39c853575cbe6aa8343e8616cfc22c2dfdad567f78b5aee8e65f38423ebe10e3

Analysis

max time kernel
95s
max time network
149s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 17:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sysfgdrvs.exe
Size

76KB
MD5

5db9a00364b3c87e0bc4c52d3fbda13d
SHA1

f2e1f784019db62dd2866295499650a2a7d629dd
SHA256

39c853575cbe6aa8343e8616cfc22c2dfdad567f78b5aee8e65f38423ebe10e3
SHA512

7b472c384b011b24c8d4b0c7b67cc08f9708fee30bcbc38c93188064d1795ba581177cfbdd2f03d5a6f07c7ea4251c934f67710ade09ab04e9cb3884db94ef70
SSDEEP

1536:e3Mz8WzKcG6EBACCUDqgorWZK+DldD5Fw0F36:lwWWB0Aqg6WPpdD5Fwc6

Score

10^/10

discovery evasion trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysfgdrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysfgdrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysfgdrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysfgdrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysfgdrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysfgdrvs.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysfgdrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysfgdrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysfgdrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysfgdrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysfgdrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysfgdrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysfgdrvs.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysfgdrvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2652	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
3064	chrome.exe
3064	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
648	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	648	taskmgr.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: 33	1740	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1740	AUDIODG.EXE
Token: 33	1740	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1740	AUDIODG.EXE
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
648	taskmgr.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2652	EXCEL.EXE
2652	EXCEL.EXE
2652	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2984	3064	chrome.exe	35
PID 3064 wrote to memory of 2984	3064	chrome.exe	35
PID 3064 wrote to memory of 2984	3064	chrome.exe	35
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2512	3064	chrome.exe	37
PID 3064 wrote to memory of 2288	3064	chrome.exe	38
PID 3064 wrote to memory of 2288	3064	chrome.exe	38
PID 3064 wrote to memory of 2288	3064	chrome.exe	38
PID 3064 wrote to memory of 760	3064	chrome.exe	39
PID 3064 wrote to memory of 760	3064	chrome.exe	39
PID 3064 wrote to memory of 760	3064	chrome.exe	39
PID 3064 wrote to memory of 760	3064	chrome.exe	39
PID 3064 wrote to memory of 760	3064	chrome.exe	39
PID 3064 wrote to memory of 760	3064	chrome.exe	39
PID 3064 wrote to memory of 760	3064	chrome.exe	39
PID 3064 wrote to memory of 760	3064	chrome.exe	39
PID 3064 wrote to memory of 760	3064	chrome.exe	39
PID 3064 wrote to memory of 760	3064	chrome.exe	39
PID 3064 wrote to memory of 760	3064	chrome.exe	39
PID 3064 wrote to memory of 760	3064	chrome.exe	39
PID 3064 wrote to memory of 760	3064	chrome.exe	39
PID 3064 wrote to memory of 760	3064	chrome.exe	39
PID 3064 wrote to memory of 760	3064	chrome.exe	39
PID 3064 wrote to memory of 760	3064	chrome.exe	39
PID 3064 wrote to memory of 760	3064	chrome.exe	39
PID 3064 wrote to memory of 760	3064	chrome.exe	39
PID 3064 wrote to memory of 760	3064	chrome.exe	39

C:\Users\Admin\AppData\Local\Temp\sysfgdrvs.exe
"C:\Users\Admin\AppData\Local\Temp\sysfgdrvs.exe"
1⤵
- Windows security bypass
- Windows security modification
- System Location Discovery: System Language Discovery
PID:1488

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:648

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2652

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6fb9758,0x7fef6fb9768,0x7fef6fb9778
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1192 --field-trial-handle=1312,i,11942654054615770238,6543708971045020474,131072 /prefetch:2
  2⤵
  PID:2512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1544 --field-trial-handle=1312,i,11942654054615770238,6543708971045020474,131072 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 --field-trial-handle=1312,i,11942654054615770238,6543708971045020474,131072 /prefetch:8
  2⤵
  PID:760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2228 --field-trial-handle=1312,i,11942654054615770238,6543708971045020474,131072 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2240 --field-trial-handle=1312,i,11942654054615770238,6543708971045020474,131072 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1188 --field-trial-handle=1312,i,11942654054615770238,6543708971045020474,131072 /prefetch:2
  2⤵
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3272 --field-trial-handle=1312,i,11942654054615770238,6543708971045020474,131072 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3516 --field-trial-handle=1312,i,11942654054615770238,6543708971045020474,131072 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1316 --field-trial-handle=1312,i,11942654054615770238,6543708971045020474,131072 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:2488
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13ff97688,0x13ff97698,0x13ff976a8
    3⤵
    PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2768 --field-trial-handle=1312,i,11942654054615770238,6543708971045020474,131072 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3768 --field-trial-handle=1312,i,11942654054615770238,6543708971045020474,131072 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2772 --field-trial-handle=1312,i,11942654054615770238,6543708971045020474,131072 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2236 --field-trial-handle=1312,i,11942654054615770238,6543708971045020474,131072 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=1312,i,11942654054615770238,6543708971045020474,131072 /prefetch:8
  2⤵
  PID:2172

