hxxps://cdn[.]discordapp[.]com/attachments/1163199352223842404/1304946588145287209/content_v2[.]gdata?ex=67313db7&is=672fec37&hm=02226516899f12b21b2eef6843d57be83aa56e5ba4f120ebdb3273fca83ac0a0&

Analysis

max time kernel
55s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 23:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1163199352223842404/1304946588145287209/content_v2.gdata?ex=67313db7&is=672fec37&hm=02226516899f12b21b2eef6843d57be83aa56e5ba4f120ebdb3273fca83ac0a0&
Sample241109-3kl12svclc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = dc4fbf7bd218db01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "425793611"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31142656"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{42771AA9-9EF3-11EF-AEE2-F6235BFAC6D3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{8645415B-DF49-4608-9DD8-E70AC08127A4}"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "425793611"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31142656"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133756688978986733"	chrome.exe

Modifies registry class 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\gdata_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\.gdata\ = "gdata_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\gdata_auto_file\shell\edit	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\gdata_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\.gdata	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\gdata_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\gdata_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\gdata_auto_file\shell\edit\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\gdata_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\gdata_auto_file\shell\open\command	OpenWith.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
744	NOTEPAD.EXE
2432	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3004	chrome.exe
3004	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3532	OpenWith.exe
1460	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3004	chrome.exe
3004	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
4272	iexplore.exe
4272	iexplore.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe

Suspicious use of SetWindowsHookEx 40 IoCs

pid	Process
3532	OpenWith.exe
3532	OpenWith.exe
3532	OpenWith.exe
3532	OpenWith.exe
3532	OpenWith.exe
3532	OpenWith.exe
3532	OpenWith.exe
3532	OpenWith.exe
3532	OpenWith.exe
3532	OpenWith.exe
3532	OpenWith.exe
3532	OpenWith.exe
3532	OpenWith.exe
3532	OpenWith.exe
3532	OpenWith.exe
3532	OpenWith.exe
3532	OpenWith.exe
3532	OpenWith.exe
3532	OpenWith.exe
4272	iexplore.exe
4272	iexplore.exe
3124	IEXPLORE.EXE
3124	IEXPLORE.EXE
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 1004	3004	chrome.exe	83
PID 3004 wrote to memory of 1004	3004	chrome.exe	83
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2296	3004	chrome.exe	84
PID 3004 wrote to memory of 2292	3004	chrome.exe	85
PID 3004 wrote to memory of 2292	3004	chrome.exe	85
PID 3004 wrote to memory of 3760	3004	chrome.exe	86
PID 3004 wrote to memory of 3760	3004	chrome.exe	86
PID 3004 wrote to memory of 3760	3004	chrome.exe	86
PID 3004 wrote to memory of 3760	3004	chrome.exe	86
PID 3004 wrote to memory of 3760	3004	chrome.exe	86
PID 3004 wrote to memory of 3760	3004	chrome.exe	86
PID 3004 wrote to memory of 3760	3004	chrome.exe	86
PID 3004 wrote to memory of 3760	3004	chrome.exe	86
PID 3004 wrote to memory of 3760	3004	chrome.exe	86
PID 3004 wrote to memory of 3760	3004	chrome.exe	86
PID 3004 wrote to memory of 3760	3004	chrome.exe	86
PID 3004 wrote to memory of 3760	3004	chrome.exe	86
PID 3004 wrote to memory of 3760	3004	chrome.exe	86
PID 3004 wrote to memory of 3760	3004	chrome.exe	86
PID 3004 wrote to memory of 3760	3004	chrome.exe	86
PID 3004 wrote to memory of 3760	3004	chrome.exe	86
PID 3004 wrote to memory of 3760	3004	chrome.exe	86
PID 3004 wrote to memory of 3760	3004	chrome.exe	86
PID 3004 wrote to memory of 3760	3004	chrome.exe	86
PID 3004 wrote to memory of 3760	3004	chrome.exe	86
PID 3004 wrote to memory of 3760	3004	chrome.exe	86
PID 3004 wrote to memory of 3760	3004	chrome.exe	86
PID 3004 wrote to memory of 3760	3004	chrome.exe	86
PID 3004 wrote to memory of 3760	3004	chrome.exe	86
PID 3004 wrote to memory of 3760	3004	chrome.exe	86
PID 3004 wrote to memory of 3760	3004	chrome.exe	86
PID 3004 wrote to memory of 3760	3004	chrome.exe	86
PID 3004 wrote to memory of 3760	3004	chrome.exe	86
PID 3004 wrote to memory of 3760	3004	chrome.exe	86
PID 3004 wrote to memory of 3760	3004	chrome.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1163199352223842404/1304946588145287209/content_v2.gdata?ex=67313db7&is=672fec37&hm=02226516899f12b21b2eef6843d57be83aa56e5ba4f120ebdb3273fca83ac0a0&
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe1fe7cc40,0x7ffe1fe7cc4c,0x7ffe1fe7cc58
  2⤵
  PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1864,i,2648326300681372664,12090976743724942923,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1860 /prefetch:2
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2136,i,2648326300681372664,12090976743724942923,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2244,i,2648326300681372664,12090976743724942923,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2412 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3104,i,2648326300681372664,12090976743724942923,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3116 /prefetch:1
  2⤵
  PID:208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3120,i,2648326300681372664,12090976743724942923,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4460,i,2648326300681372664,12090976743724942923,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4664 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4936,i,2648326300681372664,12090976743724942923,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:4336

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:936

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3532
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\content_v2.gdata
  2⤵
  - Modifies Internet Explorer Phishing Filter
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:4272
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4272 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3124

