38be2830eecba0ee415fc2e02981bacd5195b5bf10329358127dcf7afd08dbf7

Analysis

user interaction
yes
max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/04/2026, 18:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
server.exe
Size 95KB
Sample260429-wras2aet2v
SHA256 38be2830eecba0ee415fc2e02981bacd5195b5bf10329358127dcf7afd08dbf7
MD5 d40d35b8a2ad1e66c1c6c873b42c14d3
SHA1 6f0c4a05b104d5988386faf229c4e2af4cd29977
SHA512 d199858a5f2707f3f9d062e9e8a3780d63948c55d87dc1e65d62828f0aeafaf5415c1438011df3e755a9a5b61216192b160fae9018cf086090911a02dc2d5df7
SSDEEP 1536:H7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfQw8NjmOp:b7DhdC6kzWypvaQ0FxyNTBfQr
TLSH
T12E938E41F7E241F7F6F1053500F6A52FEB3AA3285724A8DBCB5C2D529602AD0963D3E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 59 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
548	PING.EXE
6048	PING.EXE
3800	PING.EXE
2824	PING.EXE
3460	PING.EXE
2680	PING.EXE
5988	PING.EXE
4704	PING.EXE
3920	PING.EXE
5812	PING.EXE
6116	PING.EXE
4944	PING.EXE
3664	PING.EXE
1784	PING.EXE
3676	PING.EXE
3776	PING.EXE
4884	PING.EXE
2676	PING.EXE
3912	PING.EXE
5688	PING.EXE
2344	PING.EXE
1176	PING.EXE
216	PING.EXE
6132	PING.EXE
5140	PING.EXE
1148	PING.EXE
5888	PING.EXE
6124	PING.EXE
644	PING.EXE
4860	PING.EXE
6092	PING.EXE
632	PING.EXE
3968	PING.EXE
5520	PING.EXE
4388	PING.EXE
5132	PING.EXE
3480	PING.EXE
3456	PING.EXE
1984	PING.EXE
440	PING.EXE
4184	PING.EXE
3976	PING.EXE
4228	PING.EXE
976	PING.EXE
4208	PING.EXE
364	PING.EXE
4444	PING.EXE
5460	PING.EXE
3732	PING.EXE
1152	PING.EXE
3288	PING.EXE
896	PING.EXE
5920	PING.EXE
1768	PING.EXE
3192	PING.EXE
5092	PING.EXE
4584	PING.EXE
1312	PING.EXE
2596	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4664	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Runs ping.exe 1 TTPs 59 IoCs

