d311a4f486e2f81d1ffb11b37782d8bc1325b1df96ff21ab3b3de818ae3d5d84

Resubmissions

28/06/2026, 06:09

260628-gwr6jsfw217

22/06/2026, 23:09

260622-247w7agz4p8

22/06/2026, 23:07

260622-24fgyahs8v4

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 06:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BaBCKW.html
Size 11KB
Sample260628-gwr6jsfw21
SHA256 d311a4f486e2f81d1ffb11b37782d8bc1325b1df96ff21ab3b3de818ae3d5d84
MD5 c229b9d23420402bdea979bae2d31dde
SHA1 cf5cb6cd0c16a3cd252c792a13907df48fa2f0d4
SHA512 bdabdc88c2c5f8c1b6e4730801ad263d8f0172f9cbc19d80de98acaec7d06218f830366b5c10a63cf589de17ed23dd3b84542ab2183f93fe383f9fa3bd6f6fb8
SSDEEP 192:zMilLhIJhKYX5kerCNRupjQ4vYJkTcOHsU:zNOJhda4s4vYJk4OF
TLSH
T1BF32764A1EF280E701E785A97DF2FD0DAD85864BD219FC4832BC80A90FD7D468DC7995
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5684	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271006000663786"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
5460	chrome.exe
5460	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 2196	1388	chrome.exe	89
PID 1388 wrote to memory of 1860	1388	chrome.exe	90
PID 1388 wrote to memory of 5684	1388	chrome.exe	91
PID 1388 wrote to memory of 1860	1388	chrome.exe	90
PID 1388 wrote to memory of 4672	1388	chrome.exe	93
PID 1388 wrote to memory of 4672	1388	chrome.exe	93
PID 1388 wrote to memory of 2312	1388	chrome.exe	94
PID 1388 wrote to memory of 2312	1388	chrome.exe	94
PID 1388 wrote to memory of 3516	1388	chrome.exe	95
PID 1388 wrote to memory of 3516	1388	chrome.exe	95
PID 1388 wrote to memory of 2640	1388	chrome.exe	96
PID 1388 wrote to memory of 4204	1388	chrome.exe	97
PID 1388 wrote to memory of 4204	1388	chrome.exe	97
PID 1388 wrote to memory of 2440	1388	chrome.exe	98
PID 1388 wrote to memory of 2440	1388	chrome.exe	98
PID 1388 wrote to memory of 3844	1388	chrome.exe	102
PID 1388 wrote to memory of 1812	1388	chrome.exe	103
PID 1388 wrote to memory of 3844	1388	chrome.exe	102
PID 1388 wrote to memory of 1812	1388	chrome.exe	103
PID 1388 wrote to memory of 480	1388	chrome.exe	104
PID 1388 wrote to memory of 3216	1388	chrome.exe	105
PID 1388 wrote to memory of 480	1388	chrome.exe	104
PID 1388 wrote to memory of 3216	1388	chrome.exe	105
PID 1388 wrote to memory of 3708	1388	chrome.exe	106
PID 1388 wrote to memory of 3708	1388	chrome.exe	106
PID 1388 wrote to memory of 5208	1388	chrome.exe	107
PID 1388 wrote to memory of 5208	1388	chrome.exe	107
PID 1388 wrote to memory of 5840	1388	chrome.exe	109
PID 1388 wrote to memory of 4636	1388	chrome.exe	110
PID 1388 wrote to memory of 5548	1388	chrome.exe	111
PID 1388 wrote to memory of 5460	1388	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\BaBCKW.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffad16ec728,0x7ffad16ec734,0x7ffad16ec740
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,11664065575667549173,4135485056532873079,262144 --field-trial-handle=1908,i,7040313353512258165,17922497169233218839,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:1860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,5351480547472033075,11950936713276226268,524288 --field-trial-handle=1908,i,7040313353512258165,17922497169233218839,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,4776708879027950306,5663411876502541750,524288 --field-trial-handle=1908,i,7040313353512258165,17922497169233218839,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:13
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3164,i,14343854858385108024,12279868419791572104,2097152 --field-trial-handle=1908,i,7040313353512258165,17922497169233218839,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3168,i,8639598197593457326,8275048273404717048,2097152 --field-trial-handle=1908,i,7040313353512258165,17922497169233218839,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5188,i,4043621463845146845,6832686798464997714,524288 --field-trial-handle=1908,i,7040313353512258165,17922497169233218839,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5256,i,8829758321994546737,17536817162778019749,2097152 --field-trial-handle=1908,i,7040313353512258165,17922497169233218839,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5296,i,1457438411461293067,6334851099524674612,2097152 --field-trial-handle=1908,i,7040313353512258165,17922497169233218839,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5776,i,4734749356427502134,10855449370740974834,2097152 --field-trial-handle=1908,i,7040313353512258165,17922497169233218839,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5640,i,2490446164109477399,8010055900838570205,2097152 --field-trial-handle=1908,i,7040313353512258165,17922497169233218839,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5864,i,8250727307888460507,4264564223597015447,2097152 --field-trial-handle=1908,i,7040313353512258165,17922497169233218839,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5220,i,6653278167512522919,9988042806172108784,2097152 --field-trial-handle=1908,i,7040313353512258165,17922497169233218839,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5340,i,588461470493615364,4228364124125394609,2097152 --field-trial-handle=1908,i,7040313353512258165,17922497169233218839,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5464,i,10098816000084001536,6201896873164150062,2097152 --field-trial-handle=1908,i,7040313353512258165,17922497169233218839,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5300,i,6104434195875305913,18005829856174833436,524288 --field-trial-handle=1908,i,7040313353512258165,17922497169233218839,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
  2⤵
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5292,i,14950610187788527365,11868885519370234485,524288 --field-trial-handle=1908,i,7040313353512258165,17922497169233218839,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,13767379138165416434,8946967596063798037,524288 --field-trial-handle=1908,i,7040313353512258165,17922497169233218839,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:14
  2⤵
  PID:5548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5344,i,2376993075397079723,5490745492034982744,262144 --field-trial-handle=1908,i,7040313353512258165,17922497169233218839,262144 --variations-seed-version --mojo-platform-channel-handle=256 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5460

