d2896ac1149c5dffdf3d9f67822c762d3d7e3e7bd7f38cf289952d73caddebb7

Analysis

max time kernel
149s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
grasslorebook.html
Size 9KB
Sample260804-fp7f8awtdv
SHA256 d2896ac1149c5dffdf3d9f67822c762d3d7e3e7bd7f38cf289952d73caddebb7
MD5 4c487f2e7de96733aa90dd520f523367
SHA1 e6629ed6a528a46f43938d45951c60ef8297c5b3
SHA512 d06fa7f29ce42f4168b15c3054b6ce2e5c43189b9a7a7210a3a4f36a26fd113f65f85532cd161aeb778c56b682dd47b64a6d451938358bcdfe97550273a45809
SSDEEP 192:ooHS6iIFSqugxu6Rnigni6U3qV0OKPGQj5m:o4S4tVHPOqVbehm
TLSH
T17312C8D353B088592297C425FE2BF249B522E4D3F4152D80B6ECC91BEBD3ED1D823956
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3280	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302934674409523"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3400	chrome.exe
3400	chrome.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2336	3052	chrome.exe	89
PID 3052 wrote to memory of 748	3052	chrome.exe	90
PID 3052 wrote to memory of 748	3052	chrome.exe	90
PID 3052 wrote to memory of 3280	3052	chrome.exe	91
PID 3052 wrote to memory of 6016	3052	chrome.exe	92
PID 3052 wrote to memory of 6016	3052	chrome.exe	92
PID 3052 wrote to memory of 3552	3052	chrome.exe	94
PID 3052 wrote to memory of 3552	3052	chrome.exe	94
PID 3052 wrote to memory of 2096	3052	chrome.exe	95
PID 3052 wrote to memory of 2096	3052	chrome.exe	95
PID 3052 wrote to memory of 3676	3052	chrome.exe	96
PID 3052 wrote to memory of 3676	3052	chrome.exe	96
PID 3052 wrote to memory of 4720	3052	chrome.exe	97
PID 3052 wrote to memory of 3852	3052	chrome.exe	99
PID 3052 wrote to memory of 4784	3052	chrome.exe	98
PID 3052 wrote to memory of 3852	3052	chrome.exe	99
PID 3052 wrote to memory of 4784	3052	chrome.exe	98
PID 3052 wrote to memory of 1492	3052	chrome.exe	104
PID 3052 wrote to memory of 1492	3052	chrome.exe	104
PID 3052 wrote to memory of 6024	3052	chrome.exe	103
PID 3052 wrote to memory of 6024	3052	chrome.exe	103
PID 3052 wrote to memory of 2268	3052	chrome.exe	105
PID 3052 wrote to memory of 2268	3052	chrome.exe	105
PID 3052 wrote to memory of 5436	3052	chrome.exe	106
PID 3052 wrote to memory of 5436	3052	chrome.exe	106
PID 3052 wrote to memory of 3520	3052	chrome.exe	107
PID 3052 wrote to memory of 3520	3052	chrome.exe	107
PID 3052 wrote to memory of 2264	3052	chrome.exe	108
PID 3052 wrote to memory of 2264	3052	chrome.exe	108
PID 3052 wrote to memory of 5312	3052	chrome.exe	110
PID 3052 wrote to memory of 5320	3052	chrome.exe	111
PID 3052 wrote to memory of 5352	3052	chrome.exe	112
PID 3052 wrote to memory of 3400	3052	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\grasslorebook.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb3fc4c728,0x7ffb3fc4c734,0x7ffb3fc4c740
  2⤵
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,14793239071757937555,5821195232739166303,262144 --field-trial-handle=1912,i,6860787606708583415,4077741372531379184,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,6960629300331172894,5590583756895842311,524288 --field-trial-handle=1912,i,6860787606708583415,4077741372531379184,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,15763335484819503527,17235446084014055478,524288 --field-trial-handle=1912,i,6860787606708583415,4077741372531379184,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:13
  2⤵
  PID:6016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3188,i,14710025601369117924,9477097029827687677,2097152 --field-trial-handle=1912,i,6860787606708583415,4077741372531379184,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3192,i,8662580435619053731,12693388180585073557,2097152 --field-trial-handle=1912,i,6860787606708583415,4077741372531379184,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4992,i,2870327680098631356,13611644274143352341,2097152 --field-trial-handle=1912,i,6860787606708583415,4077741372531379184,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3244,i,582072601349116080,11324110175699952899,524288 --field-trial-handle=1912,i,6860787606708583415,4077741372531379184,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3376,i,11216152024159095951,390266803873836780,2097152 --field-trial-handle=1912,i,6860787606708583415,4077741372531379184,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5632,i,2896191291881326428,5066323405499578620,2097152 --field-trial-handle=1912,i,6860787606708583415,4077741372531379184,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4796,i,9544567638880654772,3481271379973712510,2097152 --field-trial-handle=1912,i,6860787606708583415,4077741372531379184,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5868,i,8441339203280475519,9555535500976132794,2097152 --field-trial-handle=1912,i,6860787606708583415,4077741372531379184,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5776,i,13906941720024484066,8990289104165405013,2097152 --field-trial-handle=1912,i,6860787606708583415,4077741372531379184,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5852,i,1369631801519349367,14643674706141015986,2097152 --field-trial-handle=1912,i,6860787606708583415,4077741372531379184,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5772,i,18078501748766352320,7309582559018354867,2097152 --field-trial-handle=1912,i,6860787606708583415,4077741372531379184,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4796,i,8767068139458059052,4967723524319537223,2097152 --field-trial-handle=1912,i,6860787606708583415,4077741372531379184,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5576,i,9418681173770205186,11372303461945543538,524288 --field-trial-handle=1912,i,6860787606708583415,4077741372531379184,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:14
  2⤵
  PID:5312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5572,i,12972349288824548685,10127641734986170312,524288 --field-trial-handle=1912,i,6860787606708583415,4077741372531379184,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
  2⤵
  PID:5320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4756,i,6780314191479729389,3948389387671929993,524288 --field-trial-handle=1912,i,6860787606708583415,4077741372531379184,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
  2⤵
  PID:5352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=788,i,14397143472982063802,15396927699333644484,262144 --field-trial-handle=1912,i,6860787606708583415,4077741372531379184,262144 --variations-seed-version --mojo-platform-channel-handle=1128 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3400

