hxxp://cevavietnams-vn[.]com

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://cevavietnams-vn.com
Sample260710-sej96abw2n

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4892	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281693491285360"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
564	chrome.exe
564	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe
5476	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5476 wrote to memory of 3412	5476	chrome.exe	87
PID 5476 wrote to memory of 1840	5476	chrome.exe	88
PID 5476 wrote to memory of 4892	5476	chrome.exe	89
PID 5476 wrote to memory of 1840	5476	chrome.exe	88
PID 5476 wrote to memory of 812	5476	chrome.exe	91
PID 5476 wrote to memory of 812	5476	chrome.exe	91
PID 5476 wrote to memory of 4652	5476	chrome.exe	92
PID 5476 wrote to memory of 3352	5476	chrome.exe	93
PID 5476 wrote to memory of 4652	5476	chrome.exe	92
PID 5476 wrote to memory of 3352	5476	chrome.exe	93
PID 5476 wrote to memory of 468	5476	chrome.exe	94
PID 5476 wrote to memory of 468	5476	chrome.exe	94
PID 5476 wrote to memory of 5748	5476	chrome.exe	95
PID 5476 wrote to memory of 1748	5476	chrome.exe	97
PID 5476 wrote to memory of 1748	5476	chrome.exe	97
PID 5476 wrote to memory of 5284	5476	chrome.exe	98
PID 5476 wrote to memory of 5284	5476	chrome.exe	98
PID 5476 wrote to memory of 4448	5476	chrome.exe	101
PID 5476 wrote to memory of 4448	5476	chrome.exe	101
PID 5476 wrote to memory of 1864	5476	chrome.exe	102
PID 5476 wrote to memory of 1864	5476	chrome.exe	102
PID 5476 wrote to memory of 5020	5476	chrome.exe	103
PID 5476 wrote to memory of 5020	5476	chrome.exe	103
PID 5476 wrote to memory of 4608	5476	chrome.exe	104
PID 5476 wrote to memory of 4608	5476	chrome.exe	104
PID 5476 wrote to memory of 1592	5476	chrome.exe	105
PID 5476 wrote to memory of 1592	5476	chrome.exe	105
PID 5476 wrote to memory of 620	5476	chrome.exe	106
PID 5476 wrote to memory of 620	5476	chrome.exe	106
PID 5476 wrote to memory of 2248	5476	chrome.exe	108
PID 5476 wrote to memory of 2760	5476	chrome.exe	109
PID 5476 wrote to memory of 4604	5476	chrome.exe	110
PID 5476 wrote to memory of 564	5476	chrome.exe	111

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://cevavietnams-vn.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd25abc728,0x7ffd25abc734,0x7ffd25abc740
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,4514519325192421214,15632780962825138534,262144 --field-trial-handle=1908,i,11238808146991595797,14759647754476445976,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,2692886338312273166,14804229585966049747,524288 --field-trial-handle=1908,i,11238808146991595797,14759647754476445976,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2212,i,612678073565430603,18098182341013449277,524288 --field-trial-handle=1908,i,11238808146991595797,14759647754476445976,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:13
  2⤵
  PID:812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3120,i,14126533003734088996,13457108526516266327,2097152 --field-trial-handle=1908,i,11238808146991595797,14759647754476445976,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3140,i,14222804296774526685,10184253576230712009,2097152 --field-trial-handle=1908,i,11238808146991595797,14759647754476445976,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4672,i,3800809734938192779,15939168824954467280,2097152 --field-trial-handle=1908,i,11238808146991595797,14759647754476445976,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5188,i,1370972534147824244,17264693961779825654,524288 --field-trial-handle=1908,i,11238808146991595797,14759647754476445976,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
