Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
269s -
max time network
265s -
platform
windows11-21h2_x64 -
resource
win11-20241007-es -
resource tags
arch:x64arch:x86image:win11-20241007-eslocale:es-esos:windows11-21h2-x64systemwindows -
submitted
13/11/2024, 05:47
Static task
static1
Behavioral task
behavioral1
Sample
software v1.24 loader.exe
Resource
win11-20241007-es
General
-
Target
software v1.24 loader.exe
-
Size
3.6MB
-
MD5
75b67e3ddf960879f0bfe4db7f2e61b0
-
SHA1
323759fbb5a65c89351f8b0ac35c5e8c9e344b0c
-
SHA256
37d10c32a5efe52fc00b976723dfd1eb1a1851e9cbbde5e49d6ba6d3e1848f89
-
SHA512
17f3858651831973b733931ebc9c19f3b8356107af7328d90cc30373a294b8c17237f64ad04c0c906cc2b5519b390c23941397cadb347621c261f9b63d695c56
-
SSDEEP
49152:0QusxfsjLFBjCUYamvmf6L7ePUZ94p/D3WoPt5Yg0O7Qzp:5pp
Malware Config
Extracted
meduza
109.107.181.162
-
anti_dbg
true
-
anti_vm
true
-
build_name
420
-
extensions
none
-
grabber_max_size
1.048576e+06
-
links
none
-
port
15666
-
self_destruct
true
Signatures
-
Meduza Stealer payload 45 IoCs
resource yara_rule behavioral1/memory/4344-1-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-6-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-11-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-8-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-13-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-7-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-19-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-18-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-15-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-14-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-5-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-2-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-0-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-28-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-29-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-32-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-35-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-36-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-40-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-41-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-59-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-58-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-54-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-52-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-49-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-47-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-46-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-66-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-43-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-42-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-55-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-34-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-39-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-33-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-64-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-92-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-87-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-84-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-78-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-77-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-74-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-72-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-71-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-95-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4344-96-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza -
Meduza family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 software v1.24 loader.exe Key opened \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 software v1.24 loader.exe Key opened \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 software v1.24 loader.exe Key opened \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 software v1.24 loader.exe Key opened \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 software v1.24 loader.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 api.ipify.org 3 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3424 set thread context of 4344 3424 software v1.24 loader.exe 79 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4972 cmd.exe 3848 PING.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133759506983718212" chrome.exe -
