229f5f53d8c9325918ed1aa6fb2dd8beeef95f9aed99b41263c1cebeddba672c

Analysis

max time kernel
900s
max time network
866s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-uk
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-uklocale:uk-uaos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
login.html
Size 78KB
Sample260801-pg4j2avcne
SHA256 229f5f53d8c9325918ed1aa6fb2dd8beeef95f9aed99b41263c1cebeddba672c
MD5 c2ebe56915c558046e49876527b05712
SHA1 678db1886e6c197b610c9c3f9b0e612014d129e0
SHA512 d5563bd95caa4230d3de64a81ae1628582b68ffd8f031d3537ce41fecf1da0c9476ee00e855bdb3b007121b30ca1bbde8b1c0a4128bf97a6054998c34ba15ea1
SSDEEP 768:ey1RrYN4Brhnce3s8TbNpdlLHTpIxzgBkuuRy1RrYN4Brhnce3s8TbNpdlLHTpIx:xPrB1fpw0kuugPrB1fpw00Gs
TLSH
T19B7319E953B193F08E4193B9C62958713A4E1CFFA651E204F3AE4C90FB9949DC896DC3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4996	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134300603687882188"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
5284	chrome.exe
5284	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 1092	4312	chrome.exe	88
PID 4312 wrote to memory of 5740	4312	chrome.exe	90
PID 4312 wrote to memory of 5740	4312	chrome.exe	90
PID 4312 wrote to memory of 4996	4312	chrome.exe	91
PID 4312 wrote to memory of 3612	4312	chrome.exe	92
PID 4312 wrote to memory of 3612	4312	chrome.exe	92
PID 4312 wrote to memory of 3956	4312	chrome.exe	94
PID 4312 wrote to memory of 5272	4312	chrome.exe	95
PID 4312 wrote to memory of 3956	4312	chrome.exe	94
PID 4312 wrote to memory of 5272	4312	chrome.exe	95
PID 4312 wrote to memory of 2656	4312	chrome.exe	96
PID 4312 wrote to memory of 788	4312	chrome.exe	97
PID 4312 wrote to memory of 3020	4312	chrome.exe	98
PID 4312 wrote to memory of 788	4312	chrome.exe	97
PID 4312 wrote to memory of 3020	4312	chrome.exe	98
PID 4312 wrote to memory of 620	4312	chrome.exe	100
PID 4312 wrote to memory of 620	4312	chrome.exe	100
PID 4312 wrote to memory of 2436	4312	chrome.exe	101
PID 4312 wrote to memory of 2436	4312	chrome.exe	101
PID 4312 wrote to memory of 1068	4312	chrome.exe	102
PID 4312 wrote to memory of 1068	4312	chrome.exe	102
PID 4312 wrote to memory of 3188	4312	chrome.exe	103
PID 4312 wrote to memory of 3188	4312	chrome.exe	103
PID 4312 wrote to memory of 3124	4312	chrome.exe	106
PID 4312 wrote to memory of 3124	4312	chrome.exe	106
PID 4312 wrote to memory of 3888	4312	chrome.exe	107
PID 4312 wrote to memory of 3888	4312	chrome.exe	107
PID 4312 wrote to memory of 1884	4312	chrome.exe	109
PID 4312 wrote to memory of 1600	4312	chrome.exe	110
PID 4312 wrote to memory of 4876	4312	chrome.exe	111
PID 4312 wrote to memory of 5284	4312	chrome.exe	112
PID 4312 wrote to memory of 2436	4312	chrome.exe	113
PID 4312 wrote to memory of 2436	4312	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\login.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd5e81c728,0x7ffd5e81c734,0x7ffd5e81c740
  2⤵
  PID:1092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,11910608404013041578,13825976813581933026,262144 --field-trial-handle=1940,i,296120874737078102,4982673094257552695,262144 --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:5740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,4082692244393902279,9132084857195855878,524288 --field-trial-handle=1940,i,296120874737078102,4982673094257552695,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,703409348262890299,2562773382911987601,524288 --field-trial-handle=1940,i,296120874737078102,4982673094257552695,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:13
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,10415162138573527159,9737928395817564069,2097152 --field-trial-handle=1940,i,296120874737078102,4982673094257552695,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,17421506370797728830,17575379052082035411,2097152 --field-trial-handle=1940,i,296120874737078102,4982673094257552695,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5208,i,9610157183839681780,4726924054333170073,524288 --field-trial-handle=1940,i,296120874737078102,4982673094257552695,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5280,i,16511230896415052810,2576968216962764807,2097152 --field-trial-handle=1940,i,296120874737078102,4982673094257552695,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5320,i,4768205481080879126,8655617990534408655,2097152 --field-trial-handle=1940,i,296120874737078102,4982673094257552695,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5588,i,16070522984028808690,8739937868149696578,2097152 --field-trial-handle=1940,i,296120874737078102,4982673094257552695,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5584,i,12364804260663603673,1390590767034175058,2097152 --field-trial-handle=1940,i,296120874737078102,4982673094257552695,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5752,i,6771663143730053507,14059000325251825343,2097152 --field-trial-handle=1940,i,296120874737078102,4982673094257552695,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6044,i,18227276852247393164,4447935918713959132,2097152 --field-trial-handle=1940,i,296120874737078102,4982673094257552695,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6160,i,6037279531461770523,7679559030821639021,2097152 --field-trial-handle=1940,i,296120874737078102,4982673094257552695,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6336,i,5528670763587270395,17695709277413909849,2097152 --field-trial-handle=1940,i,296120874737078102,4982673094257552695,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5284,i,6192585656197839776,6454857329901697816,524288 --field-trial-handle=1940,i,296120874737078102,4982673094257552695,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
  2⤵
  PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5208,i,3062210528225147088,2128336533360180314,524288 --field-trial-handle=1940,i,296120874737078102,4982673094257552695,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5232,i,14348502419317324250,7966928970391319186,524288 --field-trial-handle=1940,i,296120874737078102,4982673094257552695,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5368,i,4551926383953004825,5015606650898320548,262144 --field-trial-handle=1940,i,296120874737078102,4982673094257552695,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=uk --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5244,i,3323661636020867020,8078702461328381049,524288 --field-trial-handle=1940,i,296120874737078102,4982673094257552695,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:14
  2⤵
  PID:2436

