Analysis
- user interaction
yes - max time kernel
480s - max time network
591s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
14/10/2026, 10:51
General
- Target IwaraTool-Windows-AMD64-v1.1.1.exe
- Size 30.8MB
- Sample261014-mxtnnaby4y
- SHA256 ed9c81b4d0cdc05c4b690e022f0de953303c7032bbf0f88f4dd46c9e57aa393e
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Loads dropped DLL 64 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 2 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies data under HKEY_USERS 7 IoCs
- Modifies registry class 57 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\IwaraTool-Windows-AMD64-v1.1.1.exe"C:\Users\Admin\AppData\Local\Temp\IwaraTool-Windows-AMD64-v1.1.1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IwaraTool-Windows-AMD64-v1.1.1.exeC:\Users\Admin\AppData\Local\Temp\IwaraTool-Windows-AMD64-v1.1.1.exe2⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd5c7fc728,0x7ffd5c7fc734,0x7ffd5c7fc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1864,i,17941982605332617332,3539335999571567393,524288 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,7364956994910786076,4934892638318247796,262144 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,13247253083422374527,18155806149654501711,524288 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3024,i,5112956386233011217,10144153351969072540,2097152 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3036,i,9865926519590045319,15467113459170096633,2097152 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4540,i,1897981826298756991,7722450660190290309,2097152 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4580,i,16684063928403727818,3653549268717745438,524288 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5268,i,14975831218494527815,16874017427128111542,524288 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5320,i,987336380557098066,18369054873287591504,2097152 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5300,i,17216825124390181787,12032407047376683133,2097152 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5648,i,14123307522298634156,8601230614233560759,2097152 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,17821160513783390526,3176075779280213167,524288 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5856,i,6581453197462616983,2866446123443831832,2097152 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5992,i,4478306656620256932,6433813944292955460,2097152 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5980,i,3478043853606751138,15261780332962521855,2097152 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5604,i,913150384630048417,15604199185840849442,2097152 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5352,i,17123748445865187995,1851769511596509141,2097152 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6132,i,10555050156877733176,1378151057034918565,524288 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5276,i,6322657152912086684,16654471300847930957,524288 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4704,i,7874260817273132492,17040743494207527391,2097152 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5368,i,4500469459431126999,8790027965176227792,2097152 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4712,i,15168974621939412323,13034465127865742385,2097152 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3700,i,3616289954483482632,9370829552485810755,2097152 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3524,i,8337914227695641799,17986015219632803615,2097152 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5604,i,10106301768593959295,7784927475190890499,2097152 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3876,i,12321123092937522744,8043902587241721140,2097152 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4620,i,1518710397219859516,16473563928354798043,524288 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,10195927877115734199,18341128453528443383,524288 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3656,i,13309371840397336479,16018442923866380951,524288 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4708,i,12240804674735539504,1216517500206789569,262144 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=5828,i,17181391867955516042,11767446290320855581,2097152 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=2900,i,4926122228300959296,907988049219923970,2097152 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6276,i,5215627219667141279,5170286272459275527,2097152 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6624,i,2433885653047074725,7941329024794455548,2097152 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=5524,i,7868252755774400300,8943392232588529733,2097152 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6324,i,6108868858447543447,1842148329071922803,2097152 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=6512,i,15350596788973991154,13880023600273491640,2097152 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6656,i,7583145161421239091,10627228727147832391,524288 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=256,i,7657181462860349689,18000448569931510738,524288 --field-trial-handle=2032,i,3447919359886085096,7657221223329078810,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\IwaraTool-Windows-AMD64-v1.1.1.exe"C:\Users\Admin\Downloads\IwaraTool-Windows-AMD64-v1.1.1.exe"2⤵