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 eeba6265a4057cd83793d65e0797b8a5d1e4ba5a8b58f63cddcd423406066803
MD5 2183e731b83fb1ba93016d78aeda69b4
SHA1 939447c33e22639e2f90cc0208906fb21e568844
SHA512 ec6ed4f91222fd2cb418c992e967e0db14e17377df5a2f7160a925d44c81ccfff59c25e5f4fcf84ae3399dc41ef68ff1810f98c8e3ac3e32e614ce0a1c7ecd05
TLSH
T146418CF7C3E8897D890156F4AB156F1BCE290E24532C3C56C9D4AF4F67E2972D21068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c3d41fd186622b2dd023fd2fe62b51c26c1a6da18624d188263cda62343878e6
MD5 e53007bbf4f801a70a0714d652f19c21
SHA1 4c70eca73d25f1204d1019d5d663b51be337752c
SHA512 d5e451760217e481df724de99b0b96d7414b8a407c2d9640457209321b2957d43b35f15a7ae9b8acc0306213a08f47f4b6cc96a935a275efa15010598263c1a7
SSDEEP 192:CRUpIZgYv78vAPRp2Ojy9UHsb+WNnFLPYFBskw3v+VyIsnAUge:CRUpIaEg6X2KwpPFXv2e
TLSH
T12132A82EAD10753BACCBC21AFA65B753E7F5106132982E84EAFCCA2C15D79CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 99591e5046b56bb3c16f79e7def6f5463769ee471787e830f7396df7401b3cef
MD5 0d4ef94613e31369955daa224a049d31
SHA1 33aaf22f47be1a775e69629b83bd39cea762e52d
SHA512 d37da33e12a0f3021a4e781f38b5a27ace0922e8919bacdd5a5b1e63e23d177709057e623158abc51c3bf2e642022c5570bf313dfa53fbe24780101f08011fe5
SSDEEP 192:CRUpIZgYv78vaPRpFOjy9UHsb+WNnFLPiFBskwev+VyIsnAUgE:CRUpIaEgUXLKwpPv+v2E
TLSH
T19D42C72EAD10753BACCBD219FA65BB53E3F9106132942E84E6FCCA2C15D79CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 f869589e66312c9b3f185d28342246087a575847be11fd0d21f65df4ca420508
MD5 a3f1df2b8298b44dcfbd7129e66ac8a1
SHA1 5f324f2f69ac6accdd7f44f7382bbb8a3116ad6e
SHA512 ff1d6d3d5d7489a62932ccb4f788e860221a540504d1035a1f82064195e498baff5d5ccb962cbd346a54f006419bc6f51c5ea057e3b7111edcbb42fa013175f3
SSDEEP 192:e2N4K6CM7KxkXqK4I40pUZNCgVLHrKHfFKslEO+kXzKD/RU+ErUkKN9KGl9VvOfB:/NjpM7KxkXqKf/pUZNCgVLH2HfgslOkV
TLSH
T1D532F827A84D9A7F4FD8E408DC566B8B6DF5414773780C2492FF9D0803A97CA114A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 c98396dc7ddb6c23f500d9d6fb32d1b7126c13ffbc28eebb2892732f5f69fa94
