f07b3bf518ed267db82ce81086facbf9502c45118d99de5fcb86b378879ddeb6

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 12:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vshost.exe
Size 2.4MB
Sample260629-par8esev6m
SHA256 f07b3bf518ed267db82ce81086facbf9502c45118d99de5fcb86b378879ddeb6
MD5 12752a95c804bc68131219174c06dbaa
SHA1 b474cc92cf0effb0704f5f04645a9574cebe5c80
SHA512 152a0205d1f42bced62542e16ffa3080b38d5b95868111bed32c9780fc83940442b005e25a046ff705034169bf1d4c237e7b9904d8ca4877bfa50ac9f957ff87
SSDEEP 49152:l+qzo3wm4kOyo+2UM20GKnHasaJtVxjDcDugMNCiO:dzTwond20GKKDRR
TLSH
T1E3B59E22FB829072E4D701B012AAABFB5D7D6630533558C7E3C02D6A59206D3763AF5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery spyware stealer

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 15 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
1140	msedge.exe
3208	chrome.exe
2564	chrome.exe
5968	chrome.exe
2664	chrome.exe
5740	msedge.exe
4428	chrome.exe
6324	chrome.exe
2372	chrome.exe
7100	chrome.exe
5436	chrome.exe
1328	chrome.exe
6504	chrome.exe
2608	chrome.exe
5912	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
1428	vshost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
14	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vshost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vshost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6396	chrome.exe
2696	msedge.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4808	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134272085112950143"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1428	vshost.exe
1428	vshost.exe
1428	vshost.exe
1428	vshost.exe
5968	chrome.exe
5968	chrome.exe
1428	vshost.exe
1428	vshost.exe
1428	vshost.exe
1428	vshost.exe
1428	vshost.exe
1428	vshost.exe
1428	vshost.exe
1428	vshost.exe
1428	vshost.exe
1428	vshost.exe
1428	vshost.exe
1428	vshost.exe
1428	vshost.exe
1428	vshost.exe
1428	vshost.exe
1428	vshost.exe
1428	vshost.exe
1428	vshost.exe
1428	vshost.exe
1428	vshost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5740	msedge.exe
5740	msedge.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeDebugPrivilege	1428	vshost.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeDebugPrivilege	1428	vshost.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5968	chrome.exe
5740	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 1428	996	vshost.exe	90
PID 1428 wrote to memory of 5968	1428	vshost.exe	92
PID 5968 wrote to memory of 5648	5968	chrome.exe	93
PID 5968 wrote to memory of 3220	5968	chrome.exe	94
PID 5968 wrote to memory of 3220	5968	chrome.exe	94
PID 5968 wrote to memory of 6396	5968	chrome.exe	95
PID 5968 wrote to memory of 5696	5968	chrome.exe	96
PID 5968 wrote to memory of 5696	5968	chrome.exe	96
PID 5968 wrote to memory of 6324	5968	chrome.exe	98
PID 5968 wrote to memory of 4428	5968	chrome.exe	99
PID 5968 wrote to memory of 6324	5968	chrome.exe	98
PID 5968 wrote to memory of 4428	5968	chrome.exe	99
PID 5968 wrote to memory of 5436	5968	chrome.exe	100
PID 5968 wrote to memory of 5436	5968	chrome.exe	100
PID 5968 wrote to memory of 4824	5968	chrome.exe	101
PID 5968 wrote to memory of 4824	5968	chrome.exe	101
PID 5968 wrote to memory of 1972	5968	chrome.exe	103
PID 5968 wrote to memory of 6504	5968	chrome.exe	104
PID 5968 wrote to memory of 6504	5968	chrome.exe	104
PID 5968 wrote to memory of 1328	5968	chrome.exe	105
PID 5968 wrote to memory of 1328	5968	chrome.exe	105
PID 5968 wrote to memory of 3208	5968	chrome.exe	106
PID 5968 wrote to memory of 3208	5968	chrome.exe	106
PID 5968 wrote to memory of 2372	5968	chrome.exe	107
PID 5968 wrote to memory of 2372	5968	chrome.exe	107
PID 5968 wrote to memory of 2608	5968	chrome.exe	108
PID 5968 wrote to memory of 2608	5968	chrome.exe	108
PID 5968 wrote to memory of 2564	5968	chrome.exe	111
