b5f1c1918958cc87655c667a8192deac8b48f47a1721c313f2cd0e8090939d39

Analysis

max time kernel
900s
max time network
903s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
login.html
Size 78KB
Sample260801-ph7cbaae39
SHA256 b5f1c1918958cc87655c667a8192deac8b48f47a1721c313f2cd0e8090939d39
MD5 e1ab368f12a6c6c511430af70d66b96c
SHA1 fcaf5e58b6d75ca213987330158448dba3bd2857
SHA512 e6b82a2e956479b2197cc340d006ee87ea1628c5a990a955fe9a04fb4d5826adca930391e1a3efbfbdd9ee6e3bebc7b318a8471fa4d65557bd315e36e884d58c
SSDEEP 768:Xy1RrYN4Brhnce3s8TbNpdlLHTpIxzgBkuuRy1RrYN4Brhnce3s8TbNpdlLHTpI2:CPrB1fpw0kuugPrB1fpw0Lqs
TLSH
T1CA7329E953B193F08E4193B8C62958753E4A1CFFA651E204F3AE4C90FB9949DC896DC3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5652	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134300604796021971"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
3304	chrome.exe
3304	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 5812	2944	chrome.exe	88
PID 2944 wrote to memory of 5652	2944	chrome.exe	90
PID 2944 wrote to memory of 3392	2944	chrome.exe	91
PID 2944 wrote to memory of 3392	2944	chrome.exe	91
PID 2944 wrote to memory of 2188	2944	chrome.exe	92
PID 2944 wrote to memory of 2188	2944	chrome.exe	92
PID 2944 wrote to memory of 3096	2944	chrome.exe	94
PID 2944 wrote to memory of 3296	2944	chrome.exe	95
PID 2944 wrote to memory of 3096	2944	chrome.exe	94
PID 2944 wrote to memory of 3296	2944	chrome.exe	95
PID 2944 wrote to memory of 5828	2944	chrome.exe	96
PID 2944 wrote to memory of 3496	2944	chrome.exe	97
PID 2944 wrote to memory of 3496	2944	chrome.exe	97
PID 2944 wrote to memory of 3820	2944	chrome.exe	98
PID 2944 wrote to memory of 3820	2944	chrome.exe	98
PID 2944 wrote to memory of 4280	2944	chrome.exe	102
PID 2944 wrote to memory of 4280	2944	chrome.exe	102
PID 2944 wrote to memory of 2596	2944	chrome.exe	103
PID 2944 wrote to memory of 2596	2944	chrome.exe	103
PID 2944 wrote to memory of 1996	2944	chrome.exe	104
PID 2944 wrote to memory of 1996	2944	chrome.exe	104
PID 2944 wrote to memory of 3264	2944	chrome.exe	105
PID 2944 wrote to memory of 3264	2944	chrome.exe	105
PID 2944 wrote to memory of 1432	2944	chrome.exe	106
PID 2944 wrote to memory of 1432	2944	chrome.exe	106
PID 2944 wrote to memory of 4296	2944	chrome.exe	107
PID 2944 wrote to memory of 4296	2944	chrome.exe	107
PID 2944 wrote to memory of 924	2944	chrome.exe	109
PID 2944 wrote to memory of 2972	2944	chrome.exe	110
PID 2944 wrote to memory of 5036	2944	chrome.exe	111
PID 2944 wrote to memory of 3304	2944	chrome.exe	112
PID 2944 wrote to memory of 1700	2944	chrome.exe	113
PID 2944 wrote to memory of 1700	2944	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\login.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd3089c728,0x7ffd3089c734,0x7ffd3089c740
  2⤵
  PID:5812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2044,i,15483977537097657047,2617213644938477115,524288 --field-trial-handle=1900,i,1376674889840774674,12975259825288636687,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,9973938967507108337,11608872386125726765,262144 --field-trial-handle=1900,i,1376674889840774674,12975259825288636687,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:3392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,16478094712649758723,15314225050673796370,524288 --field-trial-handle=1900,i,1376674889840774674,12975259825288636687,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:13
