Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3NEW_0RDERL...24.exe
windows7-x64
10NEW_0RDERL...24.exe
windows10-2004-x64
10[2024]第 ......exe
windows7-x64
3[2024]第 ......exe
windows10-2004-x64
3signtest_modified.exe
windows7-x64
1signtest_modified.exe
windows10-2004-x64
10uninstall-...05.exe
windows7-x64
3uninstall-...05.exe
windows10-2004-x64
3表 格-uninstall.exe
windows7-x64
10表 格-uninstall.exe
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/12/2024, 08:17
Static task
static1
Behavioral task
behavioral1
Sample
NEW_0RDERLISTDEC2024.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
NEW_0RDERLISTDEC2024.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
[2024]第 082 号 文..。.。...exe
Resource
win7-20241023-en
Behavioral task
behavioral4
Sample
[2024]第 082 号 文..。.。...exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
signtest_modified.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
signtest_modified.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
uninstall-查询1205.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
uninstall-查询1205.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
表 格-uninstall.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
表 格-uninstall.exe
Resource
win10v2004-20241007-en
General
-
Target
NEW_0RDERLISTDEC2024.exe
-
Size
1016KB
-
MD5
907f9ec00dae9c158416379d2b961bd6
-
SHA1
40bb66f564f34037a25cd55e0a6da67abe09d7c0
-
SHA256
2bfe76169602cd81c584da62335fd8f3bd94a8693e20c9fb2f1f3dfa5cd43130
-
SHA512
67c95bfe6dbf36d9de67159f43a5f437ea818cec18502fac8cfc657abe5457980bf3037fcec4350487385d7a8047d7df9018cc7a93757787ee31e1b234fa4b05
-
SSDEEP
24576:I/fiNRFxKsPwGuRWNoYPe+7injApBoQ81RzC:I/KDzlwJoyYWW8AAlRzC
Malware Config
Extracted
remcos
TONY
85.31.47.62:45356
127.0.0.1:45356
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-0ZKXJG
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Detected Nirsoft tools 3 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral1/memory/2844-65-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/1760-66-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral1/memory/1804-60-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral1/memory/1804-60-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral1/memory/2844-65-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2820 powershell.exe 3032 powershell.exe -
Uses browser remote debugging 2 TTPs 4 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 688 Chrome.exe 468 Chrome.exe 1104 Chrome.exe 1336 Chrome.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts NEW_0RDERLISTDEC2024.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2640 set thread context of 1624 2640 NEW_0RDERLISTDEC2024.exe 36 PID 1624 set thread context of 2844 1624 NEW_0RDERLISTDEC2024.exe 39 PID 1624 set thread context of 1804 1624 NEW_0RDERLISTDEC2024.exe 40 PID 1624 set thread context of 1760 1624 NEW_0RDERLISTDEC2024.exe 41 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEW_0RDERLISTDEC2024.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEW_0RDERLISTDEC2024.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEW_0RDERLISTDEC2024.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEW_0RDERLISTDEC2024.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEW_0RDERLISTDEC2024.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer Chrome.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1048 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 2640 NEW_0RDERLISTDEC2024.exe 2640 NEW_0RDERLISTDEC2024.exe 2640 NEW_0RDERLISTDEC2024.exe 2820 powershell.exe 3032 powershell.