Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/11/2024, 23:55
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
General
-
Target
file.exe
-
Size
3.1MB
-
MD5
df3fc9d0e3234bec4a4a21004056d0e3
-
SHA1
3a689c14f50b7569fd3452e640c53cd9b7c173b2
-
SHA256
72e18d1f94925f558f47baf67848e00775a07622df025ebce3c1264296d6d44e
-
SHA512
4190a7991d8f1ac68eb19ccd53ecbb0fe39fcb9b0c590aebecf5fc8c879b47bef639cf7882d9a120209bc60ef649c77a36289a84a3830b03243dc722670b9121
-
SSDEEP
49152:Nx4TiaIdRZA4sxc8K3ZVrTy996ouxTYZNJfYd2ysTv2:N+OPrm4sxnK3ZVrTyPICTJfYd2f2
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
stealc
tale
http://185.215.113.206
-
url_path
/6c4adf523b719729.php
Extracted
lumma
https://founpiuer.store/api
Signatures
-
Amadey family
-
Lumma family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 0e767db2ea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 0e767db2ea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 0e767db2ea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 0e767db2ea.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 0e767db2ea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 0e767db2ea.exe -
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ file.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Set-up.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 32ef5fca90.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 9b7c93babb.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 0e767db2ea.exe -
Downloads MZ/PE file
-
Uses browser remote debugging 2 TTPs 4 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 352 chrome.exe 2148 chrome.exe 2424 chrome.exe 828 chrome.exe -
Checks BIOS information in registry 2 TTPs 14 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Set-up.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 9b7c93babb.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 32ef5fca90.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 32ef5fca90.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 9b7c93babb.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 0e767db2ea.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Set-up.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 0e767db2ea.exe -
Executes dropped EXE 9 IoCs
pid Process 2112 skotes.exe 2812 freecam.exe 1908 Set-up.exe 2240 32ef5fca90.exe 1564 9b7c93babb.exe 872 skotes.exe 2676 0e767db2ea.exe 2316 service123.exe 1960 service123.exe -
Identifies Wine through registry keys 2 TTPs 7 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine 0e767db2ea.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine file.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine Set-up.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine 32ef5fca90.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine 9b7c93babb.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine skotes.exe -
Loads dropped DLL 17 IoCs
pid Process 2532 file.exe 2112 skotes.exe 2112 skotes.exe 2112 skotes.exe 2112 skotes.exe 2112 skotes.exe 2112 skotes.exe 2112 skotes.exe 2112 skotes.exe 2112 skotes.exe 1908 Set-up.exe 1908 Set-up.exe 1388 WerFault.exe 1388 WerFault.exe 1388 WerFault.exe 2316 service123.exe 1960 service123.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 0e767db2ea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 0e767db2ea.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\32ef5fca90.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004232001\\32ef5fca90.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\9b7c93babb.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004233001\\9b7c93babb.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\0e767db2ea.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004235001\\0e767db2ea.exe" skotes.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