PID 5968 wrote to memory of 2564	5968	chrome.exe	111
PID 5968 wrote to memory of 7100	5968	chrome.exe	112
PID 5968 wrote to memory of 7100	5968	chrome.exe	112
PID 5968 wrote to memory of 2664	5968	chrome.exe	113
PID 5968 wrote to memory of 2664	5968	chrome.exe	113
PID 1428 wrote to memory of 5740	1428	vshost.exe	114
PID 5740 wrote to memory of 2064	5740	msedge.exe	115
PID 5740 wrote to memory of 2696	5740	msedge.exe	116
PID 5740 wrote to memory of 2644	5740	msedge.exe	117
PID 5740 wrote to memory of 2644	5740	msedge.exe	117
PID 5740 wrote to memory of 3892	5740	msedge.exe	119
PID 5740 wrote to memory of 3892	5740	msedge.exe	119
PID 5740 wrote to memory of 3892	5740	msedge.exe	119
PID 5740 wrote to memory of 1140	5740	msedge.exe	120
PID 5740 wrote to memory of 5912	5740	msedge.exe	121
PID 5740 wrote to memory of 1140	5740	msedge.exe	120
PID 5740 wrote to memory of 1140	5740	msedge.exe	120
PID 5740 wrote to memory of 5912	5740	msedge.exe	121
PID 5740 wrote to memory of 5912	5740	msedge.exe	121
PID 1428 wrote to memory of 3844	1428	vshost.exe	122
PID 3844 wrote to memory of 4808	3844	cmd.exe	124

C:\Users\Admin\AppData\Local\Temp\vshost.exe
"C:\Users\Admin\AppData\Local\Temp\vshost.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:996
- C:\Users\Admin\AppData\Local\Temp\P0bj9u3PLtulW\vshost.exe
  "C:\Users\Admin\AppData\Local\Temp\\P0bj9u3PLtulW\vshost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --headless --disable-gpu
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5968
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x13c,0x140,0x144,0x118,0x148,0x7ffe2b8cc728,0x7ffe2b8cc734,0x7ffe2b8cc740
      4⤵
      PID:5648
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1800,i,1721285480369783180,6158709144033021544,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1796 /prefetch:2
      4⤵
      PID:3220
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1800,i,1721285480369783180,6158709144033021544,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1488 /prefetch:11
      4⤵
      System Time Discovery
      PID:6396
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1800,i,1721285480369783180,6158709144033021544,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:13
      4⤵
      PID:5696
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1800,i,1721285480369783180,6158709144033021544,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:6324
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1800,i,1721285480369783180,6158709144033021544,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4428
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1800,i,1721285480369783180,6158709144033021544,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5436
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1800,i,1721285480369783180,6158709144033021544,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:14
      4⤵
      PID:4824
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1800,i,1721285480369783180,6158709144033021544,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
      4⤵
      PID:1972
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1800,i,1721285480369783180,6158709144033021544,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:6504
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1800,i,1721285480369783180,6158709144033021544,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1328
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1800,i,1721285480369783180,6158709144033021544,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3208
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1800,i,1721285480369783180,6158709144033021544,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2372
