloads\zjosee.exe"
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2580
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5620,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6088 /prefetch:8
                                                            2⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:4016
                                                        • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                          "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                          1⤵
                                                            PID:5052
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                            1⤵
                                                              PID:2832
                                                            • C:\Windows\System32\rundll32.exe
                                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                              1⤵
                                                                PID:664
                                                              • C:\Users\Admin\Downloads\love.exe
                                                                "C:\Users\Admin\Downloads\love.exe"
                                                                1⤵
                                                                • Executes dropped EXE
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:2404

                                                              Network

                                                                    MITRE ATT&CK Enterprise v15

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

                                                                      Filesize

                                                                      64KB

                                                                      MD5

                                                                      b5ad5caaaee00cb8cf445427975ae66c

                                                                      SHA1

                                                                      dcde6527290a326e048f9c3a85280d3fa71e1e22

                                                                      SHA256

                                                                      b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

                                                                      SHA512

                                                                      92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

                                                                    • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

                                                                      Filesize

                                                                      4B

                                                                      MD5

                                                                      f49655f856acb8884cc0ace29216f511

                                                                      SHA1

                                                                      cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                                      SHA256

                                                                      7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                                      SHA512

                                                                      599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                                    • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

                                                                      Filesize

                                                                      1008B

                                                                      MD5

                                                                      d222b77a61527f2c177b0869e7babc24

                                                                      SHA1

                                                                      3f23acb984307a4aeba41ebbb70439c97ad1f268

                                                                      SHA256

                                                                      80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

                                                                      SHA512

                                                                      d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\60b902fe-728f-4aa1-a7a6-27b91cdabc4f.tmp

                                                                      Filesize

                                                                      9KB

                                                                      MD5

                                                                      b194a9240381c36d46aaeb0ebe6d52b0

                                                                      SHA1

                                                                      22255eaa6102a9bce42f9a43dd961dea0265b07e

                                                                      SHA256

                                                                      8eb9f6241a1e294771dda93c8467920c952d1fc76791bce10a70059b35d5b9cd

                                                                      SHA512

                                                                      85c729b6269af122511dff584e03d92d914490cb7018e277aa851723cc904d8b8e4bb8e837148e87721a9e190e9bb46bc9f4937f3c161898ede01eba8fdc3c60

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                                                      Filesize

                                                                      649B

                                                                      MD5

                                                                      570bc7dfa65a14ad27f6eb49a3264700

                                                                      SHA1

                                                                      26b89b7850d93c3561fc2c4acace3dd6c4c68edc

                                                                      SHA256

                                                                      c2340cc3364786eff3f764cb6da52ae50b0461b0b5b6e65d783e440f6cfc332d

                                                                      SHA512

                                                                      e67412814e668cfb3af88aaf4065f92779d0ca44c89cc8dd1651cb782bb4203a6439e543461b603e3d33fd4a7b072a79621f6309f1151a02ebb2773dd759fe1a

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                      Filesize

                                                                      2B

                                                                      MD5

                                                                      d751713988987e9331980363e24189ce

                                                                      SHA1

                                                                      97d170e1550eee4afc0af065b78cda302a97674c

                                                                      SHA256

                                                                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                      SHA512

                                                                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                      Filesize

                                                                      9KB

                                                                      MD5

                                                                      8dadc5096e83dbe40319a324da6bd611

                                                                      SHA1

                                                                      c86b9c56b06ec1f1373029a9ba19ac6135dc2de6

                                                                      SHA256

                                                                      621d121efa89dd257a442cf4a76bd9ed2ef0db42e0091d992279733e23ca3cc6

                                                                      SHA512

                                                                      37c198482451213d46e0627d42e61721044206523a4df8407d9312573f2a2903ea133cd840d252d9c17da732bb2c7dc0160fe69e95ae21070a222f763923ba77

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                      Filesize

