Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12-11-2024 06:42
Static task
static1
Behavioral task
behavioral1
Sample
651ecab38dc60be99e6a08244612050d.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
651ecab38dc60be99e6a08244612050d.exe
Resource
win10v2004-20241007-en
General
-
Target
651ecab38dc60be99e6a08244612050d.exe
-
Size
1.0MB
-
MD5
651ecab38dc60be99e6a08244612050d
-
SHA1
0d2a7c46954e4649c15fc4ace924fac538cdc2c7
-
SHA256
37749c2d24301276a9b1a9d1b39ab49c3037dd9ed6f1f90e895658a5d0ada16f
-
SHA512
5626c9787ab24785de517225ef107217734a26cfc8bd989df26bda5fbcfbbfc93c8ddd0c72ca7292a0f1e04b50a0d166fec980e092ff1c77b3ea4e1752362a24
-
SSDEEP
12288:3/HTkjpzw3cY2e8THhVECO6Cq0h/mxMZ/4A01/VvgQ0ory9DXCfdp3vmWWIC6cxB:vHYwMYzz8014dYNMWOreyBMZvmowm
Malware Config
Extracted
remcos
RemoteHostescobar
87.120.125.229:53215
goma.zapto.org:53215
127.0.0.1:53215
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-AGZL10
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Detected Nirsoft tools 3 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
Processes:
resource yara_rule behavioral1/memory/1824-48-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/2584-55-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral1/memory/2860-61-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/2860-61-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/1824-48-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid Process 2132 powershell.exe 2296 powershell.exe -
Uses browser remote debugging 2 TTPs 4 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
Processes:
Chrome.exeChrome.exeChrome.exeChrome.exepid Process 2760 Chrome.exe 1456 Chrome.exe 780 Chrome.exe 2292 Chrome.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
651ecab38dc60be99e6a08244612050d.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 651ecab38dc60be99e6a08244612050d.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
651ecab38dc60be99e6a08244612050d.exe651ecab38dc60be99e6a08244612050d.exedescription pid Process procid_target PID 2640 set thread context of 2068 2640 651ecab38dc60be99e6a08244612050d.exe 36 PID 2068 set thread context of 1824 2068 651ecab38dc60be99e6a08244612050d.exe 37 PID 2068 set thread context of 2860 2068 651ecab38dc60be99e6a08244612050d.exe 38 PID 2068 set thread context of 2584 2068 651ecab38dc60be99e6a08244612050d.exe 39 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
schtasks.exe651ecab38dc60be99e6a08244612050d.exe651ecab38dc60be99e6a08244612050d.exe651ecab38dc60be99e6a08244612050d.exe651ecab38dc60be99e6a08244612050d.exe651ecab38dc60be99e6a08244612050d.exepowershell.exepowershell.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 651ecab38dc60be99e6a08244612050d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 651ecab38dc60be99e6a08244612050d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 651ecab38dc60be99e6a08244612050d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 651ecab38dc60be99e6a08244612050d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 651ecab38dc60be99e6a08244612050d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
Chrome.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer Chrome.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 49 IoCs
Processes:
651ecab38dc60be99e6a08244612050d.exepowershell.exepowershell.exe651ecab38dc60be99e6a08244612050d.exe651ecab38dc60be99e6a08244612050d.exeChrome.exepid Process 2640 651ecab38dc60be99e6a08244612050d.exe 2640 651ecab38dc60be99e6a08244612050d.exe 2132 powershell.exe 2296 powershell.exe 1824 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 1824 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2760 Chrome.exe 2760 Chrome.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
651ecab38dc60be99e6a08244612050d.exepid Process 2068 651ecab38dc60be99e6a08244612050d.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
