Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02/01/2025, 19:54
Static task
static1
Behavioral task
behavioral1
Sample
earlyBuild.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
earlyBuild.exe
Resource
win10v2004-20241007-en
General
-
Target
earlyBuild.exe
-
Size
6.1MB
-
MD5
c78621d331c1b49744b469ba7dd7f414
-
SHA1
83eb55f7728c7f9d7cd83d398ab1ced176b082b6
-
SHA256
912e2b3852a85d651a08efe238290f759bbadebbc79772b989aaa57b5857e4ee
-
SHA512
cd195b0338659e8d295f9ed2eb8d3002487c3c1320935197dfbcc195e2af8940aec8933251f2e4df3a91ebeeba2fa8074f51b606ccb040200476e6ac467ee0d0
-
SSDEEP
196608:bSkSIlLTUcwti7TQl2NgVg01MWAXAkuujCPX9YG9he5GnQCAJKN:OkSopwtQQl2aOtXADu8X9Y95GQLJ
Malware Config
Extracted
asyncrat
1.0.7
Default
51.89.44.68:8848
etb3t1tr5n
-
delay
1
-
install
true
-
install_file
svchost.exe
-
install_folder
%Temp%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000b000000023b72-7.dat family_asyncrat -
Downloads MZ/PE file
-
Uses browser remote debugging 2 TTPs 7 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 1544 chrome.exe 1600 chrome.exe 4344 chrome.exe 392 chrome.exe 3496 msedge.exe 1372 msedge.exe 1116 chrome.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation earlyBuild.exe -
Executes dropped EXE 5 IoCs
pid Process 3984 svchost.exe 1952 svchost.exe 2436 svchost.exe 5060 svchost.exe 4132 svchost.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 earlyBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 earlyBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 earlyBuild.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 7 raw.githubusercontent.com 8 raw.githubusercontent.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 45 icanhazip.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 3640 cmd.exe 2004 netsh.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 earlyBuild.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier earlyBuild.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 440 timeout.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Kills process with taskkill 1 IoCs
pid Process 3036 taskkill.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133803212633085767" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 700 earlyBuild.exe 700 earlyBuild.exe 700 earlyBuild.exe 700 earlyBuild.exe 700 earlyBuild.exe 700 earlyBuild.exe 700 earlyBuild.exe 700 earlyBuild.exe 700 earlyBuild.exe 700 earlyBuild.exe 700 earlyBuild.exe 700 earlyBuild.exe 700 earlyBuild.exe 1116 chrome.exe 1116 chrome.exe 700 earlyBuild.exe 700 earlyBuild.exe 700 earlyBuild.exe 700 earlyBuild.exe 700 earlyBuild.exe 700 earlyBuild.exe 700 earlyBuild.exe 700 earlyBuild.exe 700 earlyBuild.exe 700 earlyBuild.exe 700 earlyBuild.exe 700 earlyBuild.exe 700 earlyBuild.exe 700 earlyBuild.exe 700 earlyBuild.exe 4392 msedge.exe 4392 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 700 earlyBuild.exe Token: SeIncreaseQuotaPrivilege 3984 svchost.exe Token: SeSecurityPrivilege 3984 svchost.exe Token: SeTakeOwnershipPrivilege 3984 svchost.exe Token: SeLoadDriverPrivilege 3984 svchost.exe Token: SeSystemProfilePrivilege 3984 svchost.exe Token: SeSystemtimePrivilege 3984 svchost.exe Token: SeProfSingleProcessPrivilege 3984 svchost.exe Token: SeIncBasePriorityPrivilege 3984 svchost.exe Token: SeCreatePagefilePrivilege 3984 svchost.exe Token: SeBackupPrivilege 3984 svchost.exe Token: SeRestorePrivilege 3984 svchost.exe Token: SeShutdownPrivilege 3984 svchost.exe Token: SeDebugPrivilege 3984 svchost.exe Token: SeSystemEnvironmentPrivilege 3984 svchost.exe Token: SeRemoteShutdownPrivilege 3984 svchost.exe Token: SeUndockPrivilege 3984 svchost.exe Token: SeManageVolumePrivilege 