Overview

overview

10

Static

static

3

ws-Setup-Complete.exe

windows10-2004-x64

10

ws-Setup-Complete.exe

windows10-ltsc_2021-x64

10

ws-Setup-Complete.exe

windows11-21h2-x64

10

ws-Setup-Complete.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    298s
  • max time network
    188s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    04/07/2026, 03:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ws-Setup-Complete.exe
  • Size 511KB
  • Sample260704-dwhekaaw5v
  • SHA256 5a67fd7e1f3bd5d1bca01efa7bd91407635d0c69e4d8924b0c4c87296dc11d40
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryspywarestealer

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3392
      • C:\Users\Admin\AppData\Local\Temp\ws-Setup-Complete.exe
        "C:\Users\Admin\AppData\Local\Temp\ws-Setup-Complete.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:892
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-fre --no-default-browser-check --disable-background-networking --disable-sync --disable-gpu --mute-audio --new-window
        2⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3940
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff81ecec728,0x7ff81ecec734,0x7ff81ecec740
          3⤵
            PID:1348
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1812,i,2328271296156758950,5344769987274677754,262144 --field-trial-handle=2028,i,7617232552549168124,11219192314770788863,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2012 /prefetch:2
            3⤵
              PID:736
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=1660,i,14949182464897258337,2554253877033790550,524288 --field-trial-handle=2028,i,7617232552549168124,11219192314770788863,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2244 /prefetch:3
              3⤵
              • System Time Discovery
              PID:1596
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,11776633382960280762,6212182775918097306,524288 --field-trial-handle=2028,i,7617232552549168124,11219192314770788863,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2504 /prefetch:8
              3⤵
                PID:4864
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3100,i,7206752136711877839,9399337165279611710,2097152 --field-trial-handle=2028,i,7617232552549168124,11219192314770788863,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3168 /prefetch:1
                3⤵
                  PID:1136
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3104,i,3976619001126730706,12516638629480580131,2097152 --field-trial-handle=2028,i,7617232552549168124,11219192314770788863,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3188 /prefetch:1
                  3⤵
                    PID:3588
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4224,i,11103270745053499335,10360041445009651162,2097152 --field-trial-handle=2028,i,7617232552549168124,11219192314770788863,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4240 /prefetch:2
                    3⤵
                      PID:4280
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4556,i,13155539638079265035,5108076173010560286,2097152 --field-trial-handle=2028,i,7617232552549168124,11219192314770788863,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4544 /prefetch:1
                      3⤵
                        PID:2104
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4760,i,8485337552820198899,10805858381077598864,524288 --field-trial-handle=2028,i,7617232552549168124,11219192314770788863,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4788 /prefetch:8
                        3⤵
                          PID:1628
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4828,i,6255703199057475868,8363763435341943484,524288 --field-trial-handle=2028,i,7617232552549168124,11219192314770788863,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4948 /prefetch:8
                          3⤵
                            PID:548
                      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                        1⤵
                          PID:1860

                        Network

                              MITRE ATT&CK Enterprise v16

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              SCT Auditing Pending Reports
                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                              • Size 2B
                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                              • MD5 SHA1 SHA512
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                              • Size 115KB
                              • SHA256 50a34028ca8efa2ed26cc1b6a8dec3e235129d780899ae663a87f61dc7c109eb
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download