2ac7b013f6e4aca33f48394935001dd33836c7a1319569317d927484978e8909

Analysis

user interaction
yes
max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/06/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
inbox.html
Size 950B
Sample260625-ss3nnads9m
SHA256 2ac7b013f6e4aca33f48394935001dd33836c7a1319569317d927484978e8909
MD5 689296a64db717c2574b760f2d31c208
SHA1 736777a5e02d312b46793ecba75ce7758428015d
SHA512 6820ea31d187d0c7e6249b1df92ae36f0b8bef6a51ddc4c623307ff7aca50f0049ea48a3645df1d7f883da2581fcfdc8bcffe96db3986c9ad15dd6acf921290e
TLSH
T10E11DC922C1DC84952A44E06EEB6B0481489F50A9A2CE85134DDA12A5BD8FD8F8C3ADC
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6036	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134268746687469438"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
2960	chrome.exe
2960	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe
Token: SeShutdownPrivilege	1840	chrome.exe
Token: SeCreatePagefilePrivilege	1840	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 628	1840	chrome.exe	88
PID 1840 wrote to memory of 2476	1840	chrome.exe	89
PID 1840 wrote to memory of 2476	1840	chrome.exe	89
PID 1840 wrote to memory of 6036	1840	chrome.exe	90
PID 1840 wrote to memory of 1168	1840	chrome.exe	91
PID 1840 wrote to memory of 1168	1840	chrome.exe	91
PID 1840 wrote to memory of 4248	1840	chrome.exe	93
PID 1840 wrote to memory of 4960	1840	chrome.exe	94
PID 1840 wrote to memory of 4248	1840	chrome.exe	93
PID 1840 wrote to memory of 4960	1840	chrome.exe	94
PID 1840 wrote to memory of 4440	1840	chrome.exe	95
PID 1840 wrote to memory of 3088	1840	chrome.exe	96
PID 1840 wrote to memory of 3088	1840	chrome.exe	96
PID 1840 wrote to memory of 6000	1840	chrome.exe	97
PID 1840 wrote to memory of 6000	1840	chrome.exe	97
PID 1840 wrote to memory of 840	1840	chrome.exe	99
PID 1840 wrote to memory of 840	1840	chrome.exe	99
PID 1840 wrote to memory of 804	1840	chrome.exe	100
PID 1840 wrote to memory of 804	1840	chrome.exe	100
PID 1840 wrote to memory of 4800	1840	chrome.exe	101
PID 1840 wrote to memory of 4800	1840	chrome.exe	101
PID 1840 wrote to memory of 1768	1840	chrome.exe	102
PID 1840 wrote to memory of 1768	1840	chrome.exe	102
PID 1840 wrote to memory of 4528	1840	chrome.exe	103
PID 1840 wrote to memory of 4528	1840	chrome.exe	103
PID 1840 wrote to memory of 3220	1840	chrome.exe	104
PID 1840 wrote to memory of 3220	1840	chrome.exe	104
PID 1840 wrote to memory of 5568	1840	chrome.exe	108
PID 1840 wrote to memory of 5564	1840	chrome.exe	109
PID 1840 wrote to memory of 1676	1840	chrome.exe	110
PID 1840 wrote to memory of 5520	1840	chrome.exe	111
PID 1840 wrote to memory of 2960	1840	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\inbox.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd4a5bc728,0x7ffd4a5bc734,0x7ffd4a5bc740
  2⤵
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,10451282200719174547,13367385535259591961,262144 --field-trial-handle=1912,i,6854298597025475093,4164299495095622724,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,15346066773966714305,2845352416900323062,524288 --field-trial-handle=1912,i,6854298597025475093,4164299495095622724,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,4394589906273794164,632727593891260953,524288 --field-trial-handle=1912,i,6854298597025475093,4164299495095622724,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:13
  2⤵