651ecab38dc60be99e6a08244612050d.exepid Process 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe 2068 651ecab38dc60be99e6a08244612050d.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
651ecab38dc60be99e6a08244612050d.exepowershell.exepowershell.exe651ecab38dc60be99e6a08244612050d.exeChrome.exedescription pid Process Token: SeDebugPrivilege 2640 651ecab38dc60be99e6a08244612050d.exe Token: SeDebugPrivilege 2132 powershell.exe Token: SeDebugPrivilege 2296 powershell.exe Token: SeDebugPrivilege 2584 651ecab38dc60be99e6a08244612050d.exe Token: SeShutdownPrivilege 2760 Chrome.exe Token: SeShutdownPrivilege 2760 Chrome.exe Token: SeShutdownPrivilege 2760 Chrome.exe Token: SeShutdownPrivilege 2760 Chrome.exe Token: SeShutdownPrivilege 2760 Chrome.exe Token: SeShutdownPrivilege 2760 Chrome.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Chrome.exepid Process 2760 Chrome.exe 2760 Chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
651ecab38dc60be99e6a08244612050d.exe651ecab38dc60be99e6a08244612050d.exeChrome.exedescription pid Process procid_target PID 2640 wrote to memory of 2132 2640 651ecab38dc60be99e6a08244612050d.exe 30 PID 2640 wrote to memory of 2132 2640 651ecab38dc60be99e6a08244612050d.exe 30 PID 2640 wrote to memory of 2132 2640 651ecab38dc60be99e6a08244612050d.exe 30 PID 2640 wrote to memory of 2132 2640 651ecab38dc60be99e6a08244612050d.exe 30 PID 2640 wrote to memory of 2296 2640 651ecab38dc60be99e6a08244612050d.exe 32 PID 2640 wrote to memory of 2296 2640 651ecab38dc60be99e6a08244612050d.exe 32 PID 2640 wrote to memory of 2296 2640 651ecab38dc60be99e6a08244612050d.exe 32 PID 2640 wrote to memory of 2296 2640 651ecab38dc60be99e6a08244612050d.exe 32 PID 2640 wrote to memory of 2832 2640 651ecab38dc60be99e6a08244612050d.exe 34 PID 2640 wrote to memory of 2832 2640 651ecab38dc60be99e6a08244612050d.exe 34 PID 2640 wrote to memory of 2832 2640 651ecab38dc60be99e6a08244612050d.exe 34 PID 2640 wrote to memory of 2832 2640 651ecab38dc60be99e6a08244612050d.exe 34 PID 2640 wrote to memory of 2068 2640 651ecab38dc60be99e6a08244612050d.exe 36 PID 2640 wrote to memory of 2068 2640 651ecab38dc60be99e6a08244612050d.exe 36 PID 2640 wrote to memory of 2068 2640 651ecab38dc60be99e6a08244612050d.exe 36 PID 2640 wrote to memory of 2068 2640 651ecab38dc60be99e6a08244612050d.exe 36 PID 2640 wrote to memory of 2068 2640 651ecab38dc60be99e6a08244612050d.exe 36 PID 2640 wrote to memory of 2068 2640 651ecab38dc60be99e6a08244612050d.exe 36 PID 2640 wrote to memory of 2068 2640 651ecab38dc60be99e6a08244612050d.exe 36 PID 2640 wrote to memory of 2068 2640 651ecab38dc60be99e6a08244612050d.exe 36 PID 2640 wrote to memory of 2068 2640 651ecab38dc60be99e6a08244612050d.exe 36 PID 2640 wrote to memory of 2068 2640 651ecab38dc60be99e6a08244612050d.exe 36 PID 2640 wrote to memory of 2068 2640 651ecab38dc60be99e6a08244612050d.exe 36 PID 2068 wrote to memory of 1824 2068 651ecab38dc60be99e6a08244612050d.exe 37 PID 2068 wrote to memory of 1824 2068 651ecab38dc60be99e6a08244612050d.exe 37 PID 2068 wrote to memory of 1824 2068 651ecab38dc60be99e6a08244612050d.exe 37 PID 2068 wrote to memory of 1824 2068 651ecab38dc60be99e6a08244612050d.exe 37 PID 2068 wrote to memory of 1824 2068 651ecab38dc60be99e6a08244612050d.exe 37 PID 2068 wrote to memory of 2860 2068 651ecab38dc60be99e6a08244612050d.exe 38 PID 2068 wrote to memory of 2860 2068 651ecab38dc60be99e6a08244612050d.exe 38 PID 2068 wrote to memory of 2860 2068 651ecab38dc60be99e6a08244612050d.exe 38 PID 2068 wrote to memory of 2860 2068 651ecab38dc60be99e6a08244612050d.exe 38 PID 2068 wrote to memory of 2860 2068 651ecab38dc60be99e6a08244612050d.exe 38 PID 2068 wrote to memory of 2584 2068 651ecab38dc60be99e6a08244612050d.exe 39 PID 2068 wrote to memory of 2584 2068 651ecab38dc60be99e6a08244612050d.exe 39 PID 2068 wrote to memory of 2584 2068 651ecab38dc60be99e6a08244612050d.exe 39 PID 2068 wrote to memory of 2584 