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3304

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:6060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

03b5dd49-2c5a-41ff-a12b-45b201a1236b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\03b5dd49-2c5a-41ff-a12b-45b201a1236b.tmp
Size 5KB
SHA256 167556c539026a539570d0aef993f7ad4143d785e8e8dd717895ab1ee2af808f
MD5 c323b8920bb8155ce13c302b872f4e42
SHA1 84c0a2c83f93c274fe22b8cf0e49e0662eb9e835
SHA512 80bb3f61a834759053fba59e9f86338d7a862e1a7debcaf48b17bd839ddf60094c6eb4010232d69c0abd6a186b957390abecd2a938185c3eb102ceaac6db1d19
SSDEEP 96:CbJod+cAOIt5aDVmufj7u4cRbSl8h4otop54upDvB6O0dGyv9JrQDtbRNC39ISyB:CtoLA/TE57qpiU2JZ+w+rQDtbuCMJG
TLSH
T124C107B4A86D6DBB9CB6A494F1433D43CEA8A01B69253E58EDED1F0C00D74EC1383527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d0165382500091e30972236c909d99edd1ada758e2da2836631b47aed70e1907
MD5 2f59bcaac4c00d5fc2a3f11c50285cce
SHA1 6b9f76e2abebc971b7c749f6fa240810b585a3b4
SHA512 ada63d14c3fb014d251afd30c2dbda6c77103a18f634a5baaddf633afbaab617dcfa1f1049216bc3bbda9973a9902025cadf3d22542f45b9e480d51f959700df
TLSH
T18041ACF7C7E4867D891552F4EB156F1FCE290A18432C3C66C8D4AE1B67E2872D20068E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 470f29c0a896e3c498674a50d92207bacec0b55dbdd8f076985bf8e8e31a6690
MD5 a1001a5a5ff9fd8ff91044a50689e224
SHA1 11b9d198e69a1ced711335ca5acafadd69979e15
SHA512 cf91dbde66a719e59ef701d828a00d468761a24f21d6ba20ec0b1ebc0e186f5a70eec3c84cd6b293a80bcc8a653757ba74ecb5075e48be94aa9f373445a2f584
TLSH
T1E3418BF7C7E4967D890556F4EB156F1BCE2D0A18532C3C66C8D4AE1BA7E2872D20068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 ffc7afef8e605b5358a79b7b588d5131462a94f8ee9abf4b8a0220495b827f33
MD5 df46f728a4abb0695e5fa98fcae0a3ad
SHA1 7fe3c4ea6222dc372fdeead9ab1a6c49f1149235
SHA512 b98ac2ee7d89785e3ae6a1d6975370cbd6e7239c2671e885393d40df79ac4a1879dd979fc9a82d3f372745961918911c5d62b333892d783e6749bb5f0a2d7372
TLSH
T1A1F059B7A6AE7567107B84BF5D08BC06AC72B435115168F4CFAA826CE0865F71B03443
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 5c8b6be0fc89000e09ee2d3077ed70f915db049bd019e3af2e9619e8eb198e73
MD5 7be94eb6bbad7b9d4a6b9325d1dd1811
SHA1 a561a52ecf1ce112fd136c152857d01bce930f1c
SHA512 390ae61ef52266552fa7ecaae049628b458106ac76dfdbeb1794f333a058d118067a649a797549f4a3ba3f9818c2e17de474970e8073766e016b61af96c94bfe
SSDEEP 192:dR83b4COIv7DvAPRp2rd964Hsb+WNncmPdg2yOkwXjgVyIsnAUge:dR8LWUH6Xubw9Pe2lTke
TLSH
T1C132A53EBE24797BADCAC219F9257B93D7F9002221942E84E6F8992C10E76CC7217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8f6193faba53076e8dc0b74d45019bc171891cfdac727caffc23e2654a5ea582
MD5 6b5c8e894da9fd9fbe47569dd4a0abc5
SHA1 950dcbf5ef21c86be22bb7c62aa5f9679b4a7d3e
SHA512 48e89399b00ffc3d2212f33579499386028a01afe8a89ae81c181a0a7b744809a56913a32ae142a4ddee9501390aea075a535f0e872ba1d00a185238a05d9ac5