  PID:1168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,5359853758048664352,7946474742433997621,2097152 --field-trial-handle=1912,i,6854298597025475093,4164299495095622724,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,15699488739497963382,1051677721899944899,2097152 --field-trial-handle=1912,i,6854298597025475093,4164299495095622724,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,18368155534395991901,4104061103389203525,524288 --field-trial-handle=1912,i,6854298597025475093,4164299495095622724,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5496,i,2138733363959698291,10709763076348647370,2097152 --field-trial-handle=1912,i,6854298597025475093,4164299495095622724,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5536,i,9472222360623202214,12879823657885248508,2097152 --field-trial-handle=1912,i,6854298597025475093,4164299495095622724,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5808,i,2831212222885802039,17916023403583498011,2097152 --field-trial-handle=1912,i,6854298597025475093,4164299495095622724,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5964,i,1433089108171753183,9604072012318365149,2097152 --field-trial-handle=1912,i,6854298597025475093,4164299495095622724,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5992,i,2914384630922301098,15065769176615352384,2097152 --field-trial-handle=1912,i,6854298597025475093,4164299495095622724,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6196,i,6616606927004983771,3129928891665007165,2097152 --field-trial-handle=1912,i,6854298597025475093,4164299495095622724,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6368,i,2571190665436031153,8923399323700527937,2097152 --field-trial-handle=1912,i,6854298597025475093,4164299495095622724,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6500,i,6032567580900624830,845831302973384221,2097152 --field-trial-handle=1912,i,6854298597025475093,4164299495095622724,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,1273549544435214204,13390206089225735149,524288 --field-trial-handle=1912,i,6854298597025475093,4164299495095622724,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
  2⤵
  PID:5568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,5209226617949866225,5875989990687953457,524288 --field-trial-handle=1912,i,6854298597025475093,4164299495095622724,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:5564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,11121950352296323753,17582869133778721600,524288 --field-trial-handle=1912,i,6854298597025475093,4164299495095622724,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6100,i,12410899012689079607,8207339012709001796,524288 --field-trial-handle=1912,i,6854298597025475093,4164299495095622724,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
  2⤵
  PID:5520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4636,i,12184485247409560572,7004699076883034404,262144 --field-trial-handle=1912,i,6854298597025475093,4164299495095622724,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2960

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

bbd44b3a-cd9b-49fe-bc85-8869c69cd472.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\bbd44b3a-cd9b-49fe-bc85-8869c69cd472.tmp
Size 2KB
SHA256 e0deff6be6caa42f3132595e99629a89f0016449bbc27658dbaa762543b2e707
MD5 d689388ec1476c84534dd973a7b42938
SHA1 a4c69a226073a917dfe06c16d0c1f3f19ad94f8d
SHA512 afe2d55485da37ff06fef25964b65249583c6ff7f997416f20b062116bc8d6632ee96aa1033f944b99894d711cc42653d843e44b318fc4b068904cfe5a04f423
TLSH
T1C34199F7C3D8897D891156F8EB252E1ECE290A14532C3C52C9D4AF5F53E2872E20068E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e9128e68fc7b8b62365a68ee5455d32f20fb7e8e8fd0b936908fe44daadd8dd5