2068 651ecab38dc60be99e6a08244612050d.exe 39 PID 2068 wrote to memory of 2584 2068 651ecab38dc60be99e6a08244612050d.exe 39 PID 2068 wrote to memory of 2760 2068 651ecab38dc60be99e6a08244612050d.exe 40 PID 2068 wrote to memory of 2760 2068 651ecab38dc60be99e6a08244612050d.exe 40 PID 2068 wrote to memory of 2760 2068 651ecab38dc60be99e6a08244612050d.exe 40 PID 2068 wrote to memory of 2760 2068 651ecab38dc60be99e6a08244612050d.exe 40 PID 2760 wrote to memory of 2344 2760 Chrome.exe 41 PID 2760 wrote to memory of 2344 2760 Chrome.exe 41 PID 2760 wrote to memory of 2344 2760 Chrome.exe 41 PID 2760 wrote to memory of 2936 2760 Chrome.exe 43 PID 2760 wrote to memory of 2936 2760 Chrome.exe 43 PID 2760 wrote to memory of 2936 2760 Chrome.exe 43 PID 2760 wrote to memory of 2936 2760 Chrome.exe 43 PID 2760 wrote to memory of 2936 2760 Chrome.exe 43 PID 2760 wrote to memory of 2936 2760 Chrome.exe 43 PID 2760 wrote to memory of 2936 2760 Chrome.exe 43 PID 2760 wrote to memory of 2936 2760 Chrome.exe 43 PID 2760 wrote to memory of 2936 2760 Chrome.exe 43 PID 2760 wrote to memory of 2936 2760 Chrome.exe 43 PID 2760 wrote to memory of 2936 2760 Chrome.exe 43 PID 2760 wrote to memory of 2936 2760 Chrome.exe 43 PID 2760 wrote to memory of 2936 2760 Chrome.exe 43 PID 2760 wrote to memory of 2936 2760 Chrome.exe 43 PID 2760 wrote to memory of 2936 2760 Chrome.exe 43 PID 2760 wrote to memory of 2936 2760 Chrome.exe 43 PID 2760 wrote to memory of 2936 2760 Chrome.exe 43 PID 2760 wrote to memory of 2936 2760 Chrome.exe 43 PID 2760 wrote to memory of 2936 2760 Chrome.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\651ecab38dc60be99e6a08244612050d.exe"C:\Users\Admin\AppData\Local\Temp\651ecab38dc60be99e6a08244612050d.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\651ecab38dc60be99e6a08244612050d.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2132
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\iwoBVOkb.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2296
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iwoBVOkb" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7EFF.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2832
-
-
C:\Users\Admin\AppData\Local\Temp\651ecab38dc60be99e6a08244612050d.exe"C:\Users\Admin\AppData\Local\Temp\651ecab38dc60be99e6a08244612050d.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\651ecab38dc60be99e6a08244612050d.exeC:\Users\Admin\AppData\Local\Temp\651ecab38dc60be99e6a08244612050d.exe /stext "C:\Users\Admin\AppData\Local\Temp\yosuwmvmajqmivgmybbhhmbo"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1824
-
-
C:\Users\Admin\AppData\Local\Temp\651ecab38dc60be99e6a08244612050d.exeC:\Users\Admin\AppData\Local\Temp\651ecab38dc60be99e6a08244612050d.exe /stext "C:\Users\Admin\AppData\Local\Temp\jqxfwxgoosirsbcqpmnikrvxoxfq"3⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
PID:2860
-
-
C:\Users\Admin\AppData\Local\Temp\651ecab38dc60be99e6a08244612050d.exeC:\Users\Admin\AppData\Local\Temp\651ecab38dc60be99e6a08244612050d.exe /stext "C:\Users\Admin\AppData\Local\Temp\lkcxxpqhcaawvhruyoikveqoxdpqznd"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2584
-
-
C:\Program Files\Google\Chrome\Application\Chrome.exe--user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"3⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Program Files\Google\Chrome\Application\Chrome.exe"C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x7fef7f79758,0x7fef7f79768,0x7fef7f797784⤵PID:2344
-
-
C:\Program Files\Google\Chrome\Application\Chrome.exe"C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1120 --field-trial-handle=1164,i,7630063815397753503,3479451459007557930,131072 /prefetch:24⤵PID:2936
-
-
C:\Program Files\Google\Chrome\Application\Chrome.exe"C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1432 --field-trial-handle=1164,i,7630063815397753503,3479451459007557930,131072 /prefetch:84⤵PID:2076
