dd5dc474c9542a572e344bb1027829d4f8464ea38f33bf297fda28c260e356d8

Analysis

max time kernel
299s
max time network
300s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-2.html
Size 13KB
Sample260708-vtl4eaev5x
SHA256 dd5dc474c9542a572e344bb1027829d4f8464ea38f33bf297fda28c260e356d8
MD5 8c072c053dbc8019ecb13e3b0eb8a707
SHA1 17d70012b7d929ae308c1362adc8f481800f366e
SHA512 5202f9e22ad1e64450caab17b1b5e17edcca7547686e8fba04a856df72ba86806a2c235c97ed97c0a73dc0c924a17e6c624b956100ddb79ae35e17b2a427b34f
SSDEEP 192:Px2PUx2Sx2Bx23Bx2QGx2Hp3Bx27PMAgv:J7BmOTc8p3TRAgv
TLSH
T19752D713F3C01D1599AF4920A5433B7E7F3991DA9F224974A9CB3B7E0B4CCD686C2688
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2544	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280046594610254"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
3964	chrome.exe
3964	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe
Token: SeShutdownPrivilege	4068	chrome.exe
Token: SeCreatePagefilePrivilege	4068	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe
4068	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 2320	4068	chrome.exe	88
PID 4068 wrote to memory of 2544	4068	chrome.exe	89
PID 4068 wrote to memory of 724	4068	chrome.exe	90
PID 4068 wrote to memory of 724	4068	chrome.exe	90
PID 4068 wrote to memory of 3184	4068	chrome.exe	91
PID 4068 wrote to memory of 3184	4068	chrome.exe	91
PID 4068 wrote to memory of 6040	4068	chrome.exe	93
PID 4068 wrote to memory of 4788	4068	chrome.exe	94
PID 4068 wrote to memory of 6040	4068	chrome.exe	93
PID 4068 wrote to memory of 4788	4068	chrome.exe	94
PID 4068 wrote to memory of 6048	4068	chrome.exe	95
PID 4068 wrote to memory of 3296	4068	chrome.exe	97
PID 4068 wrote to memory of 3752	4068	chrome.exe	98
PID 4068 wrote to memory of 3296	4068	chrome.exe	97
PID 4068 wrote to memory of 3752	4068	chrome.exe	98
PID 4068 wrote to memory of 2956	4068	chrome.exe	99
PID 4068 wrote to memory of 2956	4068	chrome.exe	99
PID 4068 wrote to memory of 6032	4068	chrome.exe	100
PID 4068 wrote to memory of 6032	4068	chrome.exe	100
PID 4068 wrote to memory of 5552	4068	chrome.exe	101
PID 4068 wrote to memory of 5552	4068	chrome.exe	101
PID 4068 wrote to memory of 916	4068	chrome.exe	103
PID 4068 wrote to memory of 916	4068	chrome.exe	103
PID 4068 wrote to memory of 5448	4068	chrome.exe	105
PID 4068 wrote to memory of 5448	4068	chrome.exe	105
PID 4068 wrote to memory of 1264	4068	chrome.exe	106
PID 4068 wrote to memory of 1264	4068	chrome.exe	106
PID 4068 wrote to memory of 3992	4068	chrome.exe	108
PID 4068 wrote to memory of 1332	4068	chrome.exe	109
PID 4068 wrote to memory of 5592	4068	chrome.exe	110
PID 4068 wrote to memory of 3964	4068	chrome.exe	111
PID 4068 wrote to memory of 2616	4068	chrome.exe	112
PID 4068 wrote to memory of 2616	4068	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffde986c728,0x7ffde986c734,0x7ffde986c740
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,6031503400330583521,15877487683188354378,524288 --field-trial-handle=2012,i,4962818177608496199,5618445273226579588,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,3213124260636193091,17605456021070678413,262144 --field-trial-handle=2012,i,4962818177608496199,5618445273226579588,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,3088108374712971727,2837042603625393421,524288 --field-trial-handle=2012,i,4962818177608496199,5618445273226579588,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:13
  2⤵
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,10606485117570060394,4129757039188351181,2097152 --field-trial-handle=2012,i,4962818177608496199,5618445273226579588,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,11814383024639186154,7235116052155671852,2097152 --field-trial-handle=2012,i,4962818177608496199,5618445273226579588,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5188,i,13905320609198538435,4320262724504758907,524288 --field-trial-handle=2012,i,4962818177608496199,5618445273226579588,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