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 2844 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 688 Chrome.exe 688 Chrome.exe 2844 NEW_0RDERLISTDEC2024.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1624 NEW_0RDERLISTDEC2024.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe 1624 NEW_0RDERLISTDEC2024.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 2640 NEW_0RDERLISTDEC2024.exe Token: SeDebugPrivilege 2820 powershell.exe Token: SeDebugPrivilege 3032 powershell.exe Token: SeDebugPrivilege 1760 NEW_0RDERLISTDEC2024.exe Token: SeShutdownPrivilege 688 Chrome.exe Token: SeShutdownPrivilege 688 Chrome.exe Token: SeShutdownPrivilege 688 Chrome.exe Token: SeShutdownPrivilege 688 Chrome.exe Token: SeShutdownPrivilege 688 Chrome.exe Token: SeShutdownPrivilege 688 Chrome.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 688 Chrome.exe 688 Chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2640 wrote to memory of 2820 2640 NEW_0RDERLISTDEC2024.exe 30 PID 2640 wrote to memory of 2820 2640 NEW_0RDERLISTDEC2024.exe 30 PID 2640 wrote to memory of 2820 2640 NEW_0RDERLISTDEC2024.exe 30 PID 2640 wrote to memory of 2820 2640 NEW_0RDERLISTDEC2024.exe 30 PID 2640 wrote to memory of 3032 2640 NEW_0RDERLISTDEC2024.exe 32 PID 2640 wrote to memory of 3032 2640 NEW_0RDERLISTDEC2024.exe 32 PID 2640 wrote to memory of 3032 2640 NEW_0RDERLISTDEC2024.exe 32 PID 2640 wrote to memory of 3032 2640 NEW_0RDERLISTDEC2024.exe 32 PID 2640 wrote to memory of 1048 2640 NEW_0RDERLISTDEC2024.exe 34 PID 2640 wrote to memory of 1048 2640 NEW_0RDERLISTDEC2024.exe 34 PID 2640 wrote to memory of 1048 2640 NEW_0RDERLISTDEC2024.exe 34 PID 2640 wrote to memory of 1048 2640 NEW_0RDERLISTDEC2024.exe 34 PID 2640 wrote to memory of 1624 2640 NEW_0RDERLISTDEC2024.exe 36 PID 2640 wrote to memory of 1624 2640 NEW_0RDERLISTDEC2024.exe 36 PID 2640 wrote to memory of 1624 2640 NEW_0RDERLISTDEC2024.exe 36 PID 2640 wrote to memory of 1624 2640 NEW_0RDERLISTDEC2024.exe 36 PID 2640 wrote to memory of 1624 2640 NEW_0RDERLISTDEC2024.exe 36 PID 2640 wrote to memory of 1624 2640 NEW_0RDERLISTDEC2024.exe 36 PID 2640 wrote to memory of 1624 2640 NEW_0RDERLISTDEC2024.exe 36 PID 2640 wrote to memory of 1624 2640 NEW_0RDERLISTDEC2024.exe 36 PID 2640 wrote to memory of 1624 2640 NEW_0RDERLISTDEC2024.exe 36 PID 2640 wrote to memory of 1624 2640 NEW_0RDERLISTDEC2024.exe 36 PID 2640 wrote to memory of 1624 2640 NEW_0RDERLISTDEC2024.exe 36 PID 1624 wrote to memory of 688 1624 NEW_0RDERLISTDEC2024.exe 37 PID 1624 wrote to memory of 688 1624 NEW_0RDERLISTDEC2024.exe 37 PID 1624 wrote to memory of 688 1624 NEW_0RDERLISTDEC2024.exe 37 PID 1624 wrote to memory of 688 1624 NEW_0RDERLISTDEC2024.exe 37 PID 688 wrote to memory of 2532 688 Chrome.exe 38 PID 688 wrote to memory of 2532 688 Chrome.exe 38 PID 688 wrote to memory of 2532 688 Chrome.exe 38 PID 1624 wrote to memory of 2844 1624 NEW_0RDERLISTDEC2024.exe 39 PID 1624 wrote to memory of 2844 1624 NEW_0RDERLISTDEC2024.exe 39 PID 1624 wrote to memory of 2844 1624 NEW_0RDERLISTDEC2024.exe 39 PID 1624 wrote to memory of 2844 1624 NEW_0RDERLISTDEC2024.exe 39 PID 1624 wrote to memory of 2844 1624 NEW_0RDERLISTDEC2024.exe 39 PID 1624 wrote to memory of 1804 1624 NEW_0RDERLISTDEC2024.exe 40 PID 1624 wrote to memory of 1804 1624 NEW_0RDERLISTDEC2024.exe 40 PID 1624 wrote to memory of 1804 1624 NEW_0RDERLISTDEC2024.exe 40 PID 1624 wrote to memory of 