Modifies registry class 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" BackgroundTransferHost.exe Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\MuiCache BackgroundTransferHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix BackgroundTransferHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" BackgroundTransferHost.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3848 PING.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3968 WINWORD.EXE 3968 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4344 software v1.24 loader.exe 4344 software v1.24 loader.exe 708 chrome.exe 708 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4344 software v1.24 loader.exe Token: SeImpersonatePrivilege 4344 software v1.24 loader.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe Token: SeShutdownPrivilege 708 chrome.exe Token: SeCreatePagefilePrivilege 708 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe 708 chrome.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3968 WINWORD.EXE 3968 WINWORD.EXE 3968 WINWORD.EXE 3968 WINWORD.EXE 3968 WINWORD.EXE 3968 WINWORD.EXE 3968 WINWORD.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3424 wrote to memory of 4344 3424 software v1.24 loader.exe 79 PID 3424 wrote to memory of 4344 3424 software v1.24 loader.exe 79 PID 3424 wrote to memory of 4344 3424 software v1.24 loader.exe 79 PID 3424 wrote to memory of 4344 3424 software v1.24 loader.exe 79 PID 3424 wrote to memory of 4344 3424 software v1.24 loader.exe 79 PID 3424 wrote to memory of 4344 3424 software v1.24 loader.exe 79 PID 3424 wrote to memory of 4344 3424 software v1.24 loader.exe 79 PID 3424 wrote to memory of 4344 3424 software v1.24 loader.exe 79 PID 3424 wrote to memory of 4344 3424 software v1.24 loader.exe 79 PID 3424 wrote to memory of 4344 3424 software v1.24 loader.exe 79 PID 4344 wrote to memory of 4972 4344 software v1.24 loader.exe 82 PID 4344 wrote to memory of 4972 4344 software v1.24 loader.exe 82 PID 4972 wrote to memory of 3848 4972 cmd.exe 84 PID 4972 wrote to memory of 3848 4972 cmd.exe 84 PID 708 wrote to memory of 2824 708 chrome.exe 95 PID 708 wrote to memory of 2824 708 chrome.exe 95 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 3836 708 chrome.exe 96 PID 708 wrote to memory of 4508 708 chrome.exe 97 PID 708 wrote to memory of 4508 708 chrome.exe 97 PID 708 wrote to memory of 3428 708 chrome.exe 98 PID 708 wrote to memory of 3428 708 chrome.exe 98 PID 708 wrote to memory of 3428 708 chrome.exe 98 PID 708 wrote to memory of 3428 708 chrome.exe 98 PID 708 wrote to memory of 3428 708 chrome.exe 98 PID 708 wrote to memory of 3428 708 chrome.exe 98 PID 708 wrote to memory of 3428 708 chrome.exe 98 PID 708 wrote to memory of 3428 708 chrome.exe 98 PID 708 wrote to memory of 3428 708 chrome.exe 98 PID 708 wrote to memory of 3428 708 chrome.exe 98 PID 708 wrote to memory of 3428 708 chrome.exe 98 PID 708 wrote to memory of 3428 708 chrome.exe 98 PID 708 wrote to memory of 3428 708 chrome.exe 98 PID 708 wrote to memory of 3428 708 chrome.exe 98 PID 708 wrote to memory of 3428 708 chrome.exe 98 PID 708 wrote to memory of 3428 708 chrome.exe 98 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 software v1.24 loader.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 software v1.24 loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\software v1.24 loader.exe"C:\Users\Admin\AppData\Local\Temp\software v1.24 loader.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\software v1.24 loader.exe"C:\Users\Admin\AppData\Local\Temp\software v1.24 loader.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:4344 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\software v1.24 loader.exe"3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 30004⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3848
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1728
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.131⤵
- Modifies registry class
PID:4696
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\SaveSync.odt"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3968