3984 svchost.exe Token: 33 3984 svchost.exe Token: 34 3984 svchost.exe Token: 35 3984 svchost.exe Token: 36 3984 svchost.exe Token: SeIncreaseQuotaPrivilege 1952 svchost.exe Token: SeSecurityPrivilege 1952 svchost.exe Token: SeTakeOwnershipPrivilege 1952 svchost.exe Token: SeLoadDriverPrivilege 1952 svchost.exe Token: SeSystemProfilePrivilege 1952 svchost.exe Token: SeSystemtimePrivilege 1952 svchost.exe Token: SeProfSingleProcessPrivilege 1952 svchost.exe Token: SeIncBasePriorityPrivilege 1952 svchost.exe Token: SeCreatePagefilePrivilege 1952 svchost.exe Token: SeBackupPrivilege 1952 svchost.exe Token: SeRestorePrivilege 1952 svchost.exe Token: SeShutdownPrivilege 1952 svchost.exe Token: SeDebugPrivilege 1952 svchost.exe Token: SeSystemEnvironmentPrivilege 1952 svchost.exe Token: SeRemoteShutdownPrivilege 1952 svchost.exe Token: SeUndockPrivilege 1952 svchost.exe Token: SeManageVolumePrivilege 1952 svchost.exe Token: 33 1952 svchost.exe Token: 34 1952 svchost.exe Token: 35 1952 svchost.exe Token: 36 1952 svchost.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeSecurityPrivilege 3124 msiexec.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeIncreaseQuotaPrivilege 2436 svchost.exe Token: SeSecurityPrivilege 2436 svchost.exe Token: SeTakeOwnershipPrivilege 2436 svchost.exe Token: SeLoadDriverPrivilege 2436 svchost.exe Token: SeSystemProfilePrivilege 2436 svchost.exe Token: SeSystemtimePrivilege 2436 svchost.exe Token: SeProfSingleProcessPrivilege 2436 svchost.exe Token: SeIncBasePriorityPrivilege 2436 svchost.exe Token: SeCreatePagefilePrivilege 2436 svchost.exe Token: SeBackupPrivilege 2436 svchost.exe Token: SeRestorePrivilege 2436 svchost.exe Token: SeShutdownPrivilege 2436 svchost.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1116 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 700 wrote to memory of 3984 700 earlyBuild.exe 84 PID 700 wrote to memory of 3984 700 earlyBuild.exe 84 PID 700 wrote to memory of 1952 700 earlyBuild.exe 90 PID 700 wrote to memory of 1952 700 earlyBuild.exe 90 PID 700 wrote to memory of 1116 700 earlyBuild.exe 95 PID 700 wrote to memory of 1116 700 earlyBuild.exe 95 PID 1116 wrote to memory of 1616 1116 chrome.exe 96 PID 1116 wrote to memory of 1616 1116 chrome.exe 96 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4516 1116 chrome.exe 97 PID 1116 wrote to memory of 4640 1116 chrome.exe 98 PID 1116 wrote to memory of 4640 1116 chrome.exe 98 PID 1116 wrote to memory of 460 1116 chrome.exe 99 PID 1116 wrote to memory of 460 1116 chrome.exe 99 PID 1116 wrote to memory of 460 1116 chrome.exe 99 PID 1116 wrote to memory of 460 1116 chrome.exe 99 PID 1116 wrote to memory of 460 1116 chrome.exe 99 PID 1116 wrote to memory of 460 1116 chrome.exe 99 PID 1116 wrote to memory of 460 1116 chrome.exe 99 PID 1116 wrote to memory of 460 1116 chrome.exe 99 PID 1116 wrote to memory of 460 1116 chrome.exe 99 PID 1116 wrote to memory of 460 1116 chrome.exe 99 PID 1116 wrote to memory of 460 1116 chrome.exe 99 PID 1116 wrote to memory of 460 1116 chrome.exe 99 PID 1116 wrote to memory of 460 1116 chrome.exe 99 PID 1116 wrote to memory of 460 1116 chrome.exe 99 PID 1116 wrote to memory of 460 1116 chrome.exe 99 PID 1116 wrote to memory of 460 1116 chrome.exe 99 PID 1116 wrote to memory of 460 1116 chrome.exe 99 PID 1116 wrote to memory of 460 1116 chrome.exe 99 PID 1116 wrote to memory of 460 1116 chrome.exe 99 PID 1116 wrote to memory of 460 1116 chrome.exe 99 PID 1116 wrote to memory of 460 1116 chrome.exe 99 PID 1116 wrote to memory of 460 1116 chrome.exe 99 PID 1116 wrote to memory of 460 1116 chrome.exe 99 PID 1116 wrote to memory of 460 1116 chrome.exe 99 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 earlyBuild.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 earlyBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\earlyBuild.exe"C:\Users\Admin\AppData\Local\Temp\earlyBuild.exe"1⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:700 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3984
