Analysis

  • max time kernel
    150s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-11-2024 23:12

General

  • Target

    aka45.exe

  • Size

    154.6MB

  • MD5

    d32a9d2869c0a7e6e8831ca4c804dc6f

  • SHA1

    54f7d72293c71e6e452626bb2c530e5ce002dfad

  • SHA256

    58129d63129c89982c3e28bf58ac7cdceda55b398e594251c773610fde0c4cfe

  • SHA512

    ea6fb89da8251c0e84bb4024281fac6046547506ccc178a0abf60aee306438835987ab51df7f066246869c626c56fde977fc0f9ee6897211eaa5b73447c072fa

  • SSDEEP

    1572864:OTmw0ciLNpDPuAvHxJLkY2O6Ea3f9kwZXeT6EivLp1vUAtdjtZn+f4FnIvGaC9dU:Jv6E70+Mk

Malware Config

Signatures

  • Hexon family
  • Hexon stealer

    Hexon is a stealer written in Electron NodeJS.

  • Uses browser remote debugging 2 TTPs 9 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates processes with tasklist 1 TTPs 7 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 11 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aka45.exe
    "C:\Users\Admin\AppData\Local\Temp\aka45.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4132
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1348
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic csproduct get uuid
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1116
    • C:\Users\Admin\AppData\Local\Temp\aka45.exe
      "C:\Users\Admin\AppData\Local\Temp\aka45.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1912 --field-trial-handle=1916,i,6660405435303736111,15913033701148978046,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
        PID:5088
      • C:\Users\Admin\AppData\Local\Temp\aka45.exe
        "C:\Users\Admin\AppData\Local\Temp\aka45.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=2084 --field-trial-handle=1916,i,6660405435303736111,15913033701148978046,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2460
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3496
        • C:\Windows\system32\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4224
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "where /r . cookies.sqlite"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4800
        • C:\Windows\system32\where.exe
          where /r . cookies.sqlite
          3⤵
            PID:2416
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2528
          • C:\Windows\system32\tasklist.exe
            tasklist
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4280
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4552
          • C:\Windows\system32\tasklist.exe
            tasklist
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:648
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000
          2⤵
          • Uses browser remote debugging
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1292
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff8bf13cc40,0x7ff8bf13cc4c,0x7ff8bf13cc58
            3⤵
              PID:4216
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1996,i,2597077383019839232,14259754668744047695,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1992 /prefetch:2
              3⤵
                PID:2700
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-appcompat-clear --field-trial-handle=1800,i,2597077383019839232,14259754668744047695,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1264 /prefetch:3
                3⤵
                  PID:692
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-appcompat-clear --field-trial-handle=2084,i,2597077383019839232,14259754668744047695,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2096 /prefetch:8
                  3⤵
                    PID:3112
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2900,i,2597077383019839232,14259754668744047695,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2912 /prefetch:1
                    3⤵
                    • Uses browser remote debugging
                    PID:3596
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2924,i,2597077383019839232,14259754668744047695,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2948 /prefetch:1
                    3⤵
                    • Uses browser remote debugging
                    PID:1300
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4016,i,2597077383019839232,14259754668744047695,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3996 /prefetch:1
                    3⤵
                    • Uses browser remote debugging
                    PID:2408
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000
                  2⤵
                  • Uses browser remote debugging
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of FindShellTrayWindow
                  PID:2712
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bbd946f8,0x7ff8bbd94708,0x7ff8bbd94718
                    3⤵
                      PID:4208
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,3925843714974363595,2405982963190697240,131072 --no-sandbox --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2180 /prefetch:2
                      3⤵
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2108
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,3925843714974363595,2405982963190697240,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2216 /prefetch:3
                      3⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3320
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,3925843714974363595,2405982963190697240,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --mojo-platform-channel-handle=2700 /prefetch:8
                      3⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:372
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=2184,3925843714974363595,2405982963190697240,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:1
                      3⤵
                      • Uses browser remote debugging
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5112
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=2184,3925843714974363595,2405982963190697240,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
                      3⤵
                      • Uses browser remote debugging
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5052
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=2184,3925843714974363595,2405982963190697240,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4472 /prefetch:1
                      3⤵
                      • Uses browser remote debugging
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5396
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=2184,3925843714974363595,2405982963190697240,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4504 /prefetch:1
                      3⤵
                      • Uses browser remote debugging
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5408
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                    2⤵
                      PID:5680
                      • C:\Windows\system32\tasklist.exe
                        tasklist
                        3⤵
                        • Enumerates processes with tasklist
                        PID:5796
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                      2⤵
                        PID:5696
                        • C:\Windows\system32\tasklist.exe
                          tasklist
                          3⤵
                          • Enumerates processes with tasklist
                          PID:5812
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                        2⤵
                          PID:5704
                          • C:\Windows\system32\tasklist.exe
                            tasklist
                            3⤵
                            • Enumerates processes with tasklist
                            PID:5820
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /d /s /c "where /r . *.sqlite"
                          2⤵
                            PID:5900
                            • C:\Windows\system32\where.exe
                              where /r . *.sqlite
                              3⤵
                                PID:5940
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F"
                              2⤵
                                PID:6000
                                • C:\Windows\system32\taskkill.exe
                                  taskkill /IM EpicGamesLauncher.exe /F