1804 1624 NEW_0RDERLISTDEC2024.exe 40 PID 1624 wrote to memory of 1804 1624 NEW_0RDERLISTDEC2024.exe 40 PID 1624 wrote to memory of 1760 1624 NEW_0RDERLISTDEC2024.exe 41 PID 1624 wrote to memory of 1760 1624 NEW_0RDERLISTDEC2024.exe 41 PID 1624 wrote to memory of 1760 1624 NEW_0RDERLISTDEC2024.exe 41 PID 1624 wrote to memory of 1760 1624 NEW_0RDERLISTDEC2024.exe 41 PID 1624 wrote to memory of 1760 1624 NEW_0RDERLISTDEC2024.exe 41 PID 688 wrote to memory of 324 688 Chrome.exe 43 PID 688 wrote to memory of 324 688 Chrome.exe 43 PID 688 wrote to memory of 324 688 Chrome.exe 43 PID 688 wrote to memory of 324 688 Chrome.exe 43 PID 688 wrote to memory of 324 688 Chrome.exe 43 PID 688 wrote to memory of 324 688 Chrome.exe 43 PID 688 wrote to memory of 324 688 Chrome.exe 43 PID 688 wrote to memory of 324 688 Chrome.exe 43 PID 688 wrote to memory of 324 688 Chrome.exe 43 PID 688 wrote to memory of 324 688 Chrome.exe 43 PID 688 wrote to memory of 324 688 Chrome.exe 43 PID 688 wrote to memory of 324 688 Chrome.exe 43 PID 688 wrote to memory of 324 688 Chrome.exe 43 PID 688 wrote to memory of 324 688 Chrome.exe 43 PID 688 wrote to memory of 324 688 Chrome.exe 43 PID 688 wrote to memory of 324 688 Chrome.exe 43 PID 688 wrote to memory of 324 688 Chrome.exe 43 PID 688 wrote to memory of 324 688 Chrome.exe 43 PID 688 wrote to memory of 324 688 Chrome.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW_0RDERLISTDEC2024.exe"C:\Users\Admin\AppData\Local\Temp\NEW_0RDERLISTDEC2024.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\NEW_0RDERLISTDEC2024.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2820
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RAeOxxfxjlB.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3032
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RAeOxxfxjlB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4FA6.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1048
-
-
C:\Users\Admin\AppData\Local\Temp\NEW_0RDERLISTDEC2024.exe"C:\Users\Admin\AppData\Local\Temp\NEW_0RDERLISTDEC2024.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Program Files\Google\Chrome\Application\Chrome.exe--user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"3⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Program Files\Google\Chrome\Application\Chrome.exe"C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x7fef7cd9758,0x7fef7cd9768,0x7fef7cd97784⤵PID:2532
-
-
C:\Program Files\Google\Chrome\Application\Chrome.exe"C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1260,i,9528392407525201290,8456409923340898094,131072 /prefetch:24⤵PID:324
-
-
C:\Program Files\Google\Chrome\Application\Chrome.exe"C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1468 --field-trial-handle=1260,i,9528392407525201290,8456409923340898094,131072 /prefetch:84⤵PID:2124
-
-
C:\Program Files\Google\Chrome\Application\Chrome.exe"C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1552 --field-trial-handle=1260,i,9528392407525201290,8456409923340898094,131072 /prefetch:84⤵PID:720
-
-
C:\Program Files\Google\Chrome\Application\Chrome.exe"C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2068 --field-trial-handle=1260,i,9528392407525201290,8456409923340898094,131072 /prefetch:14⤵
- Uses browser remote debugging
PID:468
-
-
C:\Program Files\Google\Chrome\Application\Chrome.exe"C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2092 --field-trial-handle=1260,i,9528392407525201290,8456409923340898094,131072 /prefetch:14⤵