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --headless=new --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --disable-gpu --disable-logging2⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbc002cc40,0x7ffbc002cc4c,0x7ffbc002cc583⤵PID:1616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-logging --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --disable-logging --field-trial-handle=1908,i,1941289285167755901,3031991283510865802,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1904 /prefetch:23⤵PID:4516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --field-trial-handle=2084,i,1941289285167755901,3031991283510865802,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2088 /prefetch:33⤵PID:4640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --field-trial-handle=2176,i,1941289285167755901,3031991283510865802,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2136 /prefetch:83⤵PID:460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,1941289285167755901,3031991283510865802,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3100 /prefetch:13⤵
- Uses browser remote debugging
PID:1600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3104,i,1941289285167755901,3031991283510865802,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3140 /prefetch:13⤵
- Uses browser remote debugging
PID:1544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4404,i,1941289285167755901,3031991283510865802,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4064 /prefetch:13⤵
- Uses browser remote debugging
PID:4344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --field-trial-handle=4680,i,1941289285167755901,3031991283510865802,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4568 /prefetch:83⤵PID:4256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --field-trial-handle=4784,i,1941289285167755901,3031991283510865802,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4792 /prefetch:83⤵PID:2588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --field-trial-handle=4576,i,1941289285167755901,3031991283510865802,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4696 /prefetch:83⤵PID:4264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --field-trial-handle=4996,i,1941289285167755901,3031991283510865802,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4972 /prefetch:83⤵PID:4020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --field-trial-handle=5000,i,1941289285167755901,3031991283510865802,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5144 /prefetch:83⤵PID:3636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --field-trial-handle=5304,i,1941289285167755901,3031991283510865802,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5316 /prefetch:83⤵PID:2440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --no-appcompat-clear --disable-logging --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5252,i,1941289285167755901,3031991283510865802,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5232 /prefetch:23⤵
- Uses browser remote debugging
PID:392
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- System Network Configuration Discovery: Wi-Fi Discovery
PID:3640 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:5024
-
-