-
-
C:\Program Files\Google\Chrome\Application\Chrome.exe"C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1584 --field-trial-handle=1164,i,7630063815397753503,3479451459007557930,131072 /prefetch:84⤵PID:2336
-
-
C:\Program Files\Google\Chrome\Application\Chrome.exe"C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2104 --field-trial-handle=1164,i,7630063815397753503,3479451459007557930,131072 /prefetch:14⤵
- Uses browser remote debugging
PID:1456
-
-
C:\Program Files\Google\Chrome\Application\Chrome.exe"C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2120 --field-trial-handle=1164,i,7630063815397753503,3479451459007557930,131072 /prefetch:14⤵
- Uses browser remote debugging
PID:780
-
-
C:\Program Files\Google\Chrome\Application\Chrome.exe"C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2900 --field-trial-handle=1164,i,7630063815397753503,3479451459007557930,131072 /prefetch:14⤵
- Uses browser remote debugging
PID:2292
-
-
C:\Program Files\Google\Chrome\Application\Chrome.exe"C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1376 --field-trial-handle=1164,i,7630063815397753503,3479451459007557930,131072 /prefetch:24⤵PID:2864
-
-
C:\Program Files\Google\Chrome\Application\Chrome.exe"C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3380 --field-trial-handle=1164,i,7630063815397753503,3479451459007557930,131072 /prefetch:84⤵PID:376
-
-
C:\Program Files\Google\Chrome\Application\Chrome.exe"C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3620 --field-trial-handle=1164,i,7630063815397753503,3479451459007557930,131072 /prefetch:84⤵PID:1940
-
-
C:\Program Files\Google\Chrome\Application\Chrome.exe"C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3736 --field-trial-handle=1164,i,7630063815397753503,3479451459007557930,131072 /prefetch:84⤵PID:1872
-
-
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1540
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40B
MD5cac9fbbc31dbeac5ab66c794a9c80d3e
SHA13be11f947d0025646dfdba1c22c85b00194a02ba
SHA2560dbbaa284aa2a73cdcd7a6cbc7270848aae8719cdd7ba36ff62e1d9f691e40c3
SHA512f2ba4db24a6a7da0c6a9569832ba5818535d6c22c318155d07b02b1cbeb6d79fd7843e370bd5c20ec615de7c4bd9420b0b33c472290fdfda842dfad6005a1e5f
-
Filesize
20KB
MD5c9ff7748d8fcef4cf84a5501e996a641
SHA102867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA2564d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
SHA512d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73
-
Filesize
10KB
MD5d94884d4e4f9637e90657e6f11e2a499
SHA16df0bd8982ec13d265a2eeb9bb6ec9da72fc05df
SHA2561ef132b11bfb6377d2dc614646938a126cafc1eb4fc3e1b5a2895566e61e79dc
SHA5128e8db0ac1f3196b95c7766dfdf52bbf02689fafe66f005a367a331cd167d5824fb37fb73cbf2107e9772b023d4757200ced65924816e811065851ea0646246cb
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
169KB
MD56a20d5d91d64bb3b84da7f0a956ad6b2
SHA151a4cfad4194b850f422c405d06750675af9e972
SHA25677514fb42ac884a4cdbf3fbae46f88a2432467a6edf72a787dbd55a37900d5d3
SHA51216821441a813704cf4d36e7ad45b0d37ee65dc2854d0ea1aef8efce9c48e386e7368d35a2b8cf25b44d9b29d889485a5e97416a02123e9d852ccaf05403011c3
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
1KB
MD52d4d417d6b905a85625a96b03a47a0f8
SHA11d263720009aed5ae4ad8b04ccb42136c85cb0d3
SHA256772bb81d43e1acf339e5db5ab6b9a0152cf3a4cc8fbd51dbe2b02c32bbab9810
SHA5123a4065532fa58883479a11105838948bf53c0e480c81d130011c0cbebeffaff5836a32698a56d7399eda94502cfbceef98ac73710b3eecb733bf5b1f961933c7
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\T6YR81AR14294LPAT39Y.temp
Filesize7KB
MD5d5bd136ee15b0f4c01eba9b9f215568a
SHA102df74fdf6f2404066c77b03ea6b21e3747910a9
SHA25696688e44e41e38b047c6bcc355a13c61242e865a2d008f3198ef977a9faeb773
SHA512b442c6b02ee9e565c11799024311364c1d8d68e226c8dc09ca70d81315fb9db03ce0932056792eda5a83b641b66193c664ba04230836ff8f216221e69338aed0
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e