SSDEEP 192:dR83b4COIv7DvhPRp1rd964Hsb+WNncmPig2yOkwXigVyIsnAUgE:dR8LWUHhXfbw9PL2lykE
TLSH
T1B142952EBD642D7BADCAC219F9557B53E7F9102221A02E84E7FC9A2C10E76CC7217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 390b2d3da343041b4bb8f377de5389830979e5acb4b3a32e271d3fc5ca5a1343
MD5 f1d1ecef56c7515367970c4fb9982059
SHA1 f06f19e7b260ec45dd7c1a7473c6305622fd3c3a
SHA512 a5481cc24a9c749706ccf1c802022ff66c5e4d682f43b0c45ac900e833baffe27ddc9adb95fce5e8f155b66a2304931e49547d326b46f4ed7e1b489b5b41a529
SSDEEP 192:esz4K6mQ7KxkXqK4I40pUZNCgVLHrKHfFKslEZESXzKD/pQ+ErUkKN93jCxBRq2q:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzS4
TLSH
T13232E827A48E9A3F0FD8D51CD8136F4BADF5425262280D2496FBAD0803E97CA115A5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 16f7b3e2fe9f02b8ce2a2d5008ecdb5de55ce1026fcbdd4ee5a0703f7c70159c
MD5 f53b827669b326e5e09f28ca447ca799
SHA1 4e5bb0c3ed913121e75c43956a7a2c2ba6a4bb69
SHA512 cf4baeb039c8aa43e460255c32f3c28402d6ac8edeb726d98e36402cb5d19036d8a9fa9bbefa3039b758ccd0691d1c31f7182aab29d69099e9f04961c4993466
SSDEEP 96:CbJ0d+cAOIt5aDVmufj7u4cRbSl8h4otop54upDvB6O0dGyv9JrQDtbRNC39ISyB:Ct0LA/TE57qpiU2JZ+w+rQDtbuCMJG
TLSH
T1A0C1F7B4A86D6DBB4CF6A481F1033D43CEA8A05B69257E58E9ED1F1C01974EC2383527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 2cd2532052a5b95ac716490dc0db199daadc2fb2bf2a3e05aaa623fd7e06129c
MD5 20208bce71e267a51cdfeeae24d1100b
SHA1 1310629e57417bf223e2aa8ace8aeb6d5d0d0d51
SHA512 913be7518230118601fe8ffd8c0c4e7e55b9cac1b71e3f4c076925e25af88c293da52ccef71a1fbf6eb313afa1b1a0daf7442c8ed4aea287c8b79778a043d2cb
SSDEEP 96:CC0d+cAOIt5aDVmufj7u4cRbSl8h4otop54upDvB6O0dGyv9JtFiO0AuSwoSDt9x:CC0LA/TE57qpiU2JZ+w+tFGSwoSDt9UK
TLSH
T113C11A70A8AD7D739DF69550F5437D43CEF8A15BAA216E9489ED0F1C01D70EC2382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 5ba69e1d953f81cc32ab51e0a7276c33c55538252f715b831bee9c45c04516b1
MD5 16ca4fad2073ef2be8b5508419d70cc4
SHA1 e1fbda094cf2e168d74ed86b153f7fe9e5d3fb24
SHA512 66711ece5ea651e18aeec945eac90ff2eefe836dc71921d652dfaa322166a35ba6cc20cfeeb7ef42d440804c6b38c57051604b1d1db70b9397bf735afe20d375
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok54uCDvB6/dGyv95Sthbb2Jv4a:gC0LA/TE57cDUD0ZUweSthbKl
TLSH
T1F3A10971B8A95EB75D79C544F5827E83CF78A117AA226F80D9DC1F0C10E70EC2382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 4045d26487062b3743219b109c11d4e542597e826cd88fec8ee01e8c3de7839d
MD5 699f98dcd3ffd7a2e25c4f2e33d08e6b
SHA1 9d56e41f71d3ef027d57e08c181243db95697db4
SHA512 77ca54ebc81e7789337ff84789611e8cffd1e0af8180c94935e3a0244abaae8a00adb49c47154e8258a377c8e6fc6f547f1109f761ecc21fb912604428337fa2
SSDEEP 96:CbJ0d+cAOIt5aDVmufj7u4cRbSl8h4otop54upDvB6O0dGyv9JtFiO0AuSwoSDtH:Ct0LA/TE57qpiU2JZ+w+tFGSwoSDt9UK
TLSH
T1CAC12A70A8AD7E739DF69550F5437D43CEF8A05BAA216E908AED4F1C01D70EC2382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download