Overview

overview

8

Static

static

1

f88309449b...72.gif

windows10-ltsc_2021-x64

Resubmissions

02/08/2026, 12:45

260802-py9glstapf8

02/08/2026, 12:37

260802-ptscjatakf8

Analysis

  • user interaction
    yes
  • max time kernel
    459s
  • max time network
    461s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    02/08/2026, 12:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    f88309449be9cc0425e054eed15f0c72.gif
  • Size 464KB
  • Sample260802-py9glstapf
  • SHA256 1b2849337c4de560f915c5a8e07066b94f7adf39d614f4cb0f3bb5a0918e608e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoverypersistenceprivilege_escalationransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 17 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 40 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\f88309449be9cc0425e054eed15f0c72.gif
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3904
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff99279c728,0x7ff99279c734,0x7ff99279c740
      2⤵
        PID:1064
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,17076637776194219718,9508531908691795280,262144 --field-trial-handle=1996,i,1883759844980278305,16641602184104184817,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2004 /prefetch:2
        2⤵
          PID:896
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,491971242766872592,1949741155250953984,524288 --field-trial-handle=1996,i,1883759844980278305,16641602184104184817,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2196 /prefetch:3
          2⤵
          • System Time Discovery
          PID:2568
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,384334792781124333,13797830026172523186,524288 --field-trial-handle=1996,i,1883759844980278305,16641602184104184817,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2580 /prefetch:8
          2⤵
            PID:4896
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3128,i,15153016620896234246,15401118483967151683,2097152 --field-trial-handle=1996,i,1883759844980278305,16641602184104184817,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3196 /prefetch:1
            2⤵
              PID:3312
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3132,i,7760398129826377363,2772675336889685618,2097152 --field-trial-handle=1996,i,1883759844980278305,16641602184104184817,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
              2⤵
                PID:4104
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3944,i,718382599151064781,18366158328517925384,2097152 --field-trial-handle=1996,i,1883759844980278305,16641602184104184817,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4416 /prefetch:2
                2⤵
                  PID:2092
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5252,i,14032040830822955474,17043729684599577412,524288 --field-trial-handle=1996,i,1883759844980278305,16641602184104184817,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5260 /prefetch:8
                  2⤵
                    PID:2596
                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                  1⤵
                    PID:3384
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                    1⤵
                      PID:2220
                    • C:\Windows\system32\control.exe
                      "C:\Windows\system32\control.exe"
                      1⤵
                        PID:4888
                      • C:\Windows\explorer.exe
                        C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
                        1⤵
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious behavior: AddClipboardFormatListener
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of WriteProcessMemory
                        PID:1860
                        • C:\Windows\system32\OptionalFeatures.exe
                          "C:\Windows\system32\OptionalFeatures.exe"
                          2⤵
                          • Suspicious behavior: GetForegroundWindowSpam
                          • Suspicious use of FindShellTrayWindow
                          PID:1132
                        • C:\Windows\system32\OptionalFeatures.exe
                          "C:\Windows\system32\OptionalFeatures.exe"
                          2⤵
                          • Suspicious behavior: GetForegroundWindowSpam
                          • Suspicious use of FindShellTrayWindow
                          PID:1328
                      • C:\Windows\SysWOW64\DllHost.exe
                        C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                        1⤵
                        • System Location Discovery: System Language Discovery
                        PID:4540
                      • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe
                        C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe -Embedding
                        1⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Drops desktop.ini file(s)
                        • Drops file in System32 directory
                        • Drops file in Program Files directory
                        • Drops file in Windows directory
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:900
                        • C:\Windows\system32\srtasks.exe
                          C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                          2⤵
                            PID:748
                        • C:\Windows\system32\vssvc.exe
                          C:\Windows\system32\vssvc.exe
                          1⤵
                          • Checks SCSI registry key(s)
                          PID:2076
                        • C:\Windows\system32\vssvc.exe
                          C:\Windows\system32\vssvc.exe
                          1⤵
                            PID:4876
                          • C:\Windows\system32\LogonUI.exe
                            "LogonUI.exe" /flags:0x4 /state0:0xa39c1055 /state1:0x41c64e6d
                            1⤵
                            • Modifies data under HKEY_USERS
                            • Suspicious use of SetWindowsHookEx
                            PID:5108

                          Network

                                MITRE ATT&CK Enterprise v16

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                BookmarkMergedSurfaceOrdering
                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                • Size 6B
                                • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                • MD5 SHA1 SHA512
                                Submit Download

                                BrowsingTopicsState
                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                • Size 414B
                                • SHA256 260e7700a5a05c8fa3e47ade311ef94077e0fedac41976bf85f305e1a9fa4dcc
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Network Persistent State
                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                • Size 1KB
                                • SHA256 eb139dcd41dbb2aef61536e547d67fdea2115fbb628d8a010bcc78192af402f7
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                SCT Auditing Pending Reports
                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                • Size 2B
                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                • MD5 SHA1 SHA512
                                Submit Download

                                TransportSecurity
                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                • Size 523B
                                • SHA256 db55c2df8e30e7f681c4ae29f8be97e4e1ffc31f9be033e15bda8b2296cc3cf1
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Preferences
                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                • Size 11KB
                                • SHA256 7c34796561de9f6998ded55791858ed689c4ea9cf384ba6f9ee5b6720938a992
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Secure Preferences
                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                • Size 17KB
                                • SHA256 3f9b2ff6733d6ea176b7f87b97bfc00f43ce5ae2fc7db0bf43e5673b611d2981
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                the-real-index
                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                • Size 120B
                                • SHA256 850907506e4b6b65c13c287f5f51908c1c0e0c03c0dfa4c6c8bf70dad4fb19dc
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                the-real-index~RFe580f6c.TMP
                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe580f6c.TMP
                                • Size 96B
                                • SHA256 640e6a5f70581beb25590f83e95311874aafb8f4f99080c9774b4bf64897cc5e
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                • Size 115KB
                                • SHA256 97bb84e7386a7b0c4f86a793c68f53dc4c3e047e1c7705c00933fdc0508a8857
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                • Size 116KB
                                • SHA256 2838e120b14acdd11a2c502cd6b50b0dafd6ee2c305fa88ac9459531529ba6bd
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                data_1
                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
                                • Size 264KB
                                • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                StructuredQuerySchema.bin
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
                                • Size 414KB
                                • SHA256 4d71760d6f3159849068b635ab4c39b9b747d899f03670533971a62d262c264e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                iconcache_idx.db
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                • Size 28KB
                                • SHA256 525dd88e6ff258f7264f3bf611a467647de84ccdf60f22a038388096e9c3eac2
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                metadata-2
                                • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                • Size 24.0MB
                                • SHA256 503f5a67cf943fd71a893037da6350b7e76e3d83959539435e9fbaa44c781e6f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                {146c57e2-fa83-46f8-9741-df3500e6e059}_OnDiskSnapshotProp
                                • Path \??\Volume{3a7242eb-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{146c57e2-fa83-46f8-9741-df3500e6e059}_OnDiskSnapshotProp
                                • Size 6KB
                                • SHA256 3d44b6a5ce212de075f533461d941f50d8ff224ef5bb2d85eba389d31573e1b9
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download