                                                                      9KB

                                                                      MD5

                                                                      b5cb1321d99f3d90edf298041990ecef

                                                                      SHA1

                                                                      c7b125e3e1c86120303567cdfd504ce53a595db3

                                                                      SHA256

                                                                      e4792bbee8d4864bfb6049e315930250768737c33186c67dd7c42dcebbed519a

                                                                      SHA512

                                                                      833e550c835a647dee416de219774a0880fb8493246860293f2fd194ccf928bdd13a247cac167a8ff205a4b075237143453b78242614d52b8921c5ffceeeaa9f

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                      Filesize

                                                                      9KB

                                                                      MD5

                                                                      be7d55dc7c181826c7670f93dc265683

                                                                      SHA1

                                                                      d503df29df7829502bcc5923217631afee1e1a33

                                                                      SHA256

                                                                      3f2953ce9e1446ea19a71f612dac12dde418be3f57eb63397ea488103ed088db

                                                                      SHA512

                                                                      81f70b843e8b897ad2d5517d82285873ca2cd06022a98a47b405e98bf54f260bb934aecfc4375fbcb6930bca7021d0741e7df65264c360112583b10886d70b0d

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                      Filesize

                                                                      9KB

                                                                      MD5

                                                                      17a3bed1b2e883c46f10df374f3045ce

                                                                      SHA1

                                                                      c135d1de1f756573c25cacd36ba5a130af4d3468

                                                                      SHA256

                                                                      043dd72ca21bee9ad85205cbb0fd56e2d21251f4d4faf7c9ea7bbc79c6c81795

                                                                      SHA512

                                                                      3c22668f30c806e438399f730a799c3d7264806343fa80159de3918e52f6b3b6425c72717d139af06f832a1df063cd350f8cb54a0dddab9dadc50df29c93d3ee

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                      Filesize

                                                                      9KB

                                                                      MD5

                                                                      d9081275690b2d600258e3bb1b67c04e

                                                                      SHA1

                                                                      b2396bab7177fe3614d98fd01bbe51faa1f50f89

                                                                      SHA256

                                                                      2db8fc571ef427a04168157b3fe8547987acf57c52eaf8da8c06c806b24328e7

                                                                      SHA512

                                                                      4fbcc2e3a750615bd9a1d817426f21e5e4e1efe79ae01bbf02ec8c5dc2374e8be54e1e6c6c1256e2ab5abaffb9422610e633cf266a5b27fa5bcf09669054843a

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                      Filesize

                                                                      9KB

                                                                      MD5

                                                                      b1e4a1e06e20af1d2d0898ec44a81404

                                                                      SHA1

                                                                      6c9e2028a914efdf9723d663b2b926eed4c48de6

                                                                      SHA256

                                                                      1e8d6d0fc67db63fa4b637181b00450ab2efd52fce75cde6a28dca3f99ed63fd

                                                                      SHA512

                                                                      8cafaf29ff4993c84800aacd679918584374eb59cc15d4b159bdd392ac0947ad2fe76738a2eb1574284174ca261394ec4259a4dd3adf69ef4e7162b3258d58d2

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                      Filesize

                                                                      9KB

                                                                      MD5

                                                                      b840241cd93cf49e81f000e4670e8e4a

                                                                      SHA1

                                                                      15bbd90aae148f7fa556ef640b34e6a4c394ddf2

                                                                      SHA256

                                                                      b7a7324d923882246413c6358b84002fb930a5a8ea3ace03f249c3efaf51f033

                                                                      SHA512

                                                                      ea7500e7cb15c7c6df8e44841272ebefa709bfba95f22a8051dd1165ab06a60d0c040b85f7cbf344cdda0a0dac58e39799b70954ee3464192c3d6f775f5c9914

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                      Filesize

                                                                      9KB

                                                                      MD5

                                                                      31f3591544af5f3c75e854415178f245

                                                                      SHA1

                                                                      d9d15b10b27a7b7800c42bb0ccb21225cc9ab28f

                                                                      SHA256

                                                                      f79bc847d319bc09334e80cbe1a56f11a5840f3b0ab7e5faa0d02d52511d1b56

                                                                      SHA512

                                                                      cc4895756d7d50fcbe75ad1bb725f22b47d3228673be4649f95d698389badf847ee203fae324c28bbdd94af7cede3ac50dcb94f5249e3bbc419b7c5871277f42