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3132,i,16866647732406647122,6366040412439906514,2097152 --field-trial-handle=1900,i,1376674889840774674,12975259825288636687,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3140,i,12800014315082734781,14163030390505193122,2097152 --field-trial-handle=1900,i,1376674889840774674,12975259825288636687,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5188,i,10944926793501419421,11149797018516310281,524288 --field-trial-handle=1900,i,1376674889840774674,12975259825288636687,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
  2⤵
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5256,i,16925275754206684321,14578915364002553792,2097152 --field-trial-handle=1900,i,1376674889840774674,12975259825288636687,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5284,i,14788227877807187257,13828605531401276061,2097152 --field-trial-handle=1900,i,1376674889840774674,12975259825288636687,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5316,i,2623901907255173887,10855642875499761387,2097152 --field-trial-handle=1900,i,1376674889840774674,12975259825288636687,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5232,i,6636786002789925082,7918208171697994313,2097152 --field-trial-handle=1900,i,1376674889840774674,12975259825288636687,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5888,i,593386078231376389,13398730024442353613,2097152 --field-trial-handle=1900,i,1376674889840774674,12975259825288636687,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5356,i,10657276595757520786,17107753776888671464,2097152 --field-trial-handle=1900,i,1376674889840774674,12975259825288636687,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5500,i,16027129304688146453,5638355093198219695,2097152 --field-trial-handle=1900,i,1376674889840774674,12975259825288636687,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5256,i,4385189598595510118,3831718795742994617,2097152 --field-trial-handle=1900,i,1376674889840774674,12975259825288636687,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5308,i,9140333939995120925,10312975598937874555,524288 --field-trial-handle=1900,i,1376674889840774674,12975259825288636687,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
  2⤵
  PID:924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,15438987871308852847,14176152404648501401,524288 --field-trial-handle=1900,i,1376674889840774674,12975259825288636687,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,17256323602996678391,563663670245414818,524288 --field-trial-handle=1900,i,1376674889840774674,12975259825288636687,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5912,i,817231012239437057,9533648842843748298,262144 --field-trial-handle=1900,i,1376674889840774674,12975259825288636687,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,4617177046678970810,3974176482311997770,524288 --field-trial-handle=1900,i,1376674889840774674,12975259825288636687,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:1700

