Analysis
- geolocation tags
- user interaction
yes - max time kernel
277s - max time network
286s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
09/10/2026, 20:13
Errors
Reason
Machine shutdown
General
- Target Prestige-Client.exe
- Size 133.3MB
- Sample261009-yzlllstses
- SHA256 2cb044939e06ceabfa422c27e4f21d9f44088b7775d04f17ea4a1571d3b0d78d
Score
9/10
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Executes dropped EXE 15 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Discovers running processes 1 TTPs 7 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Drops file in System32 directory 2 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 33 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Kills process with taskkill 5 IoCs
- Modifies data under HKEY_USERS 11 IoCs
- Modifies registry class 2 IoCs
- Modifies registry key 1 TTPs 1 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch3⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch4⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch5⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch6⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch7⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch8⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch9⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch10⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch11⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch12⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch13⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch14⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch15⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch16⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch17⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch18⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch19⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch20⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch21⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch22⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch23⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch24⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch25⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch26⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch27⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch28⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch29⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch30⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch31⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch32⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch33⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch34⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch35⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch36⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch37⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch38⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch39⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch40⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch41⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch42⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch43⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch44⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch45⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch46⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch47⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch48⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch49⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch50⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch51⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch52⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch53⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch54⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch55⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch56⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch57⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch58⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch59⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch60⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch61⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch62⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch63⤵
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch64⤵
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch65⤵
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch66⤵
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch67⤵
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch68⤵
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch69⤵
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch70⤵
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch71⤵
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch72⤵
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch73⤵
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch74⤵
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch75⤵
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch76⤵
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch77⤵
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch78⤵
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch79⤵
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch80⤵
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch81⤵
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch82⤵
-
C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe"C:\Users\Admin\AppData\Local\Temp\Prestige-Client.exe" /watch83⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa0,0x134,0x7ffa20ecc728,0x7ffa20ecc734,0x7ffa20ecc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,2055539166978273382,9962942011406266703,262144 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1532,i,7936000642364782486,3070593512694944066,524288 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,13701688338633227439,18048151838504017985,524288 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,11517005752644474658,17502560903601488682,2097152 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,17982991752452289640,13751954942352034611,2097152 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4620,i,17124646090360552242,5142471185946149910,2097152 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4840,i,12248020974708442946,10063078506093258291,524288 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5052,i,10898488141468623693,4561020349029903353,524288 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5008,i,1367698395332033690,10632839805865641867,524288 