C:\Windows\system32\netsh.exenetsh wlan show profile3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:2004
-
-
C:\Windows\system32\findstr.exefindstr All3⤵PID:2128
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid2⤵PID:3008
-
C:\Windows\system32\chcp.comchcp 650013⤵PID:3712
-
-
C:\Windows\system32\netsh.exenetsh wlan show networks mode=bssid3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:616
-
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --headless=new --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --disable-gpu --disable-logging2⤵
- Uses browser remote debugging
PID:3496 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffbbf8846f8,0x7ffbbf884708,0x7ffbbf8847183⤵PID:2004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1412,13442869431359981068,6012292069651815604,131072 --disable-features=PaintHolding --disable-logging --headless=new --headless --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --override-use-software-gl-for-tests --disable-logging --mojo-platform-channel-handle=1464 /prefetch:23⤵PID:2720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1412,13442869431359981068,6012292069651815604,131072 --disable-features=PaintHolding --lang=en-US --service-sandbox-type=none --use-gl=swiftshader-webgl --headless --disable-logging --mojo-platform-channel-handle=1836 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:4392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-logging --remote-debugging-port=9222 --allow-pre-commit-input --field-trial-handle=1412,13442869431359981068,6012292069651815604,131072 --disable-features=PaintHolding --disable-gpu-compositing --lang=en-US --headless --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2012 /prefetch:13⤵
- Uses browser remote debugging
PID:1372
-
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Executes dropped EXE
PID:5060
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Executes dropped EXE
PID:4132
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6ca1e6fb-a083-4fec-9f29-699a7abc708c.bat"2⤵PID:1816
-
C:\Windows\system32\chcp.comchcp 650013⤵PID:1444
-
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 7003⤵
- Kills process with taskkill
PID:3036
-
-
C:\Windows\system32\timeout.exetimeout /T 2 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:440
-
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:5060
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2292
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3124
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4736
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
1Netsh Helper DLL
1Modify Authentication Process
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\_locales\en\messages.json
Filesize851B
MD507ffbe5f24ca348723ff8c6c488abfb8
SHA16dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA2566895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA5127ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\dasherSettingSchema.json
Filesize854B
MD54ec1df2da46182103d2ffc3b92d20ca5
SHA1fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA2566c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
151B
MD56a2886cffa63e6a2b676eb750e4b9397
SHA1301432c983f47febb5c3e155390010d501687e59
SHA256e97a0ac9f0ad630f0ca9243cddf0d1688937720d060329181963b42b0252bc70
SHA512b50a28005561959b845f4b10a1a2b398d773c6c02f32dcfddc61f144f7668232750a3015448b1dfacd1c2d707475e8370efbaf4fa7867c2fdc2c3467c05e3c35
-
Filesize
150KB
MD514937b985303ecce4196154a24fc369a
SHA1ecfe89e11a8d08ce0c8745ff5735d5edad683730
SHA25671006a5311819fef45c659428944897184880bcdb571bf68c52b3d6ee97682ff