  2⤵
  PID:5748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5412,i,4635538620243605901,10473172361634648003,2097152 --field-trial-handle=1908,i,11238808146991595797,14759647754476445976,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5444,i,8569252664260394870,2232953792308889357,2097152 --field-trial-handle=1908,i,11238808146991595797,14759647754476445976,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5776,i,11518705636965382817,13482668124783599194,2097152 --field-trial-handle=1908,i,11238808146991595797,14759647754476445976,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5872,i,14152241404941113589,7040618243801474504,2097152 --field-trial-handle=1908,i,11238808146991595797,14759647754476445976,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6016,i,11029736826006707272,8148606479631061132,2097152 --field-trial-handle=1908,i,11238808146991595797,14759647754476445976,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5968,i,528339403754823387,11815163488240238843,2097152 --field-trial-handle=1908,i,11238808146991595797,14759647754476445976,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5888,i,14685419316191000847,12921716274252073050,2097152 --field-trial-handle=1908,i,11238808146991595797,14759647754476445976,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5584,i,6243737647446723794,15052271459871917486,2097152 --field-trial-handle=1908,i,11238808146991595797,14759647754476445976,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3140,i,11123417662956516500,8637956219729592476,524288 --field-trial-handle=1908,i,11238808146991595797,14759647754476445976,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
  2⤵
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6060,i,10123858706018799100,2521400466090108199,524288 --field-trial-handle=1908,i,11238808146991595797,14759647754476445976,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
  2⤵
  PID:2760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,10623890027202421074,5678477894748138918,524288 --field-trial-handle=1908,i,11238808146991595797,14759647754476445976,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5840,i,13971575945967368022,3188144653787608501,262144 --field-trial-handle=1908,i,11238808146991595797,14759647754476445976,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:564

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9f775225-ed25-47df-bd16-30ed31977bb1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9f775225-ed25-47df-bd16-30ed31977bb1.tmp
Size 11KB
SHA256 504167aeab3afc6d0ed8140b1bb16238dd52c78181140d321d49fcf409afc999
MD5 f298aee23b346d66b3066e16eefd07d3
SHA1 36c66c078e390a7b03674e1dfc19a652d3d2a41c
SHA512 df769df201e441770cefc0559830f157d64101f2a8f8cb3d9b7aaa43a36f74eee1f576422a84efc124ba364eb17c016a4347620f916b79c0dd3c4d17fa849abc
SSDEEP 192:5BRKHa1ev7QvAPRp2oQ9XxHsb+WNn4Yejg2gdQejVyIsnAUge:5BRKHga86XefwPx2qe
TLSH
T13232A62EBD10A53B6DCAD229FA617793D7F6102521E43E84EBFC8A2C15DB5CC621700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 25KB
SHA256 bfbd9f83e1dcc1946284d25e48889c074b9e428018b93cd8b61cc55699f6067f
MD5 c1c4de2811033479361e3266f5545d68
SHA1 dedaf335adf039a4233c5fa1c955de1eeff3e310
SHA512 2d0982b45fd688e993573cd168164c896421c2bb0a592947820fdc0f916aec422c548efbec3fb3ad74eecbec37cfacc2532f6b864a12ecb9ad5d361185791898
SSDEEP 768:wqHsKY+zyV115PHFw/MmgJo012tZWq3xv4/DPso1119VP:JH7bOV115vmkmga012tZWqV4/Lso111P