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3324

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

68d1b168-42ce-4c7e-b9ee-b1cdbc3e1348.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\68d1b168-42ce-4c7e-b9ee-b1cdbc3e1348.tmp
Size 11KB
SHA256 c94167162789adb55026e5bbf537ae2755a73a62a917b7f63b4fa1e615e9a3af
MD5 c3d31dae1578fce81502ad733bf81778
SHA1 15008a865f03f577c888a5ee7a4a77c74f000d0e
SHA512 c6d27db62fd84d8bb357aa481aa0c08336d51512013e1772701374927475998c44c8eb07720c9d924638cde7efeece1cedcf865cacc14626688c45d54817136f
SSDEEP 192:dRALb40Hv7DvAPRp2r3964Hsb+WNnmlPJS2WpkwKynVyIsnAUge:dRAvXPH6XEbw4PU2+HBe
TLSH
T15632973EBE64697B6CCAC219F9117B53D7F9102261942E94E6FC9A2C10E7ACC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c2c0551f1a410007aa05781131293ed00d9a9f7ecc76ee58413d226d8c896542
MD5 ed766480ebc03deebfd38434436eac8b
SHA1 1739b7c277ff920bc6bdc1305500a7914a45bf25
SHA512 6bdee40a3c483113b6de2c91cad6a1a869fc11dce324ac45b13d00223b668a9b60a8ffcc4428e340da760afd883caf566362bff3840e5fb8ef47c4c26baa1526
TLSH
T10A419DF7C7E8867D890556F4EB156F1BCE2D0A18532C3C26C8D4AE1F57E2872D20064E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 66ad8cd34fce13d7287ecb2e051fb970db246a47b761800213a3639ec6950a62
MD5 525206cff23b04678d26e0c10f731f73
SHA1 eaf4bc9028838d34338b03d681673ce7cda88b15
SHA512 fce18ba2f60c577c64e39935fbb70d04dc4bb59a8cede4e3cf45c0de9c097420b4ef5e8d62dd5a6d9df8c1519e2174a7408e3ce871139501975b12b23e071df5
TLSH
T158418CF7C7D4967D890556F4EB156E1BCE2D0A18532C3C66C8D4AE1B57E2872D20064E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0d84f47a18f0597705c2015e664806be948ee17f91c85998eba7f989c3c65841
MD5 cc14d38d99e18f726ea22b494f6c9778
SHA1 18fa30f9c4f06ef54510de5103157d28e5b1ef72
SHA512 830d5b928894c19640c66709bcaaf7a2497b4e2fe005fe56d16de46ae3a706615e3516567742472dec20d2846bdcbcdd4057f47b30e9a0dcf1b1f93c927119de
TLSH
T18F418DF7C7E4967D890556F4EB156F1BCE2D0A18532C3C66C8D4AE1B57E2872D20068F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 52702caf367fb7d7a944e17e679f8cc040c0cb3c50034d9d643292434694e354
MD5 acb422f8631994fe35f360a17a0bc64e
SHA1 17de028c95a5c356210702bc5671d9ddb03ab371
SHA512 4938678abc6f09d386376b8443bd8173f9ed4833fe0ab9aab0166cffca8d2d380a05f42c20cf3f861df2a74a992a024504af7a2a404fea5b5dd90a7927a142d2
TLSH
T113F059A7A76EBA67007984AE5E09BC05AD76B435015168F4CFEA836CE0865F71B02447
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 89e1788602639de11c85fe48ac190e64f1043f696b3ae7be9345156620e5caf5
MD5 4f7f1bc6d7eba523891484304adfa226
SHA1 eef2182eae38337441567f71a83e3ac0e396c743
SHA512 ee8a036784499f3ec884454e4d39745bb8b3636867f80d46bbe19951a5b31ef2791c382bb182f687d8ae21247dde81bbd5ec57b05407cfdbb0b4c06569459475
SSDEEP 192:dRALb40Hv7DvkPRp+r3964Hsb+WNnmlPMS2WpkwKhnVyIsnAUgE:dRAvXPH+XMbw4PP2+OBE
TLSH
T16642953EBD24697BACCAC219FA117F53D7F9102261902E94E7FC9A2C10E7ACC2217117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 390b2d3da343041b4bb8f377de5389830979e5acb4b3a32e271d3fc5ca5a1343