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1460
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\content_v2.gdata
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:744

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4280

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\content_v2.gdata
1⤵
- Opens file in notepad (likely ransom note)
PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 87cf25ab79f4a4d95f6ba6736a433191182e5dc6eca5a845359fb5042bb43ab7
MD5 05b57028a5c87933a4e088e306360213
SHA1 058b89cad823164b88af244416bab94d76cefdc0
SHA512 6760e172d693e12dfb685a2f4812468fb08e45aedc6ac7f860c47a99e84b694fbc737c440d2febf289b5c60b8d38b0b3438c81ea81f0f9d975d5f952ccdbdc9a
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 7557bf3b1a3d59f95cf5d355b89759a1308b00782246969c207dc5663b5f06f7
MD5 d3a8e399ef8929a5f39ee5fa6e9dbeb4
SHA1 bcbba1035d0e5452260e27befff9529c6b3070f9
SHA512 aa540dd41c54ad73b006a51cf9c44db77fb4209c11176cce5eb927d7bf9dc3bd9d294e18c61969f9a0d48786cb650bbec7b6e28bb01b1113dcdd8b342aeac177
SSDEEP 192:FmSg6GvwAqaejeHV+FR2HrEPQ5kw6a+Po6yIsnVdg4:FmSRq0qGR4rESaa+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 72d532fd77eab3491aa148b2901407e3c91e63741100d7fb55d6bedda517d052
MD5 49328fdee098abbdae000c7aba8aa574
SHA1 53c1d07a399e4d831c3c76d0deb2d0478f1aa12f
SHA512 00a83ccc1d3fb06dd1d0f1be31071e5dbc5e1a64f3ef3e05132c49f374ca408c72fe67724f959135ee7c8d3ff082ee924e68a60a3ed03d470dfd5fd67c69d217
SSDEEP 192:FmSg6GvwAqMejeHV+FR2HrEPQ5kw6a+Po6yIsnVdg4:FmSRqCqGR4rESaa+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 43018ab88d5fd526fc732ee31a2e13ded804b2419fc65c3f563ba60d1573479d
MD5 df0a8540902270be83bcb9f219bed4db
SHA1 271b4cb1e9d69d0aac6d81e3dabcf042a591f756
SHA512 d36b46615a8bca2cdac5e2d777ad9b5ded827a460b1d53bc7b8661e38eca06495c163dfc460ba80fc231e997b82c67f860df125237fd226394f35db92efff347
SSDEEP 192:FmSg6GvwAqvejeHV+FR2rEPQ5kwZa+Po6yIsnVdg4:FmSRq7qGR2rES5a+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 4330f7de15fa209c9d5154b101fccf36274c45dd71c1677bd005d2de335d8794
MD5 6cc40c6ddff84a8e4f545b4a942db477
SHA1 75edcf10a5e7fd1638617f816dfab0cfb791a443
SHA512 d533f16880179837dd386da36f393c560a410ff1ed97cb3b307e5de205bbffc11f08f17d277e065607a11f4d402d1aa62e7d0f393e1921ceb66ce58040ecb677
SSDEEP 192:FmSg6GvwAq8ejeHV+FR2rEPQ5kwZa+Po6yIsnVdg4:FmSRqKqGR2rES5a+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 cb93534b9861da0482b8c63fb558d61af1e6eb61bafdc06fe51e4ccc5832971b
MD5 b52fda441986364e586288e2fc8d6141
SHA1 5760ec0652167875958961ef5900b4f5e8b3389a
SHA512 a93090f7c0513b6ea60e654527d4ef9b6eb0e7d06cc25f77dbdfe43629cde7555db6d5097c37b4cada446e9181ee9f4a79be75c7d59aac88ff4f64043762414e
SSDEEP 3072:dDcZ6UZsu46J8ixse6HWNMk6YILigpcehoroaeH:lNUZt46Jlxse6HWNj6YHgta9eH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 c796e629e7789116e037d784d0c1de594c39d37e66b22149aefe4db2627c3df1
MD5 8e9c73f31c8d9e6592d8c1fccd4caa3f
SHA1 63fb071ec5956a9ac00382c4137a0483f5177a65
SHA512 e303ee75b6d08eeff44c07e2f1ca5ca254ceca7f3caf94151db58b844b0477e0878d67ac4ea1dad3674ce586d34d6a854a5d49b77207e1e0ecfab66544bd8bb2
SSDEEP 3072:MDcZ6UZsu46J8ixse6HWNMk6YILigpcehoroaeH:oNUZt46Jlxse6HWNj6YHgta9eH
MD5 SHA1 SHA512 SSDEEP

Submit Download

content_v2.gdata.crdownload

Path C:\Users\Admin\Downloads\content_v2.gdata.crdownload
Size 1.5MB
SHA256 0302f687286275370cc4267486f90f8c5ebe7aeae3f338e117fbf53277db2c3f
MD5 67421824f80d65c5365cab1f0de49ab6
SHA1 1254f8e28642a877ebdaef713e08a088cc84ace0
SHA512 00cc95ee9456d5b62c8898e74706c53be4cf7621f05fc201e9583d0a65fdb4997b07b43b60be71d3308891ed7580ce49730b956a53d66651c39d42d86761854c
SSDEEP 24576:VU26PZCy0MJaIfeWXxeobMRZd3i6B4JZBHeZbHq/+haKMfbo7DUSCiPOuHKGesV:V16YOAIWgxLMXdS6KC7gKMbo7FC+XZP
MD5 SHA1 SHA512 SSDEEP

Submit Download