TLSH
T149C2D08353B1FF68C9350A31498D85F7F670A36A6E46CA3FB592313CA3087440AAE4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 120B
SHA256 dd061dce4316c3d985ab7c489afcec34adabbe3de0f24ea5052e96f5cf8cccff
MD5 8f64e1488fbc04bd5fb534823e0ebf80
SHA1 da1b1a8ee25b42b37324d266458297494f302e5f
SHA512 e5c96a513178cddbcd3d5d0ca9f97c024c243b5116f4a47375817b49f7c8918e795a2500eb35ff4488aeca66114e584d66a16d3b69ce40962bada30a9a989ad3
TLSH
T133B0128C52A2049ECF4041310282054167B70A540C12178B50C040D464327E7B905D13
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2d26486e35cdf821790dc5e53265821e334e8907f8091c9e284f4b4fbc254f00
MD5 f00c8abdb7aa4f109bd8a3306d4e5b3c
SHA1 514708fe1deeb6bf9195269cc89959296485a6ab
SHA512 b17c28b27b00cda7f37802746329e9b4cdf97430b8fba990a91f07797a8685267f8d07d83222c1ce09e45d377c636b206492f05ef37e9bbf29a9f43b0b292c83
TLSH
T10271AAF7C7D9997CC94116F9AB152E1BCE1D0D18532C3D1AC8D8AE4F93E2871D21069E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e713c2bd8bb28e461e57a433bfd211ff51edaa60e8418db31a3114a5faa181e9
MD5 16dfbeb341095a489c2dee72672dbeb4
SHA1 d255387b95d0278e19434fd69b78ec9bc43aef06
SHA512 87cd35d3581dc1c37307d5af41285fbb39e49dd4d20783da56ea2cd368d97955d398137294f4fc227615c6bbbdf9389020db4379d197943154d450876f0cbf34
SSDEEP 192:5BRKHa1ev7QvePRpSoQ9XxHsb+WNn4Yejg2rdQeJVyIsnAUgE:5BRKHga8YXCfwPx2rE
TLSH
T11B42972EBD1069376DCAD229FA657B93D7F5102521E03E84EBFC8A2C15DB5CC621701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 28e9d29a5ef94d36515ca7803e6bc1f327f753381f524765bccb7c676a2968b7
MD5 49a3b051bc8714fd9aaf9121d8def6ad
SHA1 4026c08c037d0f01c2ca46cd606904d18ef58e23
SHA512 fad4e244cd3d543237ac14903825b3b8f506fa09199f5348747470a8283d1f289564ec1a1934658cb84523ff9f43e4fe77d883ccf67354652a22023a080cd301
SSDEEP 96:RbJ61d+r2io+TJ/E0f6m934UMfSl8h4otop5gicDJB6RGyvn0SxShlm+9RpNRNCc:Rt2ITo+TQ0IFiU2aPxPSohlm+9RzuCjX
TLSH
T159C10975942C5C7708B6E449B2132E83CDB8206BAA55BFA8FEE90F0D01E74DC5393523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 f7c79bfbac072186493f58685f21e2424289efa57d67879eb0b82a974783f906
MD5 c8874147027358bc3899fdea21b9a059
SHA1 a70ff7db21e0352eee54b2c5bda1f075eb39af70
SHA512 8485c6432024af7cc462007cdc6104a20620f3bcbaedc9cadbc8f28b233277b3d20c3a8839b4bcdd4eafe2da270b5271814febe67eb0b3bb8d8543739b21b600
SSDEEP 96:RbJ61d+r2io+TJ/E0f6m934UMfSl8h4otop5gicDJB6RGyvn0SvQxwzQqShjm+9z:Rt2ITo+TQ0IFiU2aPxPSIxJhjm+9RuUj
TLSH
T1A3C13976B46C5D3711B7E455F2222A93CEB4306B9A51AFA4EFEA0F0C01EB4DC2352523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 ce916a90a028f75d6b8e6a3b88bb4579485209942a07053f0c696690624e28df
MD5 aa9006222c7b259243c9731e66737c68
SHA1 be55735dcd5bf518bbfb852b717a93924785b632
SHA512 917fc8d15a0d944e82e53f4f2b8b36861fd06be26a87c3f16022b4c5cfe88af9dce39b38eb26456003ea4edc83a3c31f9da60ef6a3d89c2ef16fd6b83e3f721a
SSDEEP 96:RC61d+r2io+TJ/E0f6m934UMfSl8h4otop5gicDJB6RGyvn0SvQxwzQqShjm+9Rx:RC2ITo+TQ0IFiU2aPxPSIxJhjm+9RuUj
TLSH
T1D7C12A76B46C5D7715B7E455F2222A93CEB4306B9A51AFA4EEEA0F0C01EB0DC2352523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 a8ab679bb7ddd839c8b7d38fde941347d7188037df4d0b99e6134af755aebb14
MD5 b320bad0195f3c72a366907a86cf2068
SHA1 257e1b940b856446d8b468b1f3aff99adb50465b
SHA512 2a55731255a616ae7b3b4cc45594f4aeff65938e9182b63aa794ba2736ccdc17ffc6930cdeb00c5ef0394e22b497769101b8cb4fba42e19326f6099a8ffa9d23
SSDEEP 96:xC61d+r2io+TJ/E0f6m934zM4RDotok5gmDJB6nGyvn0b4T8RybJv4a:xC2ITo+TQ0InDUDvPPPb4T8Rybl
TLSH
T109A1F836A0284D775076D449B2622A53CFA87067E9A2AFD4EAD90F0D15F74EC1352523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download