MD5 f1d1ecef56c7515367970c4fb9982059
SHA1 f06f19e7b260ec45dd7c1a7473c6305622fd3c3a
SHA512 a5481cc24a9c749706ccf1c802022ff66c5e4d682f43b0c45ac900e833baffe27ddc9adb95fce5e8f155b66a2304931e49547d326b46f4ed7e1b489b5b41a529
SSDEEP 192:esz4K6mQ7KxkXqK4I40pUZNCgVLHrKHfFKslEZESXzKD/pQ+ErUkKN93jCxBRq2q:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzS4
TLSH
T13232E827A48E9A3F0FD8D51CD8136F4BADF5425262280D2496FBAD0803E97CA115A5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 8aef4bc6f6d19e2e1a6a65a331541940b917666842e99d6082724ccf5ef10034
MD5 6e62fb6deab3be41f46a748e69b07027
SHA1 28959bade19aea6c8ba60ec4d3d5a57089bbad38
SHA512 2a6ae9d2131db304df5ae78bc66faa3c41e5c40185c53066bf712b9d658ffd7482e1961186732a33b460b6aa9e6a4c5716908eb6c718b0c31d876d2cf5646876
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5ZCDeB6/dGyv95S6hbb2Jv4a:gC0LA/TE57cDUDGeUweS6hbKl
TLSH
T17DA1F9B1B8695EB75D75C544F5827E83CF78A117A9227E84D8ED1F0C10E74E81382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 4dd7442ae05d2add996845c0d5241809df1655f42476c8a73d29c97fa4b4502b
MD5 3802f049be1a6fd000d6aab1f70618ff
SHA1 1da0a196c7f64c94f9283794a72d1f091b0caa50
SHA512 ce9cddda572e0d726a4a241d92e69979cab360f61bc30a72001a1f7ed65096c091196efb30db9b862348c85ef68fd38a0c360ea603e4002e7d640c23ae7aca9a
SSDEEP 96:CbJ0d+cAOIt5aDVmufj7ScDSl8h4otop5ZpDeB6NGyv9JtFiO0AuSwGSD6T0j9I0:Ct0LA/TE57ziU2zel+tFGSwGSD6TUZvX
TLSH
T19FC139B0B86D6D736DF69550F1427E43CEB8A157A9226E948EED4F0C00DB4DC2383A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 5ff25b76eae495642dbee1628f73b76426bf7136f5175a8499f251cdbf85cbd5
MD5 5c2f71b704d7af267d8a6a79629e4e92
SHA1 08e7568b7953e114ebec23de8fcb82301c507f8e
SHA512 bae5600809b11ec2ab144206d541d1fbbc36669c53354f9b66db057ab29068638bf5ed039be1fc3abaa68c11d92f701d275c353c9529c33d356056a018cf3b1b
SSDEEP 96:CbJod+cAOIt5aDVmufj7ScDSl8h4otop5ZpDeB6NGyv9JFjQD6ERNC39ISyVNCFz:CtoLA/TE57ziU2zel+1QD6EuCMJj
TLSH
T180C105B1E86D6DBB9CF6A454F1433D438EA8A11BA9253E98ADED1F0C00D74DC1383923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 202801b7cdda6478c975b8afb00eafbf4a7975a1f85b3e68384b8a05bf738c08
MD5 528b0d26e3b7686151875254c16089d6
SHA1 25ddf8e63ac117ef8312ffe5a3c44e3a21eab127
SHA512 ebe6a240bb68ab8b76d9d659d5211a6ab27893d57363ad427ac728c2c1ba73b78defec32ec807570630c1d56278732cb066f0f757683587d43623ee1eab24900
SSDEEP 96:CbJ0d+cAOIt5aDVmufj7ScDSl8h4otop5ZpDeB6NGyv9JFjQD6ERNC39ISyVNCFz:Ct0LA/TE57ziU2zel+1QD6EuCMJj
TLSH
T1B0C105B1A86D6DBB4CF6A450F1433D438EA8A01B69253E98ADED0F0C00D78DC1383923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 fdffe18e12911595a2f574359d8dc6e91387cbbe1a90fbd6915e247e6e56cb27
MD5 bfd238491b47e64fbb83505a2e30fb74
SHA1 256407275f7d3ce20671b743f88aed88e9461de9
SHA512 adc8cc9a3e439e273b44dedcab38084817a007f401e6a7e19ec231210832e34c3359c587d124ebfec8099bfde15cb9c94e2ae40247de51c0ca69a1c4224e1702
SSDEEP 96:CC0d+cAOIt5aDVmufj7ScDSl8h4otop5ZpDeB6NGyv9JtFiO0AuSwGSD6T0j9IKP:CC0LA/TE57ziU2zel+tFGSwGSD6TUZvX
TLSH
T1E2C13AB0B86D6D736DF69554F1427E43CEB8A157A9226E948DED0F0C01DB4DC2383923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download