e11811db10afadc6d917402d841b750dc66b91649657a5020adc81cd5d84a72c

Analysis

max time kernel
1340s
max time network
1701s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-12-2024 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Howlis executor.zip
Size

9.5MB
MD5

8065ee8f8c5ea3b3323ae807890429d4
SHA1

cb0f5cf2519c95530b155dc56a9a3d58386c3c8e
SHA256

e11811db10afadc6d917402d841b750dc66b91649657a5020adc81cd5d84a72c
SHA512

50cb20bc46f43b3e8ef8aea87fbce1aab84645446ed2e534a9db0e94304fdecaa1ac80edc8429c7073ef496dac9b9061fecee513bfa77db4f62f27643aebb7f1
SSDEEP

196608:9PyjcoEEVJWA8Rin6PgDRTF6wLhePLKDUS7bl3IdOnoUq+:9Py9WY6UXQe33OdO

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
2696	Howlis executor.exe
2200	Howlis executor.exe
672	Howlis executor.exe
2800	Howlis executor.exe
2284	Howlis executor.exe
572	Howlis executor.exe

Loads dropped DLL 32 IoCs

pid	Process
1860	7zFM.exe
2696	Howlis executor.exe
2200	Howlis executor.exe
2200	Howlis executor.exe
2200	Howlis executor.exe
2200	Howlis executor.exe
2200	Howlis executor.exe
2200	Howlis executor.exe
2200	Howlis executor.exe
1200	Process not Found
1200	Process not Found
1860	7zFM.exe
672	Howlis executor.exe
2800	Howlis executor.exe
2800	Howlis executor.exe
2800	Howlis executor.exe
2800	Howlis executor.exe
2800	Howlis executor.exe
2800	Howlis executor.exe
2800	Howlis executor.exe
1860	7zFM.exe
1200	Process not Found
1200	Process not Found
2284	Howlis executor.exe
572	Howlis executor.exe
572	Howlis executor.exe
572	Howlis executor.exe
572	Howlis executor.exe
572	Howlis executor.exe
572	Howlis executor.exe
572	Howlis executor.exe
1200	Process not Found

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2200-85-0x000007FEF62D0000-0x000007FEF6736000-memory.dmp	upx
behavioral1/files/0x000500000001a444-84.dat	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
1860	7zFM.exe
2200	Howlis executor.exe
2800	Howlis executor.exe
572	Howlis executor.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	1860	7zFM.exe
Token: 35	1860	7zFM.exe
Token: SeSecurityPrivilege	1860	7zFM.exe
Token: SeSecurityPrivilege	1860	7zFM.exe
Token: SeSecurityPrivilege	1860	7zFM.exe
Token: 33	1336	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1336	AUDIODG.EXE
Token: 33	1336	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1336	AUDIODG.EXE
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe
Token: SeShutdownPrivilege	2956	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
1860	7zFM.exe
1860	7zFM.exe
1860	7zFM.exe
1860	7zFM.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2696	1860	7zFM.exe	29
PID 1860 wrote to memory of 2696	1860	7zFM.exe	29
PID 1860 wrote to memory of 2696	1860	7zFM.exe	29
PID 2696 wrote to memory of 2200	2696	Howlis executor.exe	30
PID 2696 wrote to memory of 2200	2696	Howlis executor.exe	30
PID 2696 wrote to memory of 2200	2696	Howlis executor.exe	30
PID 1860 wrote to memory of 672	1860	7zFM.exe	31
PID 1860 wrote to memory of 672	1860	7zFM.exe	31
PID 1860 wrote to memory of 672	1860	7zFM.exe	31
PID 672 wrote to memory of 2800	672	Howlis executor.exe	32
PID 672 wrote to memory of 2800	672	Howlis executor.exe	32
PID 672 wrote to memory of 2800	672	Howlis executor.exe	32
PID 1860 wrote to memory of 2284	1860	7zFM.exe	33
PID 1860 wrote to memory of 2284	1860	7zFM.exe	33
PID 1860 wrote to memory of 2284	1860	7zFM.exe	33
PID 2284 wrote to memory of 572	2284	Howlis executor.exe	34
PID 2284 wrote to memory of 572	2284	Howlis executor.exe	34
PID 2284 wrote to memory of 572	2284	Howlis executor.exe	34
PID 2956 wrote to memory of 1348	2956	chrome.exe	39
PID 2956 wrote to memory of 1348	2956	chrome.exe	39
PID 2956 wrote to memory of 1348	2956	chrome.exe	39
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 1612	2956	chrome.exe	41
PID 2956 wrote to memory of 980	2956	chrome.exe	42
PID 2956 wrote to memory of 980	2956	chrome.exe	42
PID 2956 wrote to memory of 980	2956	chrome.exe	42
PID 2956 wrote to memory of 1484	2956	chrome.exe	43