pid Process 2532 file.exe 2112 skotes.exe 1908 Set-up.exe 2240 32ef5fca90.exe 1564 9b7c93babb.exe 872 skotes.exe 2676 0e767db2ea.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2112 set thread context of 872 2112 skotes.exe 38 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job file.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1388 1908 WerFault.exe 34 -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0e767db2ea.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language freecam.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32ef5fca90.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9b7c93babb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Set-up.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Set-up.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Set-up.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1364 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2532 file.exe 2112 skotes.exe 1908 Set-up.exe 2240 32ef5fca90.exe 1564 9b7c93babb.exe 872 skotes.exe 2676 0e767db2ea.exe 2676 0e767db2ea.exe 2676 0e767db2ea.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2676 0e767db2ea.exe Token: SeShutdownPrivilege 352 chrome.exe Token: SeShutdownPrivilege 352 chrome.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 2532 file.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe 352 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2532 wrote to memory of 2112 2532 file.exe 30 PID 2532 wrote to memory of 2112 2532 file.exe 30 PID 2532 wrote to memory of 2112 2532 file.exe 30 PID 2532 wrote to memory of 2112 2532 file.exe 30 PID 2112 wrote to memory of 2812 2112 skotes.exe 33 PID 2112 wrote to memory of 2812 2112 skotes.exe 33 PID 2112 wrote to memory of 2812 2112 skotes.exe 33 PID 2112 wrote to memory of 2812 2112 skotes.exe 33 PID 2112 wrote to memory of 1908 2112 skotes.exe 34 PID 2112 wrote to memory of 1908 2112 skotes.exe 34 PID 2112 wrote to memory of 1908 2112 skotes.exe 34 PID 2112 wrote to memory of 1908 2112 skotes.exe 34 PID 2112 wrote to memory of 2240 2112 skotes.exe 35 PID 2112 wrote to memory of 2240 2112 skotes.exe 35 PID 2112 wrote to memory of 2240 2112 skotes.exe 35 PID 2112 wrote to memory of 2240 2112 skotes.exe 35 PID 2112 wrote to memory of 1564 2112 skotes.exe 37 PID 2112 wrote to memory of 1564 2112 skotes.exe 37 PID 2112 wrote to memory of 1564 2112 skotes.exe 37 PID 2112 wrote to memory of 1564 2112 skotes.exe 37 PID 2112 wrote to memory of 872 2112 skotes.exe 38 PID 2112 wrote to memory of 872 2112 skotes.exe 38 PID 2112 wrote to memory of 872 2112 skotes.exe 38 PID 2112 wrote to memory of 872 2112 skotes.exe 38 PID 2112 wrote to memory of 872 2112 skotes.exe 38 PID 2112 wrote to memory of 872 2112 skotes.exe 38 PID 2112 wrote to memory of 872 2112 skotes.exe 38 PID 2112 wrote to memory of 872 2112 skotes.exe 38 PID 2112 wrote to memory of 872 2112 skotes.exe 38 PID 2112 wrote to memory of 872 2112 skotes.exe 38 PID 2112 wrote to memory of 872 2112 skotes.exe 38 PID 2112 wrote to memory of 872 2112 skotes.exe 38 PID 2112 wrote to memory of 2676 2112 skotes.exe 39 PID 2112 wrote to memory of 2676 2112 skotes.exe 39 PID 2112 wrote to memory of 2676 2112 skotes.exe 39 PID 2112 wrote to memory of 2676 2112 skotes.exe 39 PID 1908 wrote to memory of 352 1908 Set-up.exe 40 PID 1908 wrote to memory of 352 1908 Set-up.exe 40 PID 1908 wrote to memory of 352 1908 Set-up.exe 40 PID 1908 wrote to memory of 352 1908 Set-up.exe 40 PID 352 wrote to memory of 892 352 chrome.exe 41 PID 352 wrote to memory of 892 352 chrome.exe 41 PID 352 wrote to memory of 892 352 chrome.exe 41 PID 352 wrote to memory of 1768 352 chrome.exe 42 PID 352 wrote to memory of 1768 352 chrome.exe 42 PID 352 wrote to memory of 1768 352 chrome.exe 42 PID 352 wrote to memory of 2444 352 chrome.exe 43 PID 352 wrote to memory of 2444 352 chrome.exe 43 PID 352 wrote to memory of 2444 352 chrome.exe 43 PID 352 wrote to memory of 2444 352 chrome.exe 43 PID 352 wrote to memory of 2444 352 chrome.exe 43 PID 352 wrote to memory of 2444 352 chrome.exe 43 PID 352 wrote to memory of 2444 352 chrome.exe 43 PID 352 wrote to memory of 2444 352 chrome.exe 43 PID 352 wrote to memory of 2444 352 chrome.exe 43 PID 352 wrote to memory of 2444 352 chrome.exe 43 PID 352 wrote to memory of 2444 352 chrome.exe 43 PID 352 wrote to memory of 2444 352 chrome.exe 43 PID 352 wrote to memory of 2444 352 chrome.exe 43 PID 352 wrote to memory of 2444 352 chrome.exe 43 PID 352 wrote to memory of 2444 352 chrome.exe 43 PID 352 wrote to memory of 2444 352 chrome.exe 43 PID 352 wrote to memory of 2444 352 chrome.exe 43 PID 352 wrote to memory of 2444 352 chrome.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\1004149001\freecam.exe"C:\Users\Admin\AppData\Local\Temp\1004149001\freecam.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2812
-
-
