Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10CleanerV2.exe
windows7-x64
10CleanerV2.exe
windows10-2004-x64
10InstallSetup.exe
windows7-x64
8InstallSetup.exe
windows10-2004-x64
10Motrix-1.8.19-x64.exe
windows7-x64
7Motrix-1.8.19-x64.exe
windows10-2004-x64
7Rust_22_02...np.exe
windows7-x64
3Rust_22_02...np.exe
windows10-2004-x64
3SoftCPU.exe
windows7-x64
3SoftCPU.exe
windows10-2004-x64
7chrome.exe
windows7-x64
8chrome.exe
windows10-2004-x64
8client.exe
windows7-x64
10client.exe
windows10-2004-x64
10goodboy.exe
windows10-2004-x64
10install.exe
windows7-x64
10install.exe
windows10-2004-x64
10Resubmissions
14/03/2025, 13:03
250314-qacneavkv5 10Analysis
-
max time kernel
153s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
14/03/2025, 13:03
Behavioral task
behavioral1
Sample
CleanerV2.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
CleanerV2.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
InstallSetup.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral4
Sample
InstallSetup.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral5
Sample
Motrix-1.8.19-x64.exe
Resource
win7-20241010-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral6
Sample
Motrix-1.8.19-x64.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral7
Sample
Rust_22_02_2023_gnp.exe
Resource
win7-20241010-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
Rust_22_02_2023_gnp.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
SoftCPU.exe
Resource
win7-20241010-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
SoftCPU.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral11
Sample
chrome.exe
Resource
win7-20241010-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral12
Sample
chrome.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral13
Sample
client.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral14
Sample
client.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral15
Sample
goodboy.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral16
Sample
install.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral17
Sample
install.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
chrome.exe
-
Size
4.3MB
-
MD5
94c60e6704b5dd11a139f2ffebde9135
-
SHA1
cd89f1cf9428a3eab554a3eb9ff6ca869e5bc368
-
SHA256
106bf123359d03963b1df1011fb8560aaf1c5e811de775dce1d8a53758a69102
-
SHA512
586bf326eae890379fcc7ad60e0a70384d069898aea46da32baf6bd60854df97b461019beaf17744ba3dfc0e70eb75970b977c30f035d296ae89763605d4ff6d
-
SSDEEP
49152:cGNq7FBhpRWa3viMRIcDdxw6dXF3W1QrL1UDq3P8mlp4DOXUxm:cGejpRWafEkRW6OHmrZXt
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\Drivers\PROCEXP152.SYS chrome64.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\PROCEXP152\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS" chrome64.exe -
Executes dropped EXE 2 IoCs
pid Process 2200 chrome64.exe 1256 Process not Found -
Loads dropped DLL 1 IoCs
pid Process 2684 chrome.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: chrome64.exe File opened (read-only) \??\Y: chrome64.exe File opened (read-only) \??\L: chrome64.exe File opened (read-only) \??\V: chrome64.exe File opened (read-only) \??\X: chrome64.exe File opened (read-only) \??\P: chrome64.exe File opened (read-only) \??\B: chrome64.exe File opened (read-only) \??\E: chrome64.exe File opened (read-only) \??\H: chrome64.exe File opened (read-only) \??\J: chrome64.exe File opened (read-only) \??\N: chrome64.exe File opened (read-only) \??\S: chrome64.exe File opened (read-only) \??\I: chrome64.exe File opened (read-only) \??\M: chrome64.exe File opened (read-only) \??\O: chrome64.exe File opened (read-only) \??\Q: chrome64.exe File opened (read-only) \??\Z: chrome64.exe File opened (read-only) \??\A: chrome64.exe File opened (read-only) \??\G: chrome64.exe File opened (read-only) \??\K: chrome64.exe File opened (read-only) \??\R: chrome64.exe File opened (read-only) \??\T: chrome64.exe File opened (read-only) \??\U: chrome64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chrome.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz chrome64.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome64.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\.Default chrome64.exe Key created \REGISTRY\USER\S-1-5-19 chrome64.exe Key created \REGISTRY\USER\S-1-5-20 chrome64.exe -
Modifies system certificate store 2 TTPs 6 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 chrome64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 chrome64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 chrome64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 chrome64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde chrome64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 chrome64.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2200 chrome64.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 2200 chrome64.exe Token: SeBackupPrivilege 2200 chrome64.exe Token: SeSecurityPrivilege 2200 chrome64.exe Token: SeLoadDriverPrivilege 2200 chrome64.exe Token: SeShutdownPrivilege 2200 chrome64.exe Token: SeShutdownPrivilege 2200 chrome64.exe Token: SeDebugPrivilege 2200 chrome64.exe Token: SeImpersonatePrivilege 2200 chrome64.exe Token: SeSecurityPrivilege 2200 chrome64.exe Token: SeDebugPrivilege 2200 chrome64.exe Token: SeBackupPrivilege 2200 chrome64.exe Token: SeRestorePrivilege 2200 chrome64.exe Token: SeDebugPrivilege 2200 chrome64.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe 2200 chrome64.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2684 wrote to memory of 2200 2684 chrome.exe 30 PID 2684 wrote to memory of 2200 2684 chrome.exe 30 PID 2684 wrote to memory of 2200 2684 chrome.exe 30 PID 2684 wrote to memory of 2200 2684 chrome.exe 30 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\chrome.exe"C:\Users\Admin\AppData\Local\Temp\chrome.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\chrome64.exe"C:\Users\Admin\AppData\Local\Temp\chrome.exe"2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2200
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
2.3MB
MD5dfeea73e421c76deb18d5ca0800dccf2
SHA10497eba0b24d0f4500faad5ae96dbebab9c64608
SHA2568158dc0569972c10056f507cf9e72f4946600ce163c4c659a610480585cd4935
SHA51223ddc9f28314d4cf3b05d88b9e0b6fd69f9804f5e9c3f7703258ff2c5786721061321379fde53e21048d3c7cce1ff71e2872d48dcc580d059397fa0692335630