                                  3⤵
                                  • Kills process with taskkill
                                  PID:6040
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
                                2⤵
                                  PID:6072
                                  • C:\Windows\system32\taskkill.exe
                                    taskkill /IM javaw.exe /F
                                    3⤵
                                    • Kills process with taskkill
                                    PID:6112
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
                                  2⤵
                                    PID:5200
                                    • C:\Windows\system32\taskkill.exe
                                      taskkill /IM Steam.exe /F
                                      3⤵
                                      • Kills process with taskkill
                                      PID:1668
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                                    2⤵
                                      PID:3768
                                      • C:\Windows\system32\tasklist.exe
                                        tasklist
                                        3⤵
                                        • Enumerates processes with tasklist
                                        PID:4596
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
                                      2⤵
                                        PID:5324
                                        • C:\Windows\system32\taskkill.exe
                                          taskkill /F /T /IM chrome.exe
                                          3⤵
                                          • Kills process with taskkill
                                          PID:4356
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
                                        2⤵
                                          PID:5320
                                          • C:\Windows\system32\taskkill.exe
                                            taskkill /F /T /IM msedge.exe
                                            3⤵
                                            • Kills process with taskkill
                                            PID:4104
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
                                          2⤵
                                            PID:1280
                                            • C:\Windows\system32\taskkill.exe
                                              taskkill /F /T /IM chrome.exe
                                              3⤵
                                              • Kills process with taskkill
                                              PID:1428
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
                                            2⤵
                                              PID:2980
                                              • C:\Windows\system32\taskkill.exe
                                                taskkill /F /T /IM msedge.exe
                                                3⤵
                                                • Kills process with taskkill
                                                PID:4848
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
                                              2⤵
                                                PID:692
                                                • C:\Windows\system32\taskkill.exe
                                                  taskkill /F /T /IM chrome.exe
                                                  3⤵
                                                  • Kills process with taskkill
                                                  PID:2152
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
                                                2⤵
                                                  PID:1712
                                                  • C:\Windows\system32\taskkill.exe
                                                    taskkill /F /T /IM msedge.exe
                                                    3⤵
                                                    • Kills process with taskkill
                                                    PID:1840
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
                                                  2⤵
                                                    PID:2248
                                                    • C:\Windows\system32\taskkill.exe
                                                      taskkill /F /T /IM chrome.exe
                                                      3⤵
                                                      • Kills process with taskkill
                                                      PID:4136
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
                                                    2⤵
                                                      PID:1568
                                                      • C:\Windows\system32\taskkill.exe
                                                        taskkill /F /T /IM msedge.exe
                                                        3⤵
                                                        • Kills process with taskkill
                                                        PID:5380
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /d /s /c "wscript "C:\Users\Admin\AppData\Local\Temp\d028fd856dae77a9.vbs""
                                                      2⤵
                                                        PID:4856
                                                        • C:\Windows\system32\wscript.exe
                                                          wscript "C:\Users\Admin\AppData\Local\Temp\d028fd856dae77a9.vbs"
                                                          3⤵
                                                            PID:4604
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /d /s /c "cscript //B "C:\Users\Admin\AppData\Local\Temp\open.vbs""
                                                          2⤵
                                                            PID:2264
                                                            • C:\Windows\system32\cscript.exe
                                                              cscript //B "C:\Users\Admin\AppData\Local\Temp\open.vbs"
                                                              3⤵
                                                              • Checks computer location settings
                                                              PID:64
                                                              • C:\Users\Admin\AppData\Local\Temp\hexon_a34871cb5ce6fc37.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\hexon_a34871cb5ce6fc37.exe" HXN-TEST-7E561F93D321 discord
                                                                4⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                PID:1212
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
                                                                  5⤵
                                                                    PID:5984
                                                                    • C:\Windows\System32\reg.exe
                                                                      C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                                      6⤵
                                                                        PID:6064
                                                              • C:\Users\Admin\AppData\Local\Temp\aka45.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\aka45.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 --field-trial-handle=1916,i,6660405435303736111,15913033701148978046,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                                                2⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:5808
                                                            • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                              "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                              1⤵
                                                                PID:2488