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1800,i,1721285480369783180,6158709144033021544,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2608
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1800,i,1721285480369783180,6158709144033021544,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2564
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1800,i,1721285480369783180,6158709144033021544,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:7100
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1800,i,1721285480369783180,6158709144033021544,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --headless --disable-gpu
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x26c,0x7ffe2b8ac188,0x7ffe2b8ac194,0x7ffe2b8ac1a0
      4⤵
      PID:2064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2296,i,13836283178832454930,12379789892045441711,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:11
      4⤵
      System Time Discovery
      PID:2696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2296,i,13836283178832454930,12379789892045441711,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:13
      4⤵
      PID:2644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2296,i,13836283178832454930,12379789892045441711,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
      4⤵
      PID:3892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2296,i,13836283178832454930,12379789892045441711,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2296,i,13836283178832454930,12379789892045441711,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5912
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c timeout /t 3 /nobreak & rd /s /q "C:\Users\Admin\AppData\Local\Temp\P0bj9u3PLtulW"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3844
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 3 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4808

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:7052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 ed8d86e673c8b3845a2769a3280188a769116339fc8b9d95b3bb2276026fbf2f
MD5 2c46b2ef5ab7744a6d66815deb38c1e2
SHA1 5d7d2c4e47160c7228ef5e69051a8d392788e301
SHA512 41ec00d2af4be14669f5339ed03535ecfe02e503f27b4ef4eb56d4e4ab00e9f55580e4ee57ba2772b198b35e4c56d3cbaad96152791dc66bf84fae6ddaf2d5fb
SSDEEP 192:URNwVe6v76JiAPRp2A9AHsb+WNnsi0vR2jkkw1qAVyIsnAUge:URNwoWUXf2w90Z2IVqEe
TLSH
T18F32B62EAD24693F9CDAD219FE65B753D7F4102272902E84EAFC8A2C15D75CC2227427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 d1e277aae102aa5d0c705693418ccaf096bbf71954fd55e413952b96a9345eb6
MD5 79d97801c2572187d66d6d77e240cd54
SHA1 98d5329de32efdd32c33b9f0edf35f4478abe26f
SHA512 51fc33ba522952a32719772b310a61068c7ad9a346213b5cf7ae6ebf6439c1201fe27ef76612debbb1e7a11883766720a0dce5a67b4095f23198e569996cf369
SSDEEP 192:eov4K6CE7KxkXqK4I40pUZNCgVLHrKHfFKslHgWXzKD/Vs+ErUkKNwMWLp/B4ZM:Jvj9E7KxkXqKf/pUZNCgVLH2HfgslAWZ
TLSH
T1AB32D927988D9D7F4FDCD50DDC166F8B6CF5029372680D2492FB9D0803E978A524A2BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 f19d36c1d029c87eb9ddd0c285f22e10dbb6ea4c3d33db394770514ae5211d6c
MD5 2188da17f7e0c4501e5523281f7de2b7
SHA1 35d8eb9404efbeb356108bbf8e71f04b91f91c56
SHA512 0bf131a0b725dc9818cea159fc71608968f5155a5addc8efdad26745f50fbc24434b0ef3800bf8b144cf5f430d7faaf16a5e326bea3e490e0204c5a6f7dc1e53
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OuRpX6UqnVumswk0:jeuvBnhJsueMEGvIW1DcP2Ow+Vumsn0
TLSH
T162D3864B3A743002DDE59A721CF050BB5E3CB16D8F55A5D428B620698EF2963B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 3edd013661c3f4a74e4d10dc265f3297a74ae8c378bc93a1a4cf0b1f20b2ae18
MD5 e9863509592be5995817c2db32d8e5a1
SHA1 f4efc5f6613dc4ce3aaa2443a34c7bd1e0ad7028
SHA512 b9002624d02cedecd65c2d98c7eab8f95279fe3b75f1e66af04173603f607e59507835edf656202505dc627f97fe059840720a08b84c4b44b474ef9db1e7f5b4
