b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb

Resubmissions

07/03/2025, 16:03

250307-thsw5ssygt 5

13/01/2025, 02:42

250113-c7dp3ssjew 5

Analysis

max time kernel
127s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2025, 16:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
Size

5.2MB
MD5

54e383ca658ebd3caaf586f032f1c401
SHA1

bc013aace5491c65a869e944123a4344cea6c1f0
SHA256

b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb
SHA512

4d10c2f888b5f56b59341e1dee5c53f56f2d81a9034eda36182bfd04246274d1fdee85b3ceccd5677ae8608626c2952ddd30fbe730dac54e405983c2a35fe51c
SSDEEP

49152:UTyQOnGEoOozdSv3U4Yn0+U0vN52S7aoRPWicuRX3EYqDqmjVNiIhnU/hHYBWZh0:KSv31WaZlah4q1W61nH/a

Score

5^/10

discovery ransomware

Malware Config

Signatures

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Control Panel\Desktop\Wallpaper = "\\\\?\\C:\\Users\\Admin\\AppData\\Local\\Temp\\downloaded_wallpaper.jpg"	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.Lock	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000_Classes\Local Settings	OpenWith.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4136	chrome.exe
4136	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
996	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 1932	1180	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe	88
PID 1180 wrote to memory of 1932	1180	b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe	88
PID 1932 wrote to memory of 4924	1932	net.exe	89
PID 1932 wrote to memory of 4924	1932	net.exe	89
PID 4136 wrote to memory of 4248	4136	chrome.exe	107
PID 4136 wrote to memory of 4248	4136	chrome.exe	107
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 4568	4136	chrome.exe	108
PID 4136 wrote to memory of 1608	4136	chrome.exe	109
PID 4136 wrote to memory of 1608	4136	chrome.exe	109
PID 4136 wrote to memory of 1484	4136	chrome.exe	110
PID 4136 wrote to memory of 1484	4136	chrome.exe	110
PID 4136 wrote to memory of 1484	4136	chrome.exe	110
PID 4136 wrote to memory of 1484	4136	chrome.exe	110
PID 4136 wrote to memory of 1484	4136	chrome.exe	110
PID 4136 wrote to memory of 1484	4136	chrome.exe	110
PID 4136 wrote to memory of 1484	4136	chrome.exe	110
PID 4136 wrote to memory of 1484	4136	chrome.exe	110
PID 4136 wrote to memory of 1484	4136	chrome.exe	110
PID 4136 wrote to memory of 1484	4136	chrome.exe	110
PID 4136 wrote to memory of 1484	4136	chrome.exe	110
PID 4136 wrote to memory of 1484	4136	chrome.exe	110
PID 4136 wrote to memory of 1484	4136	chrome.exe	110
PID 4136 wrote to memory of 1484	4136	chrome.exe	110
PID 4136 wrote to memory of 1484	4136	chrome.exe	110
PID 4136 wrote to memory of 1484	4136	chrome.exe	110
PID 4136 wrote to memory of 1484	4136	chrome.exe	110
PID 4136 wrote to memory of 1484	4136	chrome.exe	110
PID 4136 wrote to memory of 1484	4136	chrome.exe	110
PID 4136 wrote to memory of 1484	4136	chrome.exe	110
PID 4136 wrote to memory of 1484	4136	chrome.exe	110
PID 4136 wrote to memory of 1484	4136	chrome.exe	110
PID 4136 wrote to memory of 1484	4136	chrome.exe	110
PID 4136 wrote to memory of 1484	4136	chrome.exe	110
PID 4136 wrote to memory of 1484	4136	chrome.exe	110
PID 4136 wrote to memory of 1484	4136	chrome.exe	110

C:\Users\Admin\AppData\Local\Temp\b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
"C:\Users\Admin\AppData\Local\Temp\b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe"
1⤵
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\system32\net.exe
  "net" session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4924

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff40c0cc40,0x7fff40c0cc4c,0x7fff40c0cc58
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1948,i,10676114697821703681,1176542431560437502,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2192,i,10676114697821703681,1176542431560437502,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  PID:1608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2288,i,10676114697821703681,1176542431560437502,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2468 /prefetch:8
  2⤵
  PID:1484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3176,i,10676114697821703681,1176542431560437502,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3208,i,10676114697821703681,1176542431560437502,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3732,i,10676114697821703681,1176542431560437502,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4716,i,10676114697821703681,1176542431560437502,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4736 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4724,i,10676114697821703681,1176542431560437502,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4708 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4888,i,10676114697821703681,1176542431560437502,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:1716

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
c640e62f396ab3e026daba0a79584b46