MD5 ad730f12a2dc2eb4bf1da48278861f98
SHA1 0b6a557cd50cc19bb1da7344c8ed44a78d3eef90
SHA512 c2e6ef3b14b096a9f28544bd483b593d1792ea204a497ae4f15424310e00f09bf033a619700fee7ab9b1aa0c0fb75377294b7718a12106cf7d411eaa1cb97d42
SSDEEP 192:iRWoB1ZTv7KtvAPRp2GQ9+JHsb+WNnpGPY6Lkw1GVyIsnAUge:iRWkXrU6X4kRw8PZge
TLSH
T1BB32A62EAE24657B5CDBD22AF9257B53D7F5102271942E88E6FCCB2C14DB9CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0587cb990f2b46c5d2cca2117a504d9c5a4c45eaf7ac1d9f6fd55ae5ad456df0
MD5 640f8ea04d3a5c78b3e013a77a97c299
SHA1 2fba1735b45b709582bbc9edc77b8c7206d00033
SHA512 087c8cae4192ef1f9b085854a0114149b1e30c4a1cbf8efac2d69f88cabc27fb4fd6e68d988827a95d8aa50d191839f4a982c53a0c45ec32475c723fa274ede7
SSDEEP 192:iRWoB1ZTv7KtvPPRpbGQ9+JHsb+WNnpGPL6Lkw1iVyIsnAUgE:iRWkXrU/XrkRw8PwEE
TLSH
T1CB42B72EAD20657B5CDBD21AF9657B53E7F5102271942E88E6FCCB2C14EB9CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 15018e4ab65a5b97782e74655e896d87abb057a9ab46b121e5c51f68f91b0c50
MD5 5cc1fd62f76d0e26f10a8bc856ffcbcc
SHA1 7bc64c65aa846d16fa831ef665417f03d84db87d
SHA512 1b852e11fdc0ee5d961f79b659a583872636e2e45a621742e0e64edd1e1a798af1d9a0ade845470ec0fa44e16059659577223326cdf911ea5b3571ec4101a36e
SSDEEP 192:e5q4K6Tv7KxkXqK4I40pUZNCgVLHrKHfFKslEbB7XzKD/0z+ErUkKN9pewW9ss4l:gqjMv7KxkXqKf/pUZNCgVLH2HfgslE7c
TLSH
T16532E927A48D9E7F4FE8E408DC526F4B6CB5019276680C2467FB9D0803A97CE114A6F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 3c43a0065f1917fd006f02e61c1997943b83be0b6a0ec183e6368c1132f0b85b
MD5 2f2c2e52313c0c0999abc9c9e90d806d
SHA1 d3569fbd6c3690e560f210d41eb3c78843bda9ef
SHA512 09def9844c82ea60ce866c29d7e88327ae506dc9cb31041877cd30d401ce251213c114537978660eb69ce40ed5aa2060ec0b44a8c5c71e07381207ca0abcaec8
SSDEEP 96:zbJ0d+jDY8d1NHfmhiWkqiSl8h4otop5KQDtB6HGyvTxbx/xaszRNC39ISyVN8uR:zt08bd1KiWOiU2hz/8b1xa0uCuuR
TLSH
T10CC109B1946D6CB70AB7A88571023E4389B961BB7A157E58F8EE6E0C10E74EC1343237
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 3543d115e27ed5b1010fed0abbe04c22c7b899de003fff0e313c930ac4005fc7
MD5 a17ef2c5c601b04762833bd9ffc7e341
SHA1 de824bf39eceb0824e200168a08d122893b11041
SHA512 5d5e29c0a00178bce6455e1df6d60530193c6531a5b13a2c02fc8e63a73f7d8a6e292e67754fa45b58f48546614b04c3e51a9c2ac48a47fc60ef1bc53eb7e916
SSDEEP 96:zC0d+jDY8d1NHfmhiWkqiSl8h4otop5KQDtB6HGyvTx0Ce1QzbUDg6O//xasVi0+:zC08bd1KiWOiU2hz/8DLEDg6OnxatUw
TLSH
T14CC13BB4647D6C731AF79995B1033B438DF561BB6A016E98E9D95F0C11EB0EC2342137
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 d3058b45bf4188146bd9cb7feece0fce1d9c07a505c6acbb80bbfc601612b59e
MD5 48fe67dee47d2d06d3b1149741e24d0a
SHA1 7156deb00a020aaf0f65a283799c6dc99a769348
SHA512 4963d8ee4ae2f073487b207d1066b52936cb506f29bd0a5d6e4d7ffe660548b04c7184831767c597cc9baeff6b276576e7e1565f97812d288fe73ddbe3c49b89
SSDEEP 96:PC0d+jDY8d1NHfmhiWezqURDotok5KJDtB6nGyvTv1gasYbE/v4a:PC08bd1KiWyDUDyzX8gatbC
TLSH
T1A7A129B2A57C1CB3597BD48675423B43CEB9A1B7B6116E88E8DD5E0C10FB4E81302237
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 dfd35ee52c7068f3fe438bf0b8b518ad659f9dec48f8a5a2b21090da76867c10
MD5 499c23d1afde20e1024a8c01f487d812
SHA1 2abfbc8ae4fba5b1027aad7990d0fbfd6d616acc
SHA512 4dc74b9e0fddc2d087c53b2c005b20fcc3027493a65a95292d5afabf047b3ee9800c2d71ca9346207cdac598bc55150ee38471c27339bcba67880ccdc58a5ea2
SSDEEP 96:zbJ0d+jDY8d1NHfmhiWkqiSl8h4otop5KQDtB6HGyvTx0Ce1QzbUDg6O//xasViH:zt08bd1KiWOiU2hz/8DLEDg6OnxatUw
TLSH
T1B6C12AB4647D6C731AE79995B1023B438DF561BB6A016E58E9E95F0C11EB0EC2342237
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download