SSDEEP 96:UuC0d+klsgvZRFKs+X71f/3Rl1RDotok5PpqDrB6eGyvE1BL+zesdbEs3v4a:BC0fls4fFKs6l3DDUDBMV6tBL+zeAbF
TLSH
T196A11A71B4288D7789BAD985B5877E03CE7462ABF5516E80D9ED1F0C00A74EC1341137
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 377d2d702f5397d31405fb7f7c38ff42d97b14813199d6003b3722c3b21faa64
MD5 bf8bcf36f3ec47ca2e9308ed027ca34b
SHA1 a775079842a6ff4aa09481d55e46224d82b83a14
SHA512 13f7a356fa5afc340d2c15b13abf20ea032dcf0d10a2d691f8a6e8d809e52b5452da3c5b574ee273ebb461dede2b8e8b7c5a49c1db32b137cbe8bf2596166d40
SSDEEP 3072:ONckI/VGA9kCgOFkDP3HzNrBvgeL4c2e/HCipe:ONPUGKklOovgmz/HCMe
TLSH
T1CAC3127865D93CFB5873E44AF02B1E1A0EE5F4AD87958C74ABCC038103974989E87E1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fbfdc6639449912c7c98b931d8190c5dc58f3c2a0bf5687e437a1f10d8fb4d03
MD5 0648a8cda5509f4d21f145a8d2e85107
SHA1 0098998314a76ff86c61b0ea846ab42ba2d245f1
SHA512 d12c9f38e4b1be9f515149cbec2d53104d76f99eb87ea993bf787c888cea28fbc81e79244b64386a0c5a5111415c57c4251ad0e5528252f3302570bd3971bd56
TLSH
T1C1D0C0513B2DB402C1241370841343706D09C503E333C10639BDA40CDC9A4C4F3C1543
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a5bd459-228d-4017-aab0-ca6794b58277\index-dir\the-real-index
Size 2KB
SHA256 c9fb97f92bf0bc0e7b66a508a66ac11705c403537f5b1fca6aa0e5af82c3e913
MD5 2720b96034bc2a41937c4415dc38f2c1
SHA1 bea0cf2a8f8fb1e41ef97abb018f5288fa1fe865
SHA512 dc311bf988a543061f53d2722839f2aff162f5ee3f2b6eefff5d7b7d4b943b5273292c412f033c334d294fe8c70a82231767cc6184bbd283a77f9276ec02eb8f
TLSH
T17D4120A85C821B0BDD341AB265B5245C2736A5DD0F888F07657CB53CACC776518A499C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590fc5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a5bd459-228d-4017-aab0-ca6794b58277\index-dir\the-real-index~RFe590fc5.TMP
Size 2KB
SHA256 65d89251b517166920c198415f5620a8ed8c67d652c4f64e4a6f877b3a2b1b94
MD5 0e4b86459023f992a96b5e0b801dd9d0
SHA1 166eb92f592bd08ff910a1d985acca4c242ca776
SHA512 71b0bfcd8b052f814284d85cbef5a2709958925bac8268e05d17e14ae07a8dc8c71680ff52fb456be3f282388772dcd1708daecf08e69b8bcdfcf03d9d533422
TLSH
T1E041B6A15D816B1FEC100072A682104C333FF1A15A488F0B20F8D338ACC37743CA85DC
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 769a3eb5e4f91baf54eacfea3aa594d2de7b961d6407012165522c65e4984319
MD5 7905b6971cf61198bbe95dc79cdd5c3c
SHA1 acf6558e10d0cbd5dc41618b784e1aabd29124e8
SHA512 5398f7e446fdc9a685d78a63f9361275c394ac62f781a691c95472931813b62944b8ccd5e47542cfa3f5a783ea346681b06c6b115ca5235e0053866cbf9bde6c
SSDEEP 384:DNrRZyCSDnxTICYMEhIKyll7svbFKfk7:xFZJSDniwyI1l7svbF9
TLSH
T1EC44640A7B747001EDE2D9725CB080771E3CA16E8F22E6815DB654694EB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1038fe91139a9f63b12058deb87a937f457ec27421ae433cb4acfc901c39df13
MD5 16c352c51880660a00e87a6e2898c6f6
SHA1 e369bd0cae1318fd140430cf7369dbaadcbe9dc6
SHA512 80d8c5cbe37ee975f79744a9a7150420cdde4e6a470fc997d97dd63186dad5a2c55e7073d3570cbc9a35faff02514df8e7f90290256022721f7eec279e112715
SSDEEP 384:naiF1tNn/s3n9Sd8ND8TUNTUlIRBu64RjRXfaMXguEdtpLj/Pb9oRep+8Lk1Iz59:RF1j+9YywgiH0MXgrLj/Aep/v1
TLSH
T11BC23976D860DA7BADE75FC9A70A7B46AEE002A3D0D869D8DAD82E0C00C71DD1307D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vshost.exe

Path C:\Users\Admin\AppData\Local\Temp\P0bj9u3PLtulW\vshost.exe
Size 2.4MB
SHA256 f07b3bf518ed267db82ce81086facbf9502c45118d99de5fcb86b378879ddeb6
MD5 12752a95c804bc68131219174c06dbaa
SHA1 b474cc92cf0effb0704f5f04645a9574cebe5c80
SHA512 152a0205d1f42bced62542e16ffa3080b38d5b95868111bed32c9780fc83940442b005e25a046ff705034169bf1d4c237e7b9904d8ca4877bfa50ac9f957ff87
SSDEEP 49152:l+qzo3wm4kOyo+2UM20GKnHasaJtVxjDcDugMNCiO:dzTwond20GKKDRR
TLSH
T1E3B59E22FB829072E4D701B012AAABFB5D7D6630533558C7E3C02D6A59206D3763AF5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download