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Howlis executor.zip"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Users\Admin\AppData\Local\Temp\7zO44725E47\Howlis executor.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO44725E47\Howlis executor.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Users\Admin\AppData\Local\Temp\7zO44725E47\Howlis executor.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO44725E47\Howlis executor.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: GetForegroundWindowSpam
    PID:2200
- C:\Users\Admin\AppData\Local\Temp\7zO44728D39\Howlis executor.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO44728D39\Howlis executor.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:672
- - C:\Users\Admin\AppData\Local\Temp\7zO44728D39\Howlis executor.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO44728D39\Howlis executor.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: GetForegroundWindowSpam
    PID:2800
- C:\Users\Admin\AppData\Local\Temp\7zO44755439\Howlis executor.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO44755439\Howlis executor.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Users\Admin\AppData\Local\Temp\7zO44755439\Howlis executor.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO44755439\Howlis executor.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: GetForegroundWindowSpam
    PID:572

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2608

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x45c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7fc9758,0x7fef7fc9768,0x7fef7fc9778
  2⤵
  PID:1348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1156 --field-trial-handle=1368,i,16141060048669870806,9361528431404631941,131072 /prefetch:2
  2⤵
  PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1368,i,16141060048669870806,9361528431404631941,131072 /prefetch:8
  2⤵
  PID:980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1588 --field-trial-handle=1368,i,16141060048669870806,9361528431404631941,131072 /prefetch:8
  2⤵
  PID:1484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2224 --field-trial-handle=1368,i,16141060048669870806,9361528431404631941,131072 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2236 --field-trial-handle=1368,i,16141060048669870806,9361528431404631941,131072 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2808 --field-trial-handle=1368,i,16141060048669870806,9361528431404631941,131072 /prefetch:2
  2⤵
  PID:2592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2852 --field-trial-handle=1368,i,16141060048669870806,9361528431404631941,131072 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3640 --field-trial-handle=1368,i,16141060048669870806,9361528431404631941,131072 /prefetch:8
  2⤵
  PID:2168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3728 --field-trial-handle=1368,i,16141060048669870806,9361528431404631941,131072 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3820 --field-trial-handle=1368,i,16141060048669870806,9361528431404631941,131072 /prefetch:8
  2⤵
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3928 --field-trial-handle=1368,i,16141060048669870806,9361528431404631941,131072 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3716 --field-trial-handle=1368,i,16141060048669870806,9361528431404631941,131072 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3860 --field-trial-handle=1368,i,16141060048669870806,9361528431404631941,131072 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2428 --field-trial-handle=1368,i,16141060048669870806,9361528431404631941,131072 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3824 --field-trial-handle=1368,i,16141060048669870806,9361528431404631941,131072 /prefetch:1
  2⤵
  PID:3004

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
b2e67042ada064af26b073678c68a0fa

SHA1
49f4c35480d5d5771afbc576b1d6f3dd7484d852

SHA256
80d0d94666b7053eb4e13154f7446473dc08805c1fcec70536f57bbb7c9f9059

SHA512
c45d8ba3e364e80dd99c5c0031f7254e58eacff89f62983b9a2580ee8e4a3545b983e96dfcc56292dead0ac7fb8f5652bbacee11a6aee7921bdbec5cbd81d2fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
7c515e2782222578183f3e0447f9a937