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                      Filesize

                                                                      228KB

                                                                      MD5

                                                                      0c60691bff033445c78df4fa5e0a87b2

                                                                      SHA1

                                                                      29f5d59c520d084a9e404db4118cda8327c418de

                                                                      SHA256

                                                                      aa0dd927d8d14f9dcff9b16c6bd4c402a7484219d254a835a5c4cbdbcfb51709

                                                                      SHA512

                                                                      8574c30c2708b7a7aa9e1565e46f416cfee65a0f9feb6e57ea69d3654330bbd1ddf64baa907292c2f4216d78c84d50a2599619159a0c0ca59cd62c9432c320ee

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                      Filesize

                                                                      228KB

                                                                      MD5

                                                                      2c2659b06e182eb377e68416fa5fd800

                                                                      SHA1

                                                                      7e7e7ffa8805ca20e0b05ece6839270edb48cdf4

                                                                      SHA256

                                                                      f377becefa7742a04e729f41a3664a4aa7440440c1bf1c4e864fd4a04dfddfee

                                                                      SHA512

                                                                      ddeb3379af4b23bae49a01cf3d33fa50d848b7cc2ba91da5baad97464aab67973cbf7f9d331908a61a082201d675c9aad53157263884e8471af985d6778f71d8

                                                                    • C:\Users\Admin\Downloads\Unconfirmed 25351.crdownload

                                                                      Filesize

                                                                      2.4MB

                                                                      MD5

                                                                      a9bce7b69efbc8f396ff695dbdfb6ff1

                                                                      SHA1

                                                                      10e702a4aeec48609f923e4b7ab4ec3403f1f9da

                                                                      SHA256

                                                                      564c8bc367dbf80906a7cd4920020d4d9a39da3356a44685fb1cd827194b54cc

                                                                      SHA512

                                                                      770ff46f7ca82acad3f6a42eb7edcdfeef85965828ccd6f4667af3cc434d20610922541d5e13e4e4fb8573d76956624794960d879cb6e2dbbd3572ef198c2325

                                                                    • C:\Users\Admin\Downloads\Unconfirmed 315908.crdownload

                                                                      Filesize

                                                                      2.7MB

                                                                      MD5

                                                                      a4ddb99a8a8554287c4cbe126b6e60ba

                                                                      SHA1

                                                                      f3715cb4cbb306569b0246388c726286c12fe020

                                                                      SHA256

                                                                      39896f8ccb6eabe98fcf9df1c1a14aced08e0c0f728e5ed20cdf6b0ea9b52111

                                                                      SHA512

                                                                      bf8c51de6757906ca021213333d1cfd3f9649e5082704b3219f97b3ba7dbc734f80640df006e9e1f948c402a18ee79c819d0717bd6dbdb36c73dc589d1e00267

                                                                    • C:\Users\Admin\Downloads\Unconfirmed 454.crdownload

                                                                      Filesize

                                                                      2.4MB

                                                                      MD5

                                                                      f3592b115d8bb9456d4df62b6bccb1fc

                                                                      SHA1

                                                                      4735117d94b9eeb17494482e45f94da49a9626f4

                                                                      SHA256

                                                                      3ae55dcd519530d636089e72d71b08db1e36c8a7c4828cbff0e92fc1f50d7743

                                                                      SHA512

                                                                      99ce703be1e932339cbba6e4e1cd3838267c4078aad6d619eadd1702615d6e09245b895e7a6e35b2254bfdb1b25603fd46e0bcf820f6cf692699a2fc8a71a3e6