  2⤵
  PID:6048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5260,i,15321160238659056596,7404670404709216166,2097152 --field-trial-handle=2012,i,4962818177608496199,5618445273226579588,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5284,i,16481763698340503542,2307560447899284887,2097152 --field-trial-handle=2012,i,4962818177608496199,5618445273226579588,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5568,i,17382630600193026255,15666598209453408499,2097152 --field-trial-handle=2012,i,4962818177608496199,5618445273226579588,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5604,i,14239111698128651050,11017234723357373108,2097152 --field-trial-handle=2012,i,4962818177608496199,5618445273226579588,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5864,i,4579282993258666254,2908229260799468276,2097152 --field-trial-handle=2012,i,4962818177608496199,5618445273226579588,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6112,i,1699792341459874861,8846104800570451505,2097152 --field-trial-handle=2012,i,4962818177608496199,5618445273226579588,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5904,i,12952532430710252840,5128018386306816239,2097152 --field-trial-handle=2012,i,4962818177608496199,5618445273226579588,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6432,i,11236012438816208933,12163913871465141211,2097152 --field-trial-handle=2012,i,4962818177608496199,5618445273226579588,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6356,i,2547559634059273277,12804229974543979041,524288 --field-trial-handle=2012,i,4962818177608496199,5618445273226579588,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
  2⤵
  PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6148,i,13402012334979589558,2161068739374504837,524288 --field-trial-handle=2012,i,4962818177608496199,5618445273226579588,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
  2⤵
  PID:1332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5712,i,295702210697782452,4588770807155583160,524288 --field-trial-handle=2012,i,4962818177608496199,5618445273226579588,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
  2⤵
  PID:5592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6176,i,1022600509072591114,6045359047122586052,262144 --field-trial-handle=2012,i,4962818177608496199,5618445273226579588,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3064,i,15239066689403230285,8945632595992803187,524288 --field-trial-handle=2012,i,4962818177608496199,5618445273226579588,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:14
  2⤵
  PID:2616

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bab9559c3edf99ad176dc66107cd7ef459a9fa91a22a0961443169dee9b8de4c
MD5 68d80b89d3b032a49f612c9c7cec07e1
SHA1 8a4d74a104373af29dbce5d7e10ca10b6949c8ba
SHA512 7be53237d8f27685e5454863d35955f7913af073e7ed6a0745f55598c2de416c34f2273f91ad74422344d16ca04146b8f28a394282bb9742aa559eabbe462fee
TLSH
T168419BF7C3D8957D891152F4AB256E2FCE290A14432D3C66C8E4AE1F57E2871E24064E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 f1c4ff38acc3062e5c21ae0086ba99a561be9403c3158e466ee550665c65fe0e
MD5 bce9c90f175d56ce87e9dfc9af946837
SHA1 78bada3433803b757ab33aea6596c564f4de043b
SHA512 e85ccb6e0b4fd82ead200203e61f86b95defd676a684217a87fc9bdb0df895d93adee79436adbf12dad9a5f148997b4672352ffbae9b9fd2fc477cac198b8e29
SSDEEP 192:ZR8BITiv7DasAPRp2gG99Hsb+WNnOcP/seNSVyIsnAUge:ZR8BEuiNXA/wJPKe
TLSH
T1EA32A42EAE14B53B5CCBD229FE657B53D6F5102126D42E84E6FC8E2C11EB6CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e6af14b4b680b178454b22df9eeef0bcc6a0ac4c32a2b731643881437bf86c36
MD5 ae16e804eed9700a397d7ed5bd100fc7
SHA1 99751c8afdb041c4d83387a9993dd6cba7f962f1