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1680

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x450
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\Application\SetupMetrics\20241018173504.pma

Filesize
488B

MD5
6d971ce11af4a6a93a4311841da1a178

SHA1
cbfdbc9b184f340cbad764abc4d8a31b9c250176

SHA256
338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783

SHA512
c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\60f7e1fe-3887-4368-9c15-05087deede76.tmp

Filesize
352KB

MD5
c138e337ffe8be1652fb589e511ac53b

SHA1
44cf2e8486c76b38a6cc763b9cb3de1ab072724b

SHA256
fdf030cd7248d32b7e7fd34a6511dbde01b6b2edc322542f1ddde61102d77f1f

SHA512
6d5a61a0ffc926eae3dae169dbaff2c2bd8d3c9bce6c153d30ec2d205e3f360b5b0d6abc0ca1f436023616735ffe4e3a272b608d7f6ea60b3f442666bec52101

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
361B

MD5
e49db5438b8f176114d863e7925ef222

SHA1
9ced4a072428d7960ed1de145638d4957714009e

SHA256
4d3d6cfa2e3ad25ea92ae3e91265bfbddde4f3ff7cedb9d8402b9a6a483ba590

SHA512
4ee7d6b82b720edfd189b2076fcb1e700c63a5f93aa4f093c8bdd53c950d22bd5e3258f6e5a2be2139aafe75c572df1c4e4326749d84c98efffe1f672e0a5506

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
b7be4b6a8a023adf1fd56172758f7d30

SHA1
47cd0bc215a5d998daf832809b2e314ce527b279

SHA256
2b27bfe548669904472677ac85b088eb9fc9177028d4e5ce453ee2ee82e5ab91

SHA512
c3319f74d1449a480fcd40caa0127f00ab84fa51c78f7c33c85c1fd27fbc2f7f824a712d4eb4f876013469cfb71bce7e6ef34a64ee9336c27e98803e997435ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
2b22b3f3665f9e64e1d6bbe408fe6164

SHA1
1db267eb6641c1f87851ce1cd19ba2d70265c23d

SHA256
f4108df3610aa769613edd5ee06c40041f4fdb0fda9a45bc6c63ac90142ab321

SHA512
78d46fa65b49c1c9e858e1f3994b7c27fc3bb1e7cbdc45806a6e2d917351e4c75074c3f8134136eb2a71d04da8fa5396e5a5c6ea4509cedecf453acf356c84f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
352KB

MD5
e4c3c9bf3093f6ace9342e93d981616c

SHA1
a56be3407cb08cc8328a36f7a5ea338a795d998c

SHA256
5f13e0b349e9721e0c6c265dd4219cff5b55b615206300e57b59ebd1c411de87

SHA512
c1cc0e2b5971fc1abfa8bcdf9ebea1a01b2851f7f547b898a12bc4a3652e7b9eba3de6a2bdfc72461b6fe21bff68b5a888fcf8504fa2461c99021e45b04e0165

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
177KB

MD5
c851f0d08468f731ec272f01744311f4

SHA1
484b1044289521e8521d5ebe0d72fae8a842ed95

SHA256
216544c89561dd01c34d95ffcb5a10783fc2869cc879b29a23b2b59aea0b09a7

SHA512
23bb3f6337b9763bcd43d8f887b0f82e84cdf1bae1a818ce26103089ab64dd47ce1198303bbd35253b0a378fd8a17e8ba8a98a58dc719e63854ae6be8cb2598b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K0PVW9XR\1[1]

Filesize
108KB

MD5
1fcb78fb6cf9720e9d9494c42142d885

SHA1
fef9c2e728ab9d56ce9ed28934b3182b6f1d5379

SHA256
84652bb8c63ca4fd7eb7a2d6ef44029801f3057aa2961867245a3a765928dd02

SHA512
cdf58e463af1784aea86995b3e5d6b07701c5c4095e30ec80cc901ffd448c6f4f714c521bf8796ffa8c47538bf8bf5351e157596efaa7ab88155d63dc33f7dc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RLHRIIGD\2[1]

Filesize
86KB

MD5
fe1e93f12cca3f7c0c897ef2084e1778

SHA1
fb588491ddad8b24ea555a6a2727e76cec1fade3

SHA256
2ebc4a92f4fdc27d4ab56e57058575a8b18adb076cbd30feea2ecdc8b7fcd41f

SHA512
36e0524c465187ae9ad207c724aee45bcd61cfd3fa66a79f9434d24fcbadc0a743834d5e808e6041f3bd88e75deb5afd34193574f005ed97e4b17c6b0388cb93

Download Submit
memory/648-5-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/648-16-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2652-30-0x000000007287D000-0x0000000072888000-memory.dmp

Filesize
44KB

Download
memory/2652-29-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2652-17-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2652-18-0x000000007287D000-0x0000000072888000-memory.dmp

Filesize
44KB

Download