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xe8,0x108,0x7ffa29bccc40,0x7ffa29bccc4c,0x7ffa29bccc582⤵PID:2824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1808,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1804 /prefetch:22⤵PID:3836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2108,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2120 /prefetch:32⤵PID:4508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2196,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2212 /prefetch:82⤵PID:3428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:3492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3176,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:4140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3592,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4520 /prefetch:12⤵PID:2928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4424,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4420 /prefetch:82⤵PID:4748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4436,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4732 /prefetch:82⤵PID:1332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4892,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4396 /prefetch:82⤵PID:3004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4948,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4900 /prefetch:82⤵PID:4720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4968,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5068 /prefetch:82⤵PID:4724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5004,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5080 /prefetch:82⤵PID:1504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4976,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5040 /prefetch:82⤵PID:2256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4972,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4440 /prefetch:82⤵PID:4688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5008,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4304 /prefetch:22⤵PID:3880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5104,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5144 /prefetch:12⤵PID:2264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=3216,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5108 /prefetch:12⤵PID:2020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=4724,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4292 /prefetch:12⤵PID:4676
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:1804
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4712
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD5fd570f8c096f57946f9ec0e76a31cd86
SHA1f3ee396e19c15f33d203f0fcb85097b5442e0314
SHA256311c10b506c95faa8bff6b62d5ad45c94c21099bcdb46cc328b08e49e558ef4e
SHA51247b985dcd9d33ce53924ac632ed011ad26ae204507a4fe6bcb87e1363690b9869772fe4ce75e08ee235489a31574cabff28b710bdce5e5b195f25dafc01e15f5
-
Filesize
18KB
MD5b3bdcd933e8d4a8f40dc258581546f9e
SHA11f419143ad236ea655cd8d782a242f6f598535e7
SHA256d7230fa107956a874d3a8a5ae62bdde50f541f3330c667b760a77ee4b9f14adc
SHA51241e28246d473f89ad43d95bae5039735b09fdcc154b9f74b553f9949ca6cb6eae415f9fe080cf97754dc264170be37d2dc59e5eda6205cd13b79a856230cd451
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json
Filesize851B
MD507ffbe5f24ca348723ff8c6c488abfb8
SHA16dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA2566895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA5127ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json
Filesize854B
MD54ec1df2da46182103d2ffc3b92d20ca5
SHA1fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA2566c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
356B
MD515214b585a6daf6a4406c71f2ce18ff2
SHA1b7e1e6aed82751d5992cb718c7ba3cc99bccd3b0
SHA256d9dbbda24b5d543346e22b04194687caf90cb7dd2cab36207e1dd4ceb6912765
SHA512a969b26dcf2cee756de22078f14843b2a03b1a50a5b53dbe069e77b183cc66e1ab0e57546015ed480e909c6401b336a139df96ee923d1319b537e4596472aa53
-
Filesize
691B
MD58bea48940725328474ce06ebe10a2f3c
SHA16b55218c570975211116b41e6d6f9436384222bc
SHA256690cc0683159e84e68924f3796f098b325a0d3009e0aab564eb18e07a89d5b43
SHA5129f351bc79a3400a5fa420e99bf87660a2645b99905dc15054964193f29ffcdbf51f5714b1f6256849ac9495db7f1032a55ab7d5f4d28c48323035b122a56e69f
-