SHA1
05ef1cc3ab89e2b94daff22691ec75ce949ca157

SHA256
eba4bfa70e9e4c7452fedd24a058064dc79065e62f511ab1af4cc7f59f4766e6

SHA512
7600bf904659044f9569ff67de21c82edfb7aaf86fd400b229d998f0647e9f48b3f1464116b426695d8f35d65525565e9253fefd9c244880bfa52506fba6fdd5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
f96e684b32911f0a0835e2a74efa2f01

SHA1
5cbd914f3e44db42c06b7d828f1465a70d89feab

SHA256
d3ec93964ff128155a1725fd6ea069943dd27772ca9fb3b5b842e42f12c91143

SHA512
5e4da1651d5bc0c1cb6bdf409f8afa7654d6da773a542d27c50f70cea7bf45d9efb562848c2c5fed35fcb235fba7eeb5b379d2fff8575dda59ff0aa161d5e33b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
9bc868ab48afc31342d632bb5b50b0ab

SHA1
67b0b47f4e3e6628b5aa03c5662b752f22e0d1d4

SHA256
acb6b11ae8123857fea9918e39645468efc0e82e281e171ce7e000af5787139d

SHA512
d89580ec4b8a38313e790b9820318901b09d203ccb8c02023a9f911d6ff86af2a9706e952c0a5bcc05183a90b76655fb296e018ef643917e693cac2cb0b255f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
361B

MD5
c88d26cfe65fe0ae3cbb0ea25d7389e7

SHA1
f376e252058db7e48d0743beacd425709229f9ce

SHA256
68c8c4d7896c117175a85882380fc648b0beffff737a61e5bb0956d7e427fd0b

SHA512
9fe430c1589968474257dcb91c299cc061abe867d970d35c3320164e4710acfc67203628bbec6a9738900744db80df8ff4355d33943effd90d1232349afa564a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1004B

MD5
d0fbd10893d037fbef9c71b2572537e7

SHA1
e88ec2ed76adc881bb263e7c849b0b0ae9cf3b13

SHA256
f3cf21f2055d8bff7402b5d6f439ee47eb33275708dbebf576700842a737ecbf

SHA512
9d6bf1bb844fd2b66eaa2d2581cf42443d6ff8f1573763770b5e857b8260cb467be74d89a3e969bb641321b1f557e937715b7135d41399e311bcb1f3dd6635ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
11fc0fc78a19111b63e17bc93afbf0cc

SHA1
d0642ef7f13604b46166a5bbbc2949e602e9b2ca

SHA256
95471dd3e2dadd01fc73128a9c32e2e9ed1cbc10effeb1079e3577454f9e0390

SHA512
bad9e68fab1477927760508086516f2f107299a24b30fe0f74e98ad2fd50603dd9327684d77ab4a7d3bddb042245f52ae699b84117b99f8c506638f648f98460

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
1185d03a0e793e0159b0884f1bb2c9af

SHA1
5c1504852b81ec6f965c6d622ed973ea332b7f0a

SHA256
602a3cc15eff3053afd7554c6cd0603a0eae7c6782bedc89a6da7846eb854757

SHA512
dbf461db13c324be2a6b9c218278e0ae538cdd6becebb72da4e1e25adbb330b08258c2aece520a8b4d8c82383f06ce10886e282b32de256c8818c20b7698ae94

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
3b24d6f1a70122b4d9e99e2423f4ac0b

SHA1
3a3ee4a327c5dc2cd9eeff7ec63a3d8dbcbcf4c0

SHA256
664240dc5ccb059a01c6025ded54a5946fff0e2211adbddc3e74ce8e2fe5fef4

SHA512
1e7137c7f777220685f5112f845890ac84fd3470bf524e1fcba92b92d2b02bc7e52f6c1384b3dc112c9cbcb7404fcde380685c42248ecda9ac79bd6b0b188d15