                                                                    • C:\Users\Admin\Downloads\Unconfirmed 872225.crdownload

                                                                      Filesize

                                                                      2.1MB

                                                                      MD5

                                                                      a70cbe2a2cee4ae998c5737fd3a9c178

                                                                      SHA1

                                                                      03a42adf13bfa7dd19f1a2b17265fa6d68685fd3

                                                                      SHA256

                                                                      eefc72341a7c1cd9fe6a8c5ec186e24523b79c33307a2030302a6a61dcb75bea

                                                                      SHA512

                                                                      0ea2a9126d0f17f4f962d020878b5b4cb36c93346847a8d52c38e53211309cd4e94fd1cd68f012296901ca5877d4f7a6e60be554c1ef3da77876858602fc010c

                                                                    • C:\Users\Admin\Downloads\Unconfirmed 882853.crdownload

                                                                      Filesize

                                                                      1.9MB

                                                                      MD5

                                                                      313413036de12b91325e9cbdecb5e51b

                                                                      SHA1

                                                                      c3087969aa2da602ee83e3ca94557031e32239f8

                                                                      SHA256

                                                                      1ee681cdaabbfc5303f224ecd6773641816712621aaa4b4a039564c2f580d58b

                                                                      SHA512

                                                                      18faf36c3da2a10f427409b4f56d32640d688662b0666a3e4350aef37b55975d59dc85f469ffa056912427e53d1badf19a496b32cace74b89ee8ae477bfd7150

                                                                    • C:\Users\Admin\Downloads\Unconfirmed 979782.crdownload

                                                                      Filesize

                                                                      2.6MB

                                                                      MD5

                                                                      d876a770d13e15272c93e7da0531ba42

                                                                      SHA1

                                                                      816314bb08550b0a8b4a10a056a88c2c4d4047fd

                                                                      SHA256

                                                                      e4238dcbc33d3563984a285d6c184b5330b033108fac9e178d6668dd8536ca73

                                                                      SHA512

                                                                      101fce11608e6a9169e5ba50ba60866ce03f69a96e20d582d1f50a34ba40cc1302a1f9286c5923782efc830c8e0e49ed1ebbd087b2e1a109c41b622f4ac3f7e7

                                                                    • C:\Users\Admin\Downloads\antifekas.dll

                                                                      Filesize

                                                                      16.3MB

                                                                      MD5

                                                                      b2ff64181eb48491691a5da9ca1e9ca4

                                                                      SHA1

                                                                      f1cb605eb411175a0af2e3acf5d261f07779b426

                                                                      SHA256

                                                                      55baae63fcf17088f7a9ab5aafed2f4429c5f43420e5e1d812a7387c02231a08

                                                                      SHA512

                                                                      a2f872189db6f5fd3162848f3b813ad9784f0cd009d45e9fe56b83fd7390794c6839bf1c2ab93bdc8551ed2e7147740052f292aaa57c768953c2c6925ea19409

                                                                    • C:\Users\Admin\Downloads\antifekas.exe:Zone.Identifier

                                                                      Filesize

                                                                      26B

                                                                      MD5

                                                                      fbccf14d504b7b2dbcb5a5bda75bd93b

                                                                      SHA1

                                                                      d59fc84cdd5217c6cf74785703655f78da6b582b

                                                                      SHA256

                                                                      eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                                                      SHA512

                                                                      aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                                                    • C:\Users\Admin\Downloads\bl.exe

                                                                      Filesize

                                                                      2.6MB

                                                                      MD5

                                                                      6d2ea829eb24d9ebd78d919e45c158c1

                                                                      SHA1

                                                                      2b707588148577a0f32b2009ab549c35078c8888

                                                                      SHA256

                                                                      f47cbf4e49562a28fbb908b7446b7f3a7c9869ae2bb4f72fd085191b09c87211

                                                                      SHA512

                                                                      3f1fed3680901b8dd69dbc0ce657e5e284d33e6e80b5e7a6f7b9e2c231a3c898c8d6946dfddfd82d1a08cbdca713bc7da7d057198629d52158c2a06243157172