SHA512 fbe6032dc6616fefde0fdc09d0456bc8d70caa8d2b8aa05d0327bdfefe7811fe76478014dc7328a0c1b9270bc95e27371035bc826e8b4036b9bada005d1b5a70
SSDEEP 192:ZR8BITiv7DavAPRp2gG99Hsb+WNnOcP/seNSVyIsnAUge:ZR8BEui6XA/wJPKe
TLSH
T1FC32A42EAE14B53B5CCBD229FE657B53D6F5102126D42E84E6FC8E2C11EB6CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 46afbc8cc36fa66f75833f4d37f1c2c317422431060ac17b2460e3790759df47
MD5 175820d5a64d4a7c9b758c7ba0717c95
SHA1 8f890d447c9fe3730ac169408b6ce7ec664e1a8c
SHA512 6a44045bdd1c5521177987be58851c88c0ed542ed6f8e7154bf9c1bd825344d3c445699efb206aefc402690f11b3864138b103afcc2561da89cd31922891334c
SSDEEP 192:ZR8BITiv7Dav2PRp0gG99Hsb+WNnOcPwsekSVyIsnAUgE:ZR8BEuiQX+/wJPWE
TLSH
T15832962EAD14653B5CCBD229FE657B53D6F5103126D42E88E6FC8E2C15EB6CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 5d419091364e950e1f726ac0282fe90b1b2082f733ecaff3bf597aee94b21a8c
MD5 60a211c98142e082adc1fc2c563f0a47
SHA1 6f1aa8ca27b53c06e4238affd4065a144ca3ea43
SHA512 10f288e985977ef88e15d052616dc6930d2fafe655877984b28a25624ca82e8d44f60f87d044d6ff0a461474f140dd2be52c074dd05a7b23146af870a08a114c
SSDEEP 192:eGZ4K6tV7KxkXqK4I40pUZNCgVLHrKHfFKslEFPdXzKD/K1+ErUkKN9NlwLBHxCo:3ZjyV7KxkXqKf/pUZNCgVLH2Hfgslwd3
TLSH
T1FD32EA27998DAA7F4FD8D51CCC566F4B6DB5029633280C2452FFAD0803A97CE114E6BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 c98f4edc1ca68a3f1db53ee5aa0c236aee7d1ec40ff0af15675b3302638c5891
MD5 b6033b1b014d3b9a635c21f2f381bd5f
SHA1 d5c567c122eb22b3fda0f9a851f61e63407ca72b
SHA512 1f2741184667db94f02a8392a360a0797ba4e6d84a602e4fa32d1fadad0c580281436cb4cc4583515d67e68ef4207c8ebf80f3ffe045b593ce69a74b71e093ed
SSDEEP 96:FMbJ6Cd+T5Kj8OfQo1elrRSl8h4otop5ZCDMB6KGyvbahIYq/jRNC39ISyVNBFA4:OtlTjVuiU2mA+/hIYq/juCbJ
TLSH
T103C1D971D46E9C7B69B7A88871033E43CDB860ABB9547E88E9E91F0C01E74ED1343627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 7239fa7db649689bec61f5d55fbf47d27e1344a61573df4faf52b17fc808b14c
MD5 851b5b3f4be034fe9f2978b6f8ee0700
SHA1 20b56f7f8e82817022f648d5d984457ddcf33702
SHA512 c18febe3e644303cae16edc3afd5e2df534324dea381598ad23a2a1b207d234d375ba4488ff7b2f7138c67df6f6a6a8c7df1258f8f3cad7bc1c80ff4ed0dd43c
SSDEEP 96:FMC6Cd+T5Kj8OfQo1elrRSl8h4otop5ZCDMB6KGyvba7FxwzzlYKwIeq/x0j9ISX:OClTjVuiU2mA+/7FxhKwIeq/xUv
TLSH
T17BC10B71F4AEAC7765B79945B1023A43CEF820ABAE409F94DAE91F0D01E70BD1343523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 7ffe66c14b5f0991159dc678bf0d7f22f4d825812f6fcfc762fe4aab1bfafdbf
MD5 86b460101c63ba70f46200019e2abf2a
SHA1 7053f241b23a2a051be8f2b27ce2d2da88a2d0fe
SHA512 1b390cb6c48c906c8a2b7a67d668f2171ba164cd5fef9632cec683b41aa0923492e0144d9531de68646aa0ca619b6ee8bafcb5b43ac1fa4db338c4117a19491f
SSDEEP 96:FuC6Cd+T5Kj8OfQo1LrQRDotok5ZsDMB64GyvbNsb/YbcLDqv4a:8ClTjVWDUDwAgosb/YbcLo
TLSH
T169A1E971E56D9C77647AD488B5423B43CFBC70ABA9919FC8A9E81F0C10F74B91302A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 d6f8aff949e721360e02e3f80eab198714b9405146c0395eee0e12b718dbc237
MD5 05dc511ee1b39d5baa2980c205a4de65
SHA1 200030df019e1121e501d3ba97dc502120cedb35
SHA512 c71dff87759dd5eb75250c1965e8251b528379798b89bb98d0d4ad8583559ff8f8ba5d4eecdf63fb24069f52e003c5daaad0c60ac46709f15afaeb4ad465f08d
SSDEEP 96:FMbJ6yd+T5Kj8OfQo1elrRSl8h4otop5ZCDMB6KGyvbahIYq/jRNC39ISyVNBFA4:OtxTjVuiU2mA+/hIYq/juCbJ
TLSH
T152D1DA71D46E5C7B69B7A84871033E43CDB860ABB9547E98E9E91F0C01E74ED1343627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 df8dc5fcb99d203f89b092e9d56f78cba17d6e376db58f728e973bfa0b158c72
MD5 f16c1ae2722ba07f7e44e41972b060a1
SHA1 782892a93f42efbc1eff5df2314dad9c9cc38b87
SHA512 f6834369c26d500f10ce393e2e6c78705d6478c9023231bc290226c57d4b2571e5e432e3435b0129e0848c312f8f990c89a0ec50ceff5fb61d91ca352eab9c7b
SSDEEP 96:FMbJ6Cd+T5Kj8OfQo1elrRSl8h4otop5ZCDMB6KGyvba7FxwzzlYKwIeq/x0j9Iu:OtlTjVuiU2mA+/7FxhKwIeq/xUv
TLSH
T13FC11A71F4AEAC7765B79945B1023A43CEF860ABAA409F94DAE91F0D01E70BD1343523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download