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
344KB

MD5
9f16c63f9802caf88430a09486fd0692

SHA1
ecb71ebeaa9d5cdb6b670265a7d5943e9b554662

SHA256
8e17542e3575e294d611479e6d01e6eb8b9fa2a316de42fee3e2936db6c50f36

SHA512
9d01a39cb5676fdc23ee93d35606869c64a343baf84bd162f31581c62075a65dff51d01fd36b008183ebab1c87b6a66dc745d01829f19be68733df4bb48c502d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO44725E47\Howlis executor.exe

Filesize
8.0MB

MD5
f1ca5255649ddad16f45692c7008f5ee

SHA1
5c01084da7bca0482b46095ca52d59b610225ce2

SHA256
1a4205f6c5a0bbae1d88ee3cc83b6be6c96c35c129b5c6f1792e176c503be723

SHA512
07571d2496fb412ed6aa1540c6bd7a80d6f18e7e17e6b86509fd4b25d566c2761dc9264031385f1be8799431effa2575384ab7dcc0bb02e8f5810a1081a07f00

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC94A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC95D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI26962\api-ms-win-core-file-l1-2-0.dll

Filesize
21KB

MD5
3473bc217562594b5b126d7aeb9380e9

SHA1
b551b9d9aa80be070f577376e484610e01c5171a

SHA256
0d8190fd619feb20df123931108d499132f7051f1ebb0ef246082f4c52c88b22

SHA512
036b93457ade632ad68264d81ff26ee1156038e234c606882386d6babcbe722a18e9ced1655f97caecaf5fd514e261dafe999a3e9fec00cc677e177f0bf8e203

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI26962\api-ms-win-core-file-l2-1-0.dll

Filesize
20KB

MD5
50abf0a7ee67f00f247bada185a7661c

SHA1
0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1

SHA256
f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7

SHA512
c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI26962\api-ms-win-core-localization-l1-2-0.dll

Filesize
21KB

MD5
0414909b279ea61ca344edbe8e33e40b

SHA1
4ece0dabe954c43f9bd5032de76ec29c47b22e10

SHA256
05b0c773a77850f3d50ddb4b82cc4d5f19316fe1aaa65e21b4709ae73f60a28e

SHA512
edbd33540cd1ef69f2ce824cfb991903ec6e4edda815f07d610247594ceeb2ebc78f05a44b4de8c5c937191b7e8b2ef221423c06df303d73deea721c25d15eed

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI26962\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
21KB

MD5
b1ba47d8389c40c2dda3c56cbed14fc5

SHA1
2eef9ffa32171d53affa44e3db7727aa383f7fac

SHA256
c7277c05dc6b905fad5cb930b0ecfbbc4676b46974b4571e54ca44cb6f6be404

SHA512
466e31f17f73bda5149343b23f4966502a8597d2a2e43f9a6c9c32387451d92c6b658ccaae27044e68e4a9fd0ef9c89e32dc7639d59fcf04c596b6abfa09658b

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI26962\api-ms-win-core-timezone-l1-1-0.dll

Filesize
21KB

MD5
953c63ef10ec30ef7c89a6f0f7074041

SHA1
4b4f1ff3085fded9dbd737f273585ad43175b0a3

SHA256
c93954167c12e15b58ac95240d2e0a2fbd94561d739d9f6aca906d9c30453496

SHA512
b4534785e4d02ad387e3c6082884d438cc4b3cd8758aabcf99620052f5842dbd298351bc1723c274d4f7d3fce0cc940df3d47865fece2f07cdb1151376ba852e

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI26962\python310.dll

Filesize
1.4MB

MD5
4a6afa2200b1918c413d511c5a3c041c

SHA1
39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3

SHA256
bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da

SHA512
dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI26962\ucrtbase.dll

Filesize
1.1MB

MD5
3b337c2d41069b0a1e43e30f891c3813

SHA1
ebee2827b5cb153cbbb51c9718da1549fa80fc5c

SHA256
c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7

SHA512
fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499

Download Submit
memory/2200-85-0x000007FEF62D0000-0x000007FEF6736000-memory.dmp

Filesize
4.4MB

Download