                                                                    • C:\Users\Admin\Downloads\kirogga.exe:Zone.Identifier

                                                                      Filesize

                                                                      65B

                                                                      MD5

                                                                      d158c80d2cdc73264899d0031d8a8621

                                                                      SHA1

                                                                      51d5bf5728c1887fb6a70448a61241510176c7a6

                                                                      SHA256

                                                                      044bc655236b03e24ce25999597ddadab844792192bd9931a9568bf558e20a18

                                                                      SHA512

                                                                      692c8d27791fde9cc08f6aff958a518b2b607e7a34ae7bc303fc73e9305909c9ae28c8bb831cc4849dce6a0793a317fcf1645d78e861334fd05193f551571806

                                                                    • C:\Users\Admin\Downloads\soto.exe

                                                                      Filesize

                                                                      2.1MB

                                                                      MD5

                                                                      faf905dfc0d7d16f9e923144b0906b7e

                                                                      SHA1

                                                                      64b458f200181c2ade34dc55afe70fd17eecae75

                                                                      SHA256

                                                                      099196bded5b2d89f27a53b9f0fdaaf84d1092225b3079d37421d71e116c5d0a

                                                                      SHA512

                                                                      47bab36d31059029c2ec8e6d0cddf0fbe577bcc34549b095c194880aad5cb71f5c2aace19cb265c4493db6694a3df620284095838542967ac82ff0016e7279b4

                                                                    • memory/1184-106-0x00007FF7E3C53000-0x00007FF7E3C56000-memory.dmp

                                                                      Filesize

                                                                      12KB

                                                                    • memory/1184-135-0x00007FF7E3C53000-0x00007FF7E3C56000-memory.dmp

                                                                      Filesize

                                                                      12KB

                                                                    • memory/4028-85-0x00007FF761830000-0x00007FF761A5C000-memory.dmp

                                                                      Filesize

                                                                      2.2MB

                                                                    • memory/4028-71-0x00007FF761830000-0x00007FF761A5C000-memory.dmp

                                                                      Filesize

                                                                      2.2MB

                                                                    • memory/4028-88-0x00007FF761830000-0x00007FF761A5C000-memory.dmp

                                                                      Filesize

                                                                      2.2MB

                                                                    • memory/4028-87-0x00007FF761830000-0x00007FF761A5C000-memory.dmp

                                                                      Filesize

                                                                      2.2MB

                                                                    • memory/4028-86-0x00007FF761830000-0x00007FF761A5C000-memory.dmp

                                                                      Filesize

                                                                      2.2MB

                                                                    • memory/4028-133-0x00007FF7619F3000-0x00007FF7619F6000-memory.dmp

                                                                      Filesize

                                                                      12KB

                                                                    • memory/4028-75-0x00007FF7619F3000-0x00007FF7619F6000-memory.dmp

                                                                      Filesize

                                                                      12KB

                                                                    • memory/4028-90-0x00007FF761830000-0x00007FF761A5C000-memory.dmp

                                                                      Filesize

                                                                      2.2MB

                                                                    • memory/4028-134-0x00007FF761830000-0x00007FF761A5C000-memory.dmp

                                                                      Filesize

                                                                      2.2MB

                                                                    • memory/4028-68-0x00007FF761830000-0x00007FF761A5C000-memory.dmp

                                                                      Filesize

                                                                      2.2MB

                                                                    • memory/4028-65-0x00007FF761830000-0x00007FF761A5C000-memory.dmp

                                                                      Filesize

                                                                      2.2MB

                                                                    • memory/4028-62-0x00007FF761830000-0x00007FF761A5C000-memory.dmp

                                                                      Filesize

                                                                      2.2MB

                                                                    • memory/4028-59-0x00007FF761830000-0x00007FF761A5C000-memory.dmp

                                                                      Filesize

                                                                      2.2MB

                                                                    • memory/4028-57-0x000001F3C8F70000-0x000001F3C8F71000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/4028-56-0x00007FF7619F3000-0x00007FF7619F6000-memory.dmp

                                                                      Filesize

                                                                      12KB