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                Filesize

                                                                2B

                                                                MD5

                                                                d751713988987e9331980363e24189ce

                                                                SHA1

                                                                97d170e1550eee4afc0af065b78cda302a97674c

                                                                SHA256

                                                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                SHA512

                                                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                Filesize

                                                                152B

                                                                MD5

                                                                e443ee4336fcf13c698b8ab5f3c173d0

                                                                SHA1

                                                                9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

                                                                SHA256

                                                                79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

                                                                SHA512

                                                                cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                Filesize

                                                                152B

                                                                MD5

                                                                56a4f78e21616a6e19da57228569489b

                                                                SHA1

                                                                21bfabbfc294d5f2aa1da825c5590d760483bc76

                                                                SHA256

                                                                d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

                                                                SHA512

                                                                c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                Filesize

                                                                5KB

                                                                MD5

                                                                5e482330d4d6f8ae7fbda21fc976e42c

                                                                SHA1

                                                                7dc77f97119e3f1724ed8727256c1364d62baad5

                                                                SHA256

                                                                000e84c81a502c301fc2e55680b453d59304a949e2218eb1905ffafb44dddfd1

                                                                SHA512

                                                                bb2b7e3278cc7c6171d5f8a68e5a5ed8bd8afaa9efb431b09dbc44e7394a2fa68c2066fe944ef0905ac5552397317385a75d316270697a62f42aac5478e348e8

                                                              • C:\Users\Admin\AppData\Local\Temp\604b13a1-91f8-4d02-910c-a45fc710b5e3.tmp.node

                                                                Filesize

                                                                137KB

                                                                MD5

                                                                04bfbfec8db966420fe4c7b85ebb506a

                                                                SHA1

                                                                939bb742a354a92e1dcd3661a62d69e48030a335

                                                                SHA256

                                                                da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd

                                                                SHA512

                                                                4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65

                                                              • C:\Users\Admin\AppData\Local\Temp\ce47abc1-2f02-4b86-94a8-518c6eca75ee.tmp.node

                                                                Filesize

                                                                1.4MB

                                                                MD5

                                                                56192831a7f808874207ba593f464415

                                                                SHA1

                                                                e0c18c72a62692d856da1f8988b0bc9c8088d2aa

                                                                SHA256

                                                                6aa8763714aa5199a4065259af792292c2a7d6a2c381aa27007255421e5c9d8c

                                                                SHA512

                                                                c82aa1ef569c232b4b4f98a3789f2390e5f7bf5cc7e73d199fe23a3f636817edfdc2fb49ce7f69169c028a9dd5ab9f63e8f64964bb22424fc08db71e85054a33

                                                              • C:\Users\Admin\AppData\Local\Temp\d028fd856dae77a9.vbs

                                                                Filesize

                                                                150KB

                                                                MD5

                                                                4737ec1d265b6937f0199407a7cb9cc2

                                                                SHA1

                                                                a90bd262fc653384099c1299d32da193d6e8afdf

                                                                SHA256

                                                                49e01c4ea131c3a06a837bfab48b5aa6a702c6f56e4435fcaf1d869b1823daa3

                                                                SHA512

                                                                74ea1638b46d6ef370743f1d483effb54331e7a1529b0968a84a9ebe83025eb9e276052b49ba4a9e650280663b9284cf28f1e6c7d4c0eb29a7cd14af1caaa172

                                                              • C:\Users\Admin\AppData\Local\Temp\open.vbs

                                                                Filesize

                                                                191B

                                                                MD5

                                                                5d816a79f10db07461ddd0a630589755

                                                                SHA1

                                                                b34fa079478b05091a4cff950ca77f8c2c92e608

                                                                SHA256

                                                                f93e9c9c21eb5c3e288de4a888d22907ce9224b924701bb6f7c058c2bb0ffd71

                                                                SHA512

                                                                d017d0005daf2ba4f0f893d04a8050d7f5dd7b4ff0d4e8c3c5d27d756ad0548281110c6cbf3b3d41ddaba4099d40a8af5d2c8d902ad674b9b5cacfc667360780

                                                              • C:\Users\Admin\AppData\Local\Temp\passwords_0.db

                                                                Filesize

                                                                40KB

                                                                MD5

                                                                a182561a527f929489bf4b8f74f65cd7

                                                                SHA1

                                                                8cd6866594759711ea1836e86a5b7ca64ee8911f

                                                                SHA256

                                                                42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

                                                                SHA512

                                                                9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

                                                              • C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\Release\node_sqlite3.node

                                                                Filesize

                                                                1.8MB

                                                                MD5

                                                                66a65322c9d362a23cf3d3f7735d5430

                                                                SHA1

                                                                ed59f3e4b0b16b759b866ef7293d26a1512b952e

                                                                SHA256

                                                                f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c

                                                                SHA512

                                                                0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21

                                                              • memory/5808-170-0x00000207B15C0000-0x00000207B15C1000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/5808-172-0x00000207B15C0000-0x00000207B15C1000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/5808-171-0x00000207B15C0000-0x00000207B15C1000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/5808-176-0x00000207B15C0000-0x00000207B15C1000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/5808-179-0x00000207B15C0000-0x00000207B15C1000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/5808-182-0x00000207B15C0000-0x00000207B15C1000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/5808-181-0x00000207B15C0000-0x00000207B15C1000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/5808-180-0x00000207B15C0000-0x00000207B15C1000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/5808-178-0x00000207B15C0000-0x00000207B15C1000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/5808-177-0x00000207B15C0000-0x00000207B15C1000-memory.dmp

                                                                Filesize

                                                                4KB