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5188,i,18445123463551937726,5421403366063249314,524288 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5240,i,4153012356494996494,11722491190348002155,2097152 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5468,i,897195053486686561,11509207457976371022,2097152 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5740,i,11318217083035351271,16650633108133407753,2097152 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5896,i,11851607994216579317,13669941197086189760,2097152 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5988,i,5370426981052493737,13879456547156356090,2097152 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6196,i,10087532808779089812,2896136392206095983,524288 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6136,i,6956132298548697085,4188685335080878603,2097152 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6148,i,4395244915500438283,14626248330298069451,2097152 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5852,i,16614490962365048687,17724021927322326130,2097152 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6040,i,1302682241961783763,13229445189880239835,524288 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5188,i,5936013244176716274,11073786595325489524,524288 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6704,i,11637936726402385589,12358006777981034111,2097152 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6728,i,15967329033467900547,6760804607049095231,2097152 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6780,i,8384140188351289076,7108740510259049232,524288 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5240,i,1867449491253359780,18078363749124901231,524288 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6784,i,17417877791742778305,6301559342889168244,524288 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6028,i,1776162046912706936,15624034541830212771,2097152 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=3236,i,4093703449844968824,8325978619216655606,2097152 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=5772,i,12658456773286536706,600244506619956309,2097152 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6592,i,11233827673276041080,5077941007351509826,2097152 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=4704,i,18154321598763184476,176431044086278080,2097152 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=5224,i,4172641850326947643,2753713588260261585,2097152 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,6450535951324729363,9729979754519122976,524288 --field-trial-handle=2020,i,7126365122962637790,952189732861253276,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\Prestige\Prestige\Prestige-Client.exe"C:\Users\Admin\Downloads\Prestige\Prestige\Prestige-Client.exe" C:\Users\Admin\Downloads\Prestige\Prestige\Patch.dll1⤵
-
C:\Users\Admin\Downloads\Prestige\Prestige\Prestige-Client.exe"C:\Users\Admin\Downloads\Prestige\Prestige\Prestige-Client.exe" /watch2⤵
-
C:\Users\Admin\Downloads\Prestige\Prestige\Prestige-Client.exe"C:\Users\Admin\Downloads\Prestige\Prestige\Prestige-Client.exe" /watch3⤵
-
C:\Users\Admin\Downloads\Prestige\Prestige\Prestige-Client.exe"C:\Users\Admin\Downloads\Prestige\Prestige\Prestige-Client.exe" /watch4⤵
-
C:\Users\Admin\Downloads\Prestige\Prestige\Prestige-Client.exe"C:\Users\Admin\Downloads\Prestige\Prestige\Prestige-Client.exe" /watch5⤵
-
C:\Users\Admin\Downloads\Prestige\Prestige\Prestige-Client.exe"C:\Users\Admin\Downloads\Prestige\Prestige\Prestige-Client.exe" /watch6⤵
-
C:\Users\Admin\Downloads\Prestige\Prestige\Prestige-Client.exe"C:\Users\Admin\Downloads\Prestige\Prestige\Prestige-Client.exe" /watch7⤵
-
C:\Users\Admin\Downloads\Prestige\Prestige\Prestige-Client.exe"C:\Users\Admin\Downloads\Prestige\Prestige\Prestige-Client.exe" /watch8⤵
-
C:\Users\Admin\Downloads\Prestige\Prestige\Prestige-Client.exe"C:\Users\Admin\Downloads\Prestige\Prestige\Prestige-Client.exe" /watch9⤵
-
C:\Users\Admin\Downloads\Prestige\Prestige\Prestige-Client.exe"C:\Users\Admin\Downloads\Prestige\Prestige\Prestige-Client.exe" /watch10⤵
-
C:\Users\Admin\Downloads\Prestige\Prestige\Prestige-Client.exe"C:\Users\Admin\Downloads\Prestige\Prestige\Prestige-Client.exe" /watch11⤵
-
C:\Users\Admin\Downloads\Prestige\Prestige\Prestige-Client.exe"C:\Users\Admin\Downloads\Prestige\Prestige\Prestige-Client.exe" /watch12⤵
-
-
-
-
-
-
-
-
-
-
-
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe"C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe" -version2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\java.exe"C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\java.exe" -javaagent:"C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\36Boys.jar" -jar "C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\36Boys.jar"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\tasklist.exetasklist3⤵
- Discovers running processes
-
-
C:\Windows\SYSTEM32\getmac.exegetmac /fo list3⤵
-
-
C:\Windows\SYSTEM32\route.exeroute PRINT 0.0.0.03⤵
-
-
C:\Windows\SYSTEM32\net.exenet session3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵
-
-
-
C:\Windows\SYSTEM32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v 09a42e89 /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exe\" -cp \"C:\Users\Admin\AppData\Roaming\09a42e89\09a42e89.bin\" org.apache.commons.cli.CommandLine" /f3⤵
- Adds Run key to start application
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exeC:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exe -cp C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\36Boys.jar org.apache.commons.io.Tailer 4456 C:\Users\Admin\AppData\Local\Temp\mp49_15871505208373586247 C:\Users\Admin\AppData\Local\Temp\mp49done_4456.flag mp49 C:\Users\Admin\AppData\Local\Temp\wchk_1646e41a.count C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\36Boys.jar3⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exeC:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exe -cp C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\36Boys.jar org.apache.commons.io.Tailer 4456 C:\Users\Admin\AppData\Local\Temp\mp49_15871505208373586247 C:\Users\Admin\AppData\Local\Temp\mp49done_4456.flag mp49 C:\Users\Admin\AppData\Local\Temp\wchk_1646e41a.count C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\36Boys.jar3⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show profiles3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exeC:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exe -cp C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\36Boys.jar org.apache.commons.io.Tailer 4456 C:\Users\Admin\AppData\Local\Temp\mp49_15871505208373586247 C:\Users\Admin\AppData\Local\Temp\mp49done_4456.flag mp49 C:\Users\Admin\AppData\Local\Temp\wchk_1646e41a.count C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\36Boys.jar3⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exeC:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exe -cp C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\36Boys.jar org.apache.commons.io.Tailer 4456 C:\Users\Admin\AppData\Local\Temp\mp49_15871505208373586247 C:\Users\Admin\AppData\Local\Temp\mp49done_4456.flag mp49 C:\Users\Admin\AppData\Local\Temp\wchk_1646e41a.count C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\36Boys.jar3⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist3⤵