Remote System Discovery

T1018

pid	Process
3676	PING.EXE
3480	PING.EXE
6132	PING.EXE
1984	PING.EXE
6092	PING.EXE
1176	PING.EXE
3976	PING.EXE
3776	PING.EXE
548	PING.EXE
1312	PING.EXE
896	PING.EXE
4388	PING.EXE
5920	PING.EXE
3920	PING.EXE
5132	PING.EXE
632	PING.EXE
3288	PING.EXE
5520	PING.EXE
4944	PING.EXE
4704	PING.EXE
5092	PING.EXE
4228	PING.EXE
3192	PING.EXE
4444	PING.EXE
6124	PING.EXE
4584	PING.EXE
2596	PING.EXE
440	PING.EXE
644	PING.EXE
216	PING.EXE
3456	PING.EXE
3912	PING.EXE
1152	PING.EXE
2676	PING.EXE
1784	PING.EXE
4184	PING.EXE
4884	PING.EXE
5460	PING.EXE
3664	PING.EXE
3732	PING.EXE
3968	PING.EXE
2680	PING.EXE
4860	PING.EXE
5812	PING.EXE
6048	PING.EXE
2344	PING.EXE
364	PING.EXE
3460	PING.EXE
4208	PING.EXE
2824	PING.EXE
6116	PING.EXE
5988	PING.EXE
1148	PING.EXE
5688	PING.EXE
976	PING.EXE
5140	PING.EXE
1768	PING.EXE
3800	PING.EXE
5888	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4724	chrome.exe
4724	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 2148	4848	server.exe	87
PID 2148 wrote to memory of 1768	2148	cmd.exe	88
PID 2148 wrote to memory of 3920	2148	cmd.exe	90
PID 2148 wrote to memory of 6092	2148	cmd.exe	91
PID 2148 wrote to memory of 3800	2148	cmd.exe	92
PID 2148 wrote to memory of 3912	2148	cmd.exe	93
PID 2148 wrote to memory of 548	2148	cmd.exe	94
PID 2148 wrote to memory of 5132	2148	cmd.exe	95
PID 2148 wrote to memory of 1148	2148	cmd.exe	96
PID 2148 wrote to memory of 5812	2148	cmd.exe	97
PID 2148 wrote to memory of 5888	2148	cmd.exe	98
PID 2148 wrote to memory of 6048	2148	cmd.exe	99
PID 2148 wrote to memory of 2824	2148	cmd.exe	100
PID 2148 wrote to memory of 3732	2148	cmd.exe	101
PID 2148 wrote to memory of 6116	2148	cmd.exe	102
PID 2148 wrote to memory of 632	2148	cmd.exe	106
PID 2148 wrote to memory of 3192	2148	cmd.exe	107
PID 2148 wrote to memory of 5688	2148	cmd.exe	108
PID 2148 wrote to memory of 3968	2148	cmd.exe	109
PID 2148 wrote to memory of 1152	2148	cmd.exe	112
PID 2148 wrote to memory of 2344	2148	cmd.exe	116
PID 2148 wrote to memory of 1312	2148	cmd.exe	119
PID 2148 wrote to memory of 2596	2148	cmd.exe	120
PID 2148 wrote to memory of 364	2148	cmd.exe	125
PID 2148 wrote to memory of 1784	2148	cmd.exe	126
PID 2148 wrote to memory of 4944	2148	cmd.exe	127
PID 2148 wrote to memory of 3460	2148	cmd.exe	128
PID 2148 wrote to memory of 3288	2148	cmd.exe	129
PID 2148 wrote to memory of 4444	2148	cmd.exe	130
PID 2148 wrote to memory of 2680	2148	cmd.exe	131
PID 2148 wrote to memory of 3676	2148	cmd.exe	132
PID 2148 wrote to memory of 440	2148	cmd.exe	133
PID 2148 wrote to memory of 5988	2148	cmd.exe	134
PID 2148 wrote to memory of 6124	2148	cmd.exe	135
PID 2148 wrote to memory of 1176	2148	cmd.exe	136
PID 2148 wrote to memory of 896	2148	cmd.exe	137
PID 2148 wrote to memory of 5520	2148	cmd.exe	138
PID 2148 wrote to memory of 5460	2148	cmd.exe	139
PID 2148 wrote to memory of 4184	2148	cmd.exe	140
PID 2148 wrote to memory of 5092	2148	cmd.exe	141
PID 2148 wrote to memory of 644	2148	cmd.exe	142
PID 2148 wrote to memory of 216	2148	cmd.exe	143
PID 2148 wrote to memory of 3480	2148	cmd.exe	145
PID 2148 wrote to memory of 4388	2148	cmd.exe	146
PID 2148 wrote to memory of 6132	2148	cmd.exe	147
PID 2148 wrote to memory of 4228	2148	cmd.exe	148
PID 2148 wrote to memory of 3976	2148	cmd.exe	149
PID 2148 wrote to memory of 3456	2148	cmd.exe	151
PID 2148 wrote to memory of 3776	2148	cmd.exe	152
PID 2148 wrote to memory of 1984	2148	cmd.exe	153
PID 2148 wrote to memory of 3664	2148	cmd.exe	154
PID 2148 wrote to memory of 5920	2148	cmd.exe	155
PID 2148 wrote to memory of 976	2148	cmd.exe	156
PID 2148 wrote to memory of 4584	2148	cmd.exe	158
PID 2148 wrote to memory of 4704	2148	cmd.exe	159
PID 2148 wrote to memory of 4208	2148	cmd.exe	160
PID 2148 wrote to memory of 4884	2148	cmd.exe	161
PID 2148 wrote to memory of 4860	2148	cmd.exe	162
PID 2148 wrote to memory of 5140	2148	cmd.exe	163
PID 2148 wrote to memory of 2676	2148	cmd.exe	164
PID 4724 wrote to memory of 1364	4724	chrome.exe	168
PID 4724 wrote to memory of 4664	4724	chrome.exe	169
PID 4724 wrote to memory of 4964	4724	chrome.exe	170
PID 4724 wrote to memory of 4964	4724	chrome.exe	170