-
C:\Users\Admin\Downloads\IwaraTool-Windows-AMD64-v1.1.1.exeC:\Users\Admin\Downloads\IwaraTool-Windows-AMD64-v1.1.1.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
- Executes a command shell one-liner
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc1⤵
- Drops file in System32 directory
- Checks processor information in registry
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
19139567-b6c6-4c74-85d8-0f27ddd9db7d.tmp
33d0da5d-6ddb-4b7b-99ef-87c9076787d3.tmp
3cecd075-cb6d-4ebd-bdc2-d1a600c98cc6.tmp
3e3fbc75-cf40-4336-8140-a20fb129526a.tmp
44e85cb8-656f-457a-bd49-73e918be4aec.tmp
059900b1-3617-4548-99dc-1f2f2d961f2a.tmp
1e9dd6b1-834a-4c70-8041-4826b1e2e21b.tmp
24b777d5-ec32-40b7-9c50-6e10364eb451.tmp
64db0736-5bc6-46eb-8214-62c360cf70c2.tmp
95406ca9-1821-46df-9685-f138e3fd715c.tmp
99fcc5f7-1155-4e63-9f10-cb11467358bc.tmp
f_000004
f_000006
f_000008
f_000009
f_00000a
f_000011
f_000020
f_000022
f_000023
f_000027
f_000045
the-real-index
the-real-index
messages.json
craw_background.js
CURRENT
MANIFEST-000001
2d9b800d-6840-40a3-b105-27fbab18f762.tmp
2fc1ead7-c7b5-48fb-92f2-b1bda4342137.tmp
666f17a8-f6e5-4248-bd4c-c7a11f697fa2.tmp
6efe0a26-c25c-44c7-8516-42957ea94876.tmp
Secure Preferences
index
temp-index
the-real-index
index.txt
index.txt.tmp
temp-index
temp-index
temp-index
temp-index
the-real-index
data_0
data_1
data_2
data_3
afe2cbe1-ec27-4ced-9a67-c87eb1f1e4af.tmp
cf405dee-feda-4c41-a9f7-6918ba47b081.tmp
b011248f-7cb4-4fd2-960e-c3cf646db4b4.tmp
prep_Activatable Class_Hermes_perf.cache
microsoftwindows.client[1].xml
QtCore.pyd
QtWidgets.pyd
_bz2.pyd
_sqlite3.pyd
liblzma.dll
Shiboken.pyd
config.ini
config.ini
config.ini
config.ini
config.ini
config.ini
config.ini
config.ini
config.ini
config.ini
config.ini
config.ini
config.ini
config.ini
config.ini
config.ini
config.ini
config.ini
config.ini
config.ini
config.ini
config.ini
config.ini.lock
history.db
iwaratool.log
iwaratool.log
loveiwara_iwara_tags_localized.json
e76c26cb-d64f-4912-a4da-b342199abc6c.tmp
MSVCP140_1.dll
QtGui.pyd
Qt6Core.dll
Qt6Gui.dll
Qt6Widgets.dll
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
double-conversion.dll
freetype.dll
libbz2.dll
libpng16.dll
main.dll
msvcp140.dll
msvcp140_2.dll
pcre2-16.dll
pyside6.cp311-win_amd64.dll
python311.dll
select.pyd
shiboken6.cp311-win_amd64.dll
sqlite3.dll
vcruntime140_1.dll
zlib.dll
zstd.dll
messages.json
default.exc
02b54ac7-cabf-4d57-a20a-fa588eb2bb04.tmp
config.ini.lock
memory/572-140-0x00007FFD3F910000-0x00007FFD3FF51000-memory.dmp
memory/572-151-0x00007FFD3ECE0000-0x00007FFD3F115000-memory.dmp
memory/572-148-0x00007FFD3FF60000-0x00007FFD40557000-memory.dmp
memory/572-133-0x00007FFD43ED0000-0x00007FFD44263000-memory.dmp
memory/3500-2195-0x0000020099CA0000-0x0000020099DA0000-memory.dmp
memory/3500-2933-0x0000020099B80000-0x0000020099C80000-memory.dmp
memory/3500-3171-0x0000020099B80000-0x0000020099C80000-memory.dmp
memory/3500-3320-0x000002009E500000-0x000002009E600000-memory.dmp
memory/3500-3318-0x000002009E500000-0x000002009E600000-memory.dmp
memory/3500-3414-0x000002009E600000-0x000002009E700000-memory.dmp
memory/3500-3413-0x000002009E600000-0x000002009E700000-memory.dmp
memory/3500-3479-0x000002009E700000-0x000002009E800000-memory.dmp
memory/3500-1143-0x00000200801E0000-0x00000200802E0000-memory.dmp
memory/3500-3666-0x0000020099B80000-0x0000020099C80000-memory.dmp
memory/3500-3742-0x000002009E600000-0x000002009E700000-memory.dmp
memory/3500-3072-0x000002009AFE0000-0x000002009B000000-memory.dmp
memory/3500-2756-0x000002009DC30000-0x000002009DD30000-memory.dmp
memory/3500-2753-0x000002009DC30000-0x000002009DD30000-memory.dmp
memory/3500-1193-0x0000020082BB0000-0x0000020082BD0000-memory.dmp
memory/3500-1703-0x0000020099CA0000-0x0000020099DA0000-memory.dmp
memory/3500-1171-0x0000020082E70000-0x0000020082F70000-memory.dmp
memory/3500-1207-0x0000020094670000-0x0000020094690000-memory.dmp
memory/3500-1170-0x0000020082A50000-0x0000020082A70000-memory.dmp
memory/5192-4185-0x00007FFD2DCE0000-0x00007FFD2E321000-memory.dmp
memory/5192-4186-0x00007FFD331F0000-0x00007FFD33625000-memory.dmp
memory/5192-4184-0x00007FFD2EB80000-0x00007FFD2F177000-memory.dmp
memory/5192-4183-0x00007FFD33630000-0x00007FFD339C3000-memory.dmp