SHA5121d03c75e4d2cd57eee7b0e93e2de293b41f280c415fb2446ac234fc5afd11fe2f2fcc8ab9843db0847c2ce6bd7df7213fcf249ea71896fbf6c0696e3f5aee46c
-
Filesize
711B
MD5558659936250e03cc14b60ebf648aa09
SHA132f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA2562445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA5121632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
-
Filesize
6KB
MD5c9c3d516d2d6b1ae4aa82d30a8d88df5
SHA11d4686fcfd73561f2831b694d46970482de9e5e2
SHA256c08d84b922fee399b0789cced5b0a4998d7250f3f7f4ef76febd6ba1fd1ee0fa
SHA5123c602eae150154eefb8adcc386eb1a4ad7d7430d3f8caf5099c12a182d0c6fe11110ef4b44f22b5c707db326bb49ef2b950438b7066c53107d5127d731ed269e
-
C:\Users\Admin\AppData\Local\d24ab8a7266170190607fb817b97497b\Admin@ZTSLLRFH_en-US\System\Process.txt
Filesize2KB
MD5eef4b7023259b605d4a0f9fb1bb644b9
SHA109a36bbd1dd87bb70770081baa0d6ad1449c3164
SHA25637ce65a1a5973d89967f3a399a0e035375a8b93364c9ea5eb98f4b8f0c2d2e2d
SHA512b0f51e907538c7e73317cf6ab8693242e3cef833f74d6d0608bc48b472cdc3f07c8443472f662754cc1e0ddc602692baf31174a9ba84eb4d6530ac0b80a47bb9
-
C:\Users\Admin\AppData\Local\d24ab8a7266170190607fb817b97497b\Admin@ZTSLLRFH_en-US\System\Process.txt
Filesize2KB
MD5a6febcd8bf8e1a45a3250d6fa6644766
SHA1ca75fb1d0cd2612b3b4c28cb32d648247e443fa1
SHA256ea46d62417a30d30661f91baea4e6f930a269d672cf915a94f7e1f2eb771ff49
SHA5126c6856ad07ea91448cebb73d685a0998d1581eae962f37c23a7405e987d729cc21a1e9c53f3749184445a98cf3b8f2e17dd726f6bbc6209a91c1c3a6a01229c6
-
C:\Users\Admin\AppData\Local\d24ab8a7266170190607fb817b97497b\Admin@ZTSLLRFH_en-US\System\Process.txt
Filesize3KB
MD5e930da36246bd515a02c28021f5d251a
SHA17d09580f62804c06a7ce827bf8aeb155c8ca94a2
SHA2569b8ee16b75df7876bd4a1de53a1bb3d6bb52764f0130a846b975a952bbc26a17
SHA5127b03d8dc8d06d573e3ccaf6154220549c7996ccb2e2d5ca9c7535ef39c0900e10189cca5e9894190e199816bdc15e25ebeaad0953953e914b89ef75da923abe0
-
C:\Users\Admin\AppData\Local\d24ab8a7266170190607fb817b97497b\Admin@ZTSLLRFH_en-US\System\Process.txt
Filesize4KB
MD51e7aacece31e2337a46ef6df54af9781
SHA16ac10a2ea30af353b70b1e9eb2c76bc3667d4009
SHA2561ebfbd31390e9fd8de50490340d485e44c93e127e546aff488be96cc2517a950
SHA512fae068fed1709a649a9669f1c45635c379fe253bcdd5f5c83bbbb7e9a00c021c0a16c9a975a8c349c2ff8cc932d256459704d1c3459dc827f8f6f4b7f124c477
-
C:\Users\Admin\AppData\Local\d24ab8a7266170190607fb817b97497b\Admin@ZTSLLRFH_en-US\System\Process.txt
Filesize595B
MD5de83ef241f4cbe5209b28bf47810dbd1
SHA1dc7de816e11e9db2537ded92d8b84a6d6eb1bc2c
SHA256a359a8a4b98192fbf3c2b7bf25c6c47860045ef55eaa9be2cc2d0db8dd51f676
SHA512fa23d7f68cd7de2ffbe3eeb690812eeec18c656bdb1906397f7f4b4ce2cf2d3eeb22cf7509f5e1cfa475e752108765ad67f5f45256f9fa596dbdc9d74e15ec4c
-
C:\Users\Admin\AppData\Local\d24ab8a7266170190607fb817b97497b\Admin@ZTSLLRFH_en-US\System\Process.txt
Filesize1KB
MD5b35f4f6950ec38c7aecdddc9ff3ff040
SHA1a446aba51ab68600c930b3652164cbdc0a78c7bb
SHA25639e690e00f2a27bee502935481b3ca5ffd859f86fe30b3ff49a1d03e50a993cf
SHA51220116fee5ec58d29c1069df3e6c2836dfce04cddc60e36f9b8b274baf16ebd5462f4cb7a804f7559902d07c209a3b7299fc9890c55011bbfd778df16a446d409
-
Filesize
2B
MD570efdf2ec9b086079795c442636b55fb
SHA10716d9708d321ffb6a00818614779e779925365c
SHA2564523540f1504cd17100c4835e85b7eefd49911580f8efff0599a8f283be6b9e3
SHA512dc2de67eb248dcdc50c63aabd1bca8335ad01106dd8ff720590077c161f558a7b61db3c56b3a32997597a3db98fd191c3e9e7fdf555aac1525f0b5342cac4088
-
Filesize
63KB
MD567ca41c73d556cc4cfc67fc5b425bbbd
SHA1ada7f812cd581c493630eca83bf38c0f8b32b186
SHA25623d2e491a8c7f2f7f344764e6879d9566c9a3e55a3788038e48b346c068dde5b
SHA5120dceb6468147cd2497adf31843389a78460ed5abe2c5a13488fc55a2d202ee6ce0271821d3cf12bc1f09a4d6b79a737ea3bccfc2bb87f89b3fff6410fa85ec02