- Uses browser remote debugging
PID:1104
-
-
C:\Program Files\Google\Chrome\Application\Chrome.exe"C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2388 --field-trial-handle=1260,i,9528392407525201290,8456409923340898094,131072 /prefetch:14⤵
- Uses browser remote debugging
PID:1336
-
-
C:\Program Files\Google\Chrome\Application\Chrome.exe"C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1332 --field-trial-handle=1260,i,9528392407525201290,8456409923340898094,131072 /prefetch:24⤵PID:2344
-
-
C:\Program Files\Google\Chrome\Application\Chrome.exe"C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3500 --field-trial-handle=1260,i,9528392407525201290,8456409923340898094,131072 /prefetch:84⤵PID:3036
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEW_0RDERLISTDEC2024.exeC:\Users\Admin\AppData\Local\Temp\NEW_0RDERLISTDEC2024.exe /stext "C:\Users\Admin\AppData\Local\Temp\ylbwpqjexaxryrsonzka"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2844
-
-
C:\Users\Admin\AppData\Local\Temp\NEW_0RDERLISTDEC2024.exeC:\Users\Admin\AppData\Local\Temp\NEW_0RDERLISTDEC2024.exe /stext "C:\Users\Admin\AppData\Local\Temp\inghqibgtipwifgswkfcyuz"3⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
PID:1804
-
-
C:\Users\Admin\AppData\Local\Temp\NEW_0RDERLISTDEC2024.exeC:\Users\Admin\AppData\Local\Temp\NEW_0RDERLISTDEC2024.exe /stext "C:\Users\Admin\AppData\Local\Temp\lhmzrbmahqhallcwnvsvbyuxbj"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1760
-
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1268
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40B
MD5dc3d493b7334985e634026a48ad06d83
SHA13d282c8edb7fe183914d133f39eb7ab763134283
SHA256b507c404a90752f2c05caa00b7732a026e437c6aeb1bee201485806b65a5a292
SHA5123fd2e0222eb65b669499b817d74fa99b7a9091f2654cfe2c27b810674353a4fbe9ad19f9eb842cc227fc927c719b8bf8dcadaa27f70231e23954749a057086f9
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
20KB
MD5c9ff7748d8fcef4cf84a5501e996a641
SHA102867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA2564d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
SHA512d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73
-
Filesize
10KB
MD54de53fd1ecb25e50d1cd818780bd1a23
SHA1e8c23580de1ffa9bf9771c26e408b99c872b3e76
SHA256b2fc4d9dfb2130583cbd74c438a526223adad36c356941ff6bdf4d9bc127a78f
SHA512b211436e40698f602bdb5bc0b445118efc8ebe8aa0546e03244c6c9d98a6f4132b88610f5fdc1f8a73ab81b534172e873d69c0ad8aebb2a15cacaad88b8cfc2e
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
169KB
MD53f44416c0b5aea98e02381c3f0d160e4
SHA12e1a3ad91d66e230465609c462ffe3c21c251d99
SHA2567342049c01c77365d307003ac0721a7ac47e240777185d96c109247f1465f131
SHA512ec1fccde252b641408fa55cb5a680c68bb7b32eb6b25c3eccb2d1542a41456651f1f17f565f2d8941ba43f45b690fee206758a4c80188ada71184525581c1c1d
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
1KB
MD5271767cf130de8406200cd4893369188
SHA13f940c828cfb4a6f241e1185085b112f807b0acb
SHA256ee414388bfaa42d250e965e538ed38d554b54260abf6db7b3e02092115e98953
SHA512041647f146320e186c23c5e548807150853148301b8863e3dbf55f3535f551223c289c6abbcb0ae0c8a6e1ed62c69640eb7e105b353af28c32bf809aba099405
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5036a738d4ed566ae613ccefa31975bc1
SHA19938d38bca645a861c0d753b29562b400e9d57d1
SHA2569cf8abec037c8c3b1cc9b5ead46cff8f1f22d0f64d031fb1e4e0e4811664ddb7
SHA51297ca653975ad0d169ebd1d875c8f2815ce30fcfd133b877c8f7534119fd3d5e7760d3ab51cf9230e2bc5f66399a92e2e999ff616f832c77e8ee431dfa734f5c2