Filesize
356B
MD5fd6d3de5544df126e2ca8542bd383489
SHA1a46ec9af6ba52dced9cdb3f78683bdf105adb31d
SHA2564f24f894a7d9613b9a50644e199fb3b66e6ed747cc10ec039b6e2f493d0b8588
SHA512dfcf34a11a890432eea1750d33140e38201734fbdf1231951b8c44bb838cafa181469ba7b98c525fae4dd089efcd2f6a8e434aa1603f41a9f8b16a43115b28d9
-
Filesize
10KB
MD51b6f59af680300a55e3b77b2fc7813f1
SHA185caa58247b8792b007deed00434d22d184171b4
SHA256ab92594eb3e668367265cfb7f6623b587e223231c04f2e4bf329f9ea6f34f43d
SHA512747fdad310d43ad470d8fb6fe6918074ba2a4839e1f94322e537d89422688d87fddf1861af7e73b9a54cca74eea1aa91b6cbe5374463e175baedc1fb64136475
-
Filesize
10KB
MD5014ff7e8009e8dd5b84bdbe9ee6c0a75
SHA1ffdc7af34922ea45abbf094452c211535580e83c
SHA25683eb410164e727dc183113f45c28e59b3926bb6d2affe5c819d718df312c433e
SHA51278e946112c866f5f798b2e8d0dcdbfabb19aded69c5f9fb34094a570f407acb812ebbf6488e8467995aa3ac32a6b62fcb5fe344f34bbd73dfce5e401bbf4da3a
-
Filesize
10KB
MD5f03a229134ba8a6aa225728679d80149
SHA1aa5b3157f5b494ad9526ccb9905d13b1abfb6d2d
SHA256377641ae8522933c1d9e2fc71bff7c77066b9b4885a050c0c82020d86481c0da
SHA5126b20a6a37962ef92d81bbc75c69c715e3422e539972c99430504181f4b8abacec49df3fca44776e56a15a2144160439d1e559cfdd19fd9174196e1bbc4344475
-
Filesize
9KB
MD5211812428a42a9228562bd18a7cf1e06
SHA11e227d9263a4ae371851801de220760c7997636a
SHA2560042a8f961cd55312798c8d3de61d7be86ea6fca7cb6b73c5e7786b34e5401f6
SHA512175ec492d36ede0e1e90fc0f143bcd69f219ece8de01d4839698c4198c4c49e1e8e06a0ad2bd84d08f34ce336be46e92742947672231a14ee31f78a5cb3e8b92
-
Filesize
9KB
MD58ae5182e29732e8ec4cb37ba472066e5
SHA1e1ca652d695af9517b800d4da88baf1bf2ba47f1
SHA256a1af5b35a3e6ec8b6cf0c5a32127b59b7c7c4c7e9bc9ab95869d110a7bbc3625
SHA512f411743677dc2cde62d46a2c7f3ca0f070fe1eff42e7bbff94a21cc46f00d225481d8711c937471bfb3dec52253a5e80d249f503f0723bf5b4ff162666861ec7
-
Filesize
15KB
MD55770160d33156be7a35190d3e172556b
SHA1a047ab268880c99fb95ee347722dd1a7a7e830e0
SHA25676866e268c1160940369853704843b88f3004799b8336562e0e8d91b62c3f94f
SHA512afd5fa8724092c72470e11cfa53883f7271bfb37336e2ee539a259454f6daa7297cc2fdd799df538cc6809ac14492d891f252fdc31a6d172a889f91d37ab3133
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD5216f93f8747a8d4c63d5716ab0ae4f24
SHA1a014cbb38d60f0419013be59f42391c1114da92d
SHA256e5708b73bcb4e2ebd8737fd70cd0b6792b8c3c809a5093c5d628ef439b2d8027
SHA512ff96b53f8deacbeeb5f35a27a736dc4e6cea5a5d676166c17b06103a81438ed514a5100edbf60250f7629ce7a47f2f3e880cc846b951431ec17cd10b7bbb22d7
-
Filesize
233KB
MD562d7b5c6a41f933056abb519e33fcf43
SHA11aaaddbffdd25cd1a9b5b2206d3eed81b92b6c23
SHA256ee4fe811d9b6311c441b6b48232f6939d8949423320f823a8e30990a54ca0052
SHA5122dd8d8922987890934d75166f5d3c9dc334a655b09c9ef86d72dc83d770148db05e1cb0908a802ea2a7f8ec2bcca6e53f3b3d236078d6c47845562cbd90ce083
-
Filesize
233KB
MD5e0724350c2cfc91fb9743252b97f0c5b
SHA10c48924f46520c540a273e9f4cc93f74f0ef2bd9
SHA256af9f159f992645fa72a98c71d436686492bd332b29fdfabad0fc44d46d53fb13
SHA51263d8f448f44f5dfad177baafb80cfc451b3be8a3a6606b91915341fd961a98385d1871beecdfefffb072f65b8be8655ccdd6950e9246e357827568858e0e1e09
-
Filesize
233KB
MD5191620d2d306a946c5fc0916cb41eaa8
SHA12cf9848a7375019524125908c3005a347f7aeefa
SHA2562a2d2d7a6dcead677ace1c7f7677b4a7cc84c9b98543d41134f88ab5bbfb0265
SHA512986de1e0f94f7e565a2a829e7c19e4ea93d09f355837091079697d97efbc8b21ab9d843c293123b2d4b05981d09f04eed4236a8635154769da4dc609e78ae3bd
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\17e2c5a0-9d04-4094-a4e3-ff182a50020a.down_data
Filesize126KB
MD50a110bd321f114ff8727674eee2a490f
SHA1ed3eed0bc086ef1df640064d483e20487182a215
SHA256f1f611b30db0431160b742fb7b8a5ae609a7acbd3724810d92e186c65c14c268
SHA5123c08d7c95e5bb0fbdf87cce4fbf7cb10db1f2d5df8cc3e8c214ae064d1e0a0bbcdb1d599605a04dd0ab8c0c3fe5401e5a75ee8620d219e4e0da0810693bef728
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
Filesize
132KB
MD5da75bb05d10acc967eecaac040d3d733
SHA195c08e067df713af8992db113f7e9aec84f17181
SHA25633ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2
SHA51256533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef
-
Filesize
711B
MD5558659936250e03cc14b60ebf648aa09
SHA132f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA2562445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA5121632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727