MD5 f30cf4b18f78e5a94efd30bcbe4d0bf6
SHA1 ce758ba233e299955bfddb66f7202bc7f6e1a93e
SHA512 c515cbda57e0cd03f29471674c07d61abc6c730ee155fc990b77070dcc3c9d90bab293bc18f6bb629e7e0eba0bb5172a5ffc81a37978343a9cc651d6526d131f
SSDEEP 96:tbJ0d+0JdBXgpHy6xfYBxd+5qSl8h4otop5kMZADYB6nGyvGinV8TVDRNC39ISyk:tt0LJdBXgNy6YXiU2B2s3IV8TVDuCBU
TLSH
T1CAC1F870986D997B4DF6A44571033E13CDA8619BBA55BF68E9ED0F0C01E34ED5382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 cb64971b5056f48e3cab71effaea8c3dc9b7f541e39a0fcb804c2559c7d7a0f6
MD5 2a046551a31ce54c746a323b2cdb4b12
SHA1 c3ccd3d5a0079579a09d7759d013b31d8ada0043
SHA512 f06e34e662301106b785f27c48b55ffb9e78e4457d06c544cc43781bd312f712622b98301591b8589f487f1d8b5efe4e8f3d8fe236d103b7181c09bc934247dc
SSDEEP 96:tC0d+0JdBXgpHy6xfYBxd+5qSl8h4otop5kMZADYB6nGyvGisaTVnr0j9IB+pHp0:tC0LJdBXgNy6YXiU2B2s3IsaTVnrUC
TLSH
T10BC12A71787C69BB55F2D85574032D03CFB4619BAA426F64DADD4F0D02E71E82382217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 555898888b9dd40cdf7f24579f89263e83acddf80412bea28415d54cac941c97
MD5 1ce9a8eb81515397193a3573fdc4ba3d
SHA1 90b341eb9e4f3069fe0d9f3d2da0be49256f8960
SHA512 99b37e2bc413d5bd5a2aff4e9c85b4f12e59cd39b215cec525553b181fb451ce803441e5b7dd3b8146ace841ab507adb661312a25fa3a5e3efc03db8a4818d92
SSDEEP 96:dC0d+0JdBXgpHy6xfYBxdM51RDotok5kMSDYB6vGyvGdiVgbsYv4a:dC0LJdBXgNy6YGDUD8sT7iVgbsC
TLSH
T182A12871697C8A7B98B6D88578523B13CFB461ABE612AF94D9DC0F0C11E70F91382723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 aed4ac85bdb3556a40e7f4a8d05835cd3dcfe0177e565c464d5e95833b77d788
MD5 f234768cc2a1c56d04ea678f81775ee6
SHA1 952b4a0916d7619b0d5a21e854d4baa5e08aaed3
SHA512 c89a155794eb8894cf830c56142dfe82f6e2f4cfc03e26177aa6a8abee48c0874f421b5adb3f3e41a4c38e7c0a3e8f6211323a4aee2d59f9de2a59e9b4d1489a
SSDEEP 96:tbJ0d+0JdBXgpHy6xfYBxd+5qSl8h4otop5kMZADYB6nGyvGisaTVnr0j9IB+pH6:tt0LJdBXgNy6YXiU2B2s3IsaTVnrUC
TLSH
T13DC12970786C69BB95F6E855B4033D13CEB4619BAA426F64DADD4F0D02E71EC2382217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download