C:\Users\Admin\AppData\Local\Temp\server.exe
"C:\Users\Admin\AppData\Local\Temp\server.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\48F.tmp\490.tmp\491.bat C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1768
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3920
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:6092
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3800
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3912
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:548
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5132
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1148
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5812
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5888
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:6048
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2824
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3732
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:6116
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:632
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3192
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5688
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3968
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1152
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2344
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1312
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2596
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:364
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1784
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4944
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3460
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3288
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4444
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2680
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3676
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:440
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5988
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:6124
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1176
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:896
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5520
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5460
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4184
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5092
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:644
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:216
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3480
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4388
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:6132
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4228
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3976
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3456
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3776
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1984
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3664
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5920
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:976
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4584
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4704
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4208
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4884
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4860
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5140
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0xf4,0x130,0x7ffabe9bc728,0x7ffabe9bc734,0x7ffabe9bc740
  2⤵
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1860,i,15469690520889263424,6402686743352674935,524288 --field-trial-handle=1976,i,12807782645645953973,1827322929551264299,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2096 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,2370095663569004063,6382498678435920378,524288 --field-trial-handle=1976,i,12807782645645953973,1827322929551264299,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,16213114137206028364,612211531989508848,262144 --field-trial-handle=1976,i,12807782645645953973,1827322929551264299,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,17238960761913810537,1983624978049591944,2097152 --field-trial-handle=1976,i,12807782645645953973,1827322929551264299,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,5992700570885358973,83080020671336369,2097152 --field-trial-handle=1976,i,12807782645645953973,1827322929551264299,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4492,i,6953973397174654622,16582633856217745942,2097152 --field-trial-handle=1976,i,12807782645645953973,1827322929551264299,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4500 /prefetch:2
  2⤵
  PID:3736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4752,i,9290266306556657224,8760611676153156518,2097152 --field-trial-handle=1976,i,12807782645645953973,1827322929551264299,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3960 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4896,i,12434004919103745932,11539819189643757736,2097152 --field-trial-handle=1976,i,12807782645645953973,1827322929551264299,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:3104

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 219558eed6f846083b81d0f384220f977f6c96139538b08617096b0ad9afcb15
MD5 f0936638e37ad878906c7ae2914927b4
SHA1 f9a6d944fe91857e034c8106c2f58aa1ee56301d
SHA512 decc9d6b440318bf7f82099643f10c62b842e47b220aed4fbb8865d0b643b022e049afcbb99df3d734145157c796ddf6dd9c98849deec1cb6d751264ec2e6d0d
SSDEEP 1536:0cC4cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Yj:0s3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1739302BA9E2646EB957E468176AE780CCE13130D709FA8CC315C639C21D41C92B72E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

491.bat

Path C:\Users\Admin\AppData\Local\Temp\48F.tmp\490.tmp\491.bat
Size 1KB
SHA256 721bf0b2c7b0309393cd028b6d5dd631c32928710c253f92e91c1ee650f21446
MD5 e62ce1905ac0195f5bfb74ed690b201e
SHA1 aa9a8676c75f4071f5bfbe0d1101843b867121af
SHA512 d2403083fc19c5065370e163103cc39bd0706fd7dc6b029c3ade88f20fd83456b6e676bb104264559f327793915a04aeffd011120bebc1a6c29b1aaae8fa92ba
TLSH
T1C23138ABB00C2CF1074F67C9147C606EE047E41F1F42A8D8903930BA762E4CA933D00C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2148-3-0x000002293D640000-0x000002293D70D000-memory.dmp

Download

memory/2148-15-0x000002293D640000-0x000002293D70D000-memory.dmp

Download

memory/4848-0-0x0000000000417000-0x0000000000418000-memory.dmp

Download