SHA1
c15d9cec9e6af42ff295755c89b2e449d2bdf504

SHA256
c5e4aa7109444de489f911ef07f3e3cdf87c4dfcfb04587178458deaf77efa81

SHA512
305456fe740fc29ab4082a6b1513c7d90bf4fc71850f73f301cec577ea805bb514dd8c1a7863bdfc0a3fde85dfc585c6c64332f3b98b2c00eef5ba9b21e61d6f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
81a81b1abc29e179f6520658c5fe6647

SHA1
5be937788a633b95e428f5c93053ea73ecb634a0

SHA256
aacb1f4d5454604f3daa8d59491c4ef9ef8eb77db7ca4f25d1182540392a1c43

SHA512
0c702f24692755615df3164a46fbd964babc910cfd3cdd570955046da1f667b91e95549790c19b05aa891befcf25558b325a090ede07a233dbff275038ce6435

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
2861f248154106cb1045732ab31a187a

SHA1
a59015d7be69d1f4e87da69fa5aa1b94f5227a0a

SHA256
e5b2726b3a55b6aeb509431a94e1f124a0317fb2f5360e42612ca27545317ffa

SHA512
83cb2e3a8f51a072d5a399597ff3473296197f581d86a6ef5d31c2c3d923b1d6002c867915c6386d497a7caf769881eed36092866f224ac7dbb6d5086d670a2a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
632ee548120e08be76782393bad34106

SHA1
03af50d5038cefaa4bc74d48f910af3ea09cbe43

SHA256
929eeb96b1eed9a79e974e6068c9305f252e18715e455d298f220c1bdff97fe2

SHA512
aaa217f7256b0723a1310bbb2814dee288434ad9b2eed164c920568b7b245ea6dd84660151292792a5d8894a38daa3ac8c72987874ccad2120de56a92a7ae514

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
123KB

MD5
a463e49f07276d17602de1a9d7a8f737

SHA1
d9db6c7c14be3fb8aabc384d488f80547c6fc87b

SHA256
bcd936f4c48c6d57c21ace79c491b578fa96f67c4bfa816daf5ebbd54adf23bc

SHA512
148261cfb48f5c0425661917c075b2f3f007abac1cf38ecb88891c8dd6887aa670522ff9ae79bc5107ec512fbb12f9cb02304d500a67f9e82c2668abc9b52c83

Download Submit
C:\Users\Public\Desktop\Acrobat Reader DC.lnk

Filesize
2KB

MD5
e5ccf08dd2ec3fd5b3283e3acd738e21

SHA1
00a9560622280c16f11dfd379b131ebad4d3839b

SHA256
f968c04b67034e11b9a90736ca21c9a3b53d1f57c6614bc97c74c8e3a1b2ddf5

SHA512
077746409012414fd01de054e56475d597820fb6717283dfa3751251b86cda095122c5497a26d2d197502284fe8b69f84871661b561370e55d5795a445697c49

Download Submit
C:\Users\Public\Desktop\Firefox.lnk

Filesize
1000B

MD5
5b4808de6d4a285089bbb29bf789cdae

SHA1
4af5af1e97433a2ae8850cd7aa329c21d018b125

SHA256
484cfc7ea33e2b6d4b7748c02a3fe6fad99811f7074932d057d6b84303f0c3ee

SHA512
a636de4b16a667e07e42a8dc09c875831bb3d979f83b6e3678319a32dbd6de20c521ee1a86ccbece65f2bf4ede7aa92b7d6830e300048ceaaf7600ca2663505a

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
f10d3c066617c0176bbc94b41d655d76

SHA1
44b2f66730ea406e5e01ebb8dd13de971a6a9a5e

SHA256
1e51e1a2794331fb2cbef6e39fc78ccc60b057fc160b1b599dba6e86dbe22acd

SHA512
3b4728296211bf3486f9cab796977b87673a34a748a9d6e134db12cde63667cc63c020b979181c72ba80d598c97526f1785c6574d718f54c95d4e9de95536aa8

Download Submit
C:\Users\Public\Desktop\VLC media player.lnk

Filesize
923B

MD5
bcf0f175448af9ed659c37c00fb2c803

SHA1
331765cb401a734b10eb0a60c1f5a5d358417815

SHA256
7fe5c4e11ba4d13c1384a43fdfdd23da62a67b86faded43aab69d1ccb715f585

SHA512
e7c1b9747116c0ba979cc01be4d29c60197d5cd670e242822bd544af5e469c1a461bcf3720f42f0fdcad4b281beaf9dc91a3ba77e003e830a4c1504761aa3302

Download Submit