- Discovers running processes
-
-
C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exeC:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exe -cp C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\36Boys.jar org.apache.commons.io.Tailer 4456 C:\Users\Admin\AppData\Local\Temp\mp49_15871505208373586247 C:\Users\Admin\AppData\Local\Temp\mp49done_4456.flag mp49 C:\Users\Admin\AppData\Local\Temp\wchk_1646e41a.count C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\36Boys.jar3⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist /FI "IMAGENAME eq winlogon.exe" /FO CSV /NH3⤵
- Discovers running processes
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist /FI "IMAGENAME eq winlogon.exe" /FO CSV /NH3⤵
- Discovers running processes
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist /FI "IMAGENAME eq winlogon.exe" /FO CSV /NH3⤵
- Discovers running processes
-
-
C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exeC:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exe -cp C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\36Boys.jar org.apache.commons.io.Tailer 4456 C:\Users\Admin\AppData\Local\Temp\mp49_15871505208373586247 C:\Users\Admin\AppData\Local\Temp\mp49done_4456.flag mp49 C:\Users\Admin\AppData\Local\Temp\wchk_1646e41a.count C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\36Boys.jar3⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exeC:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exe -cp C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\36Boys.jar org.apache.commons.io.Tailer 4456 C:\Users\Admin\AppData\Local\Temp\mp49_15871505208373586247 C:\Users\Admin\AppData\Local\Temp\mp49done_4456.flag mp49 C:\Users\Admin\AppData\Local\Temp\wchk_1646e41a.count C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\36Boys.jar3⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exeC:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exe -cp C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\36Boys.jar org.apache.commons.io.Tailer 4456 C:\Users\Admin\AppData\Local\Temp\mp49_15871505208373586247 C:\Users\Admin\AppData\Local\Temp\mp49done_4456.flag mp49 C:\Users\Admin\AppData\Local\Temp\wchk_1646e41a.count C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\36Boys.jar3⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exeC:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exe -cp C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\36Boys.jar org.apache.commons.io.Tailer 4456 C:\Users\Admin\AppData\Local\Temp\mp49_15871505208373586247 C:\Users\Admin\AppData\Local\Temp\mp49done_4456.flag mp49 C:\Users\Admin\AppData\Local\Temp\wchk_1646e41a.count C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\36Boys.jar3⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exeC:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exe -cp C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\36Boys.jar org.apache.commons.io.Tailer 4456 C:\Users\Admin\AppData\Local\Temp\mp49_15871505208373586247 C:\Users\Admin\AppData\Local\Temp\mp49done_4456.flag mp49 C:\Users\Admin\AppData\Local\Temp\wchk_1646e41a.count C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\36Boys.jar3⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exeC:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exe -cp C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\36Boys.jar org.apache.commons.io.Tailer 4456 C:\Users\Admin\AppData\Local\Temp\mp49_15871505208373586247 C:\Users\Admin\AppData\Local\Temp\mp49done_4456.flag mp49 C:\Users\Admin\AppData\Local\Temp\wchk_1646e41a.count C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\36Boys.jar3⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /IM discord.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /IM discordcanary.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /IM discordptb.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /IM discorddevelopment.exe /T3⤵
- Kills process with taskkill
-
-
C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exeC:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exe -cp C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\36Boys.jar org.apache.commons.io.Tailer 4456 C:\Users\Admin\AppData\Local\Temp\mp49_15871505208373586247 C:\Users\Admin\AppData\Local\Temp\mp49done_4456.flag mp49 C:\Users\Admin\AppData\Local\Temp\wchk_1646e41a.count C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\36Boys.jar3⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /IM lightcord.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist /FI "IMAGENAME eq discord.exe"3⤵
- Discovers running processes
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist /FI "IMAGENAME eq discord.exe"3⤵
- Discovers running processes
-
-
C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exeC:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exe -cp C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\36Boys.jar org.apache.commons.io.Tailer 4456 C:\Users\Admin\AppData\Local\Temp\mp49_15871505208373586247 C:\Users\Admin\AppData\Local\Temp\mp49done_4456.flag mp49 C:\Users\Admin\AppData\Local\Temp\wchk_1646e41a.count C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\36Boys.jar3⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
-
C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exe"C:\Users\Admin\AppData\Local\Temp\7F2A9B1C\jdk-22.0.2+9-jre\bin\javaw.exe" -cp "C:\Users\Admin\AppData\Roaming\09a42e89\09a42e89.bin" org.apache.commons.cli.CommandLine1⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc1⤵
- Drops file in System32 directory
- Checks processor information in registry
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa390f855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Process Discovery
1Query Registry
8System Information Discovery
3System Network Configuration Discovery
3Internet Connection Discovery
1Wi-Fi Discovery
1System Time Discovery
1Virtualization/Sandbox Evasion
3Replay Monitor
Loading Replay Monitor...