C:\Users\Admin\AppData\Local\Temp\1004211001\Set-up.exe"C:\Users\Admin\AppData\Local\Temp\1004211001\Set-up.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"4⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:352 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6c89758,0x7fef6c89768,0x7fef6c897785⤵PID:892
-
-
C:\Windows\system32\ctfmon.exectfmon.exe5⤵PID:1768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1080 --field-trial-handle=1212,i,9734804157274461947,13086536988446409132,131072 /prefetch:25⤵PID:2444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1212,i,9734804157274461947,13086536988446409132,131072 /prefetch:85⤵PID:1620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1576 --field-trial-handle=1212,i,9734804157274461947,13086536988446409132,131072 /prefetch:85⤵PID:1264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2272 --field-trial-handle=1212,i,9734804157274461947,13086536988446409132,131072 /prefetch:15⤵
- Uses browser remote debugging
PID:2424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2304 --field-trial-handle=1212,i,9734804157274461947,13086536988446409132,131072 /prefetch:15⤵
- Uses browser remote debugging
PID:2148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1456 --field-trial-handle=1212,i,9734804157274461947,13086536988446409132,131072 /prefetch:25⤵PID:2792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1412 --field-trial-handle=1212,i,9734804157274461947,13086536988446409132,131072 /prefetch:15⤵
- Uses browser remote debugging
PID:828
-
-
-
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1364
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 9644⤵
- Loads dropped DLL
- Program crash
PID:1388
-
-
-
C:\Users\Admin\AppData\Local\Temp\1004232001\32ef5fca90.exe"C:\Users\Admin\AppData\Local\Temp\1004232001\32ef5fca90.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2240
-
-
C:\Users\Admin\AppData\Local\Temp\1004233001\9b7c93babb.exe"C:\Users\Admin\AppData\Local\Temp\1004233001\9b7c93babb.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1564
-
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:872
-
-
C:\Users\Admin\AppData\Local\Temp\1004235001\0e767db2ea.exe"C:\Users\Admin\AppData\Local\Temp\1004235001\0e767db2ea.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2136
-
C:\Windows\system32\taskeng.exetaskeng.exe {8BE4652B-4E6A-43DD-9B00-4C2848530604} S-1-5-21-2872745919-2748461613-2989606286-1000:CCJBVTGQ\Admin:Interactive:[1]1⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1960
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Authentication Process
1Modify Registry
3Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
12.9MB
MD5704d12a2e64a9b3ebe375594a11f3ee6
SHA1e6e45cd1926de46bfa0832de19ddeb29c8c0f629
SHA256b5975c9eb7e34161ae63eab8518b130d4fdcc1526ca512d2e5452c6d701fe912
SHA512b72689628014a48976672427d0470d8e024dac4d3b266bc9398a8dadd72f1b4d4dc1a4429847a45956ae604cf072cf5419cf3036a4e6d5373517db38a9d3ffb4
-
Filesize
4.2MB
MD5e61852d0a596d91897c3e731f18b4ae7
SHA1fa10a42495e023ae6cbd464842352cccf0d0ee28
SHA25616606d62af0e28e4c9359802f1e9f329eae01edee0b31b8b84b0fbc51818a129
SHA512c47dc92cd52c0efec3c993812965ad74a710ce8600f069d6d7d18c04e777682a2c77881a61443f9f4c425c79627ab6d06db0461f0622d1f0c6414eca2215a310
-
Filesize
3.0MB
MD54ac1e252c1765c62a40fa7b7be66983b
SHA1a5e1fd72c8dbe6a1e05f64093aaa1bd7d3639c95
SHA256516da3eed4c8dafd588727f02920aca4b47f2318e378a7f0130a419e9f74b6b3
SHA512cd3639602a573678fbc9757336c6ebcf903c180312fa19b1ad3f4e76a5d90eb9fffc6902699620d479094f920dbe637f6d4ef8fddf653952910093fc2d7b3a36
-
Filesize
2.0MB
MD5528a74ec51b95f19a5d1b00df07bc6cc
SHA1a4f8523d03455ddea5acaacbc509338038600081
SHA25684d88a7533316a280ea2a732b8949bc70a5a30875fbeb524e4eed526db83b97d
SHA5128c990976aade9a4f80d55a3923f5b6b4cd331a8ab570c9f8666823599af42317841587db7799f72d59e0aee1b38fb0cd6571d0d54aa021cb1e06d5bfcf7c497f
-
Filesize
2.6MB
MD5ae6af6ca15feec9a0d65f7ea6369adee
SHA1f3102944f0dfce4dbebdc17a2a8abeb2990299c6
SHA2567d2da9cbbba1df44a3744d1c939c312b1a3be5032e7ee9c23a70ce6df0590d33
SHA512edd392c5dd211fd227005e822c809e95a0dfc59cf3a5a9bd115a106873c80b340af776b1b4ba6001b66abd497537d87ba13a42b232962f2ce5a626a24d261d6e
-
Filesize
3.1MB
MD5df3fc9d0e3234bec4a4a21004056d0e3
SHA13a689c14f50b7569fd3452e640c53cd9b7c173b2
SHA25672e18d1f94925f558f47baf67848e00775a07622df025ebce3c1264296d6d44e
SHA5124190a7991d8f1ac68eb19ccd53ecbb0fe39fcb9b0c590aebecf5fc8c879b47bef639cf7882d9a120209bc60ef649c77a36289a84a3830b03243dc722670b9121