Downloads
2544e725-1215-468e-ba7f-f86a0b7c410b.tmp
334e17ba-f351-4fa6-8296-ca24e53bb386.tmp
8b763e24-6ae6-48f0-a7e0-ecdb9247650f.tmp
settings.dat
3baee050-8185-4389-ab57-8266bb6b9028.tmp
408742d5-0890-42c9-8460-9a6d0b434bdf.tmp
4096f940-d75e-4354-95c5-b7ee45704deb.tmp
9b779f14-ea40-4d4c-9558-51627a5571fa.tmp
f_000010
f_000019
f_00001b
f_000020
f_00002c
temp-index
messages.json
craw_background.js
CURRENT
MANIFEST-000001
6ec11185-5941-4416-b8a2-6ccf37e79d57.tmp
7250ae83-9e24-4c70-ae3c-d38bbb25eaf2.tmp
ee1ae64e-2259-4c97-8c7d-d5797dd625ea.tmp
temp-index
temp-index
temp-index
data_0
data_1
data_2
data_3
2ff17b05-7820-4d8f-a16f-2c2eaa44ae0d.tmp
Network Persistent State
e842016c-5cc3-4b76-b112-c430b3213408.tmp
ecaad819-decb-4a1f-ac90-7a26b4b70a66.tmp
f7c71e55-7426-4a20-b60d-00aee7a1111c.tmp
f1fe451f-2670-440c-9cdd-2bd43c9face9.tmp
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
vcruntime140_cor3.dll
wpfgfx_cor3.dll
javaw.exe
default_US_export.policy
ADDITIONAL_LICENSE_INFO
ASSEMBLY_EXCEPTION
LICENSE
jre22.zip
e51ef3cf-feac-4782-b9ef-6c20505950e5.tmp
jna10194454750771836564.dll
screenshot.png
mp49vp_11828218564134663865.db
mp49vp_1226199617003412307.db
mp49vp_17507598900416845320.db
mp49vp_4437140715603273652.db
mp49vp_5669007624817821205.db
messages.json
sqlite-3.45.3.0-2d0b989d-396b-4b4e-b325-88f0788d611c-sqlitejdbc.dll
8a251cf8-a196-4475-98c9-80f6e2712349.tmp
memory/1748-2077-0x000002B407A00000-0x000002B407A01000-memory.dmp
memory/1748-2088-0x000002B407A00000-0x000002B407A01000-memory.dmp
memory/1748-2086-0x000002B407A00000-0x000002B407A01000-memory.dmp
memory/1748-2085-0x000002B407A00000-0x000002B407A01000-memory.dmp
memory/1748-2083-0x000002B407A00000-0x000002B407A01000-memory.dmp
memory/1748-2087-0x000002B407A00000-0x000002B407A01000-memory.dmp
memory/1748-2084-0x000002B407A00000-0x000002B407A01000-memory.dmp
memory/1748-2079-0x000002B407A00000-0x000002B407A01000-memory.dmp
memory/3292-975-0x0000022BC2290000-0x0000022BC2291000-memory.dmp
memory/4456-2075-0x00007FFA16A60000-0x00007FFA16B55000-memory.dmp
memory/4456-2076-0x00007FFA16A60000-0x00007FFA16B55000-memory.dmp
memory/4456-1951-0x00007FFA16A60000-0x00007FFA16B55000-memory.dmp