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fd90291cfb06c1a122a94affe6c3515092e32fcd878bdffb731f4e0a9cd46398
MD5 cef5d696e64ab01bb22490ba8324b302
SHA1 f16233944f2b859e7ce982bc9667fc027e2f03cb
SHA512 f17e9376779d1e84f754e569612ed8d25ec7ce82a08220e90d8a377984f711ebeef60f6645e8e04859837d21f245e20c1d89dba124042e0b5c9cb96a0fb606e2
TLSH
T113417BF7C7D8997D891156F8AB156E1BCD2D0A18432C3C66C8D8AF1B57F2871D20068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 617be6d1ac57ec2038a203aab813ead2288d68302307000fe3b1f8c759e58a6b
MD5 b4beff074905cbdc5883afff7fb5303c
SHA1 b92c414fecb63990ba65f146671709bee1975320
SHA512 4ba4b9aae7c69c75558e723753d2f31585a20e0a7b5bfae4be78b67579cb901be9a0deb84b3780ef4ebb936734912e9cb397acd4f466fac7fc2dbbf447deccfe
SSDEEP 192:ZR6zolUg2/fv7uvaPRp8TEty9UHsb+WNnSvPUCeq22Lu5lVyIsnAUgE:ZR6zaUBKEXtyGwsPP22OE
TLSH
T17D42A66EAE10697B6DCBC229F9667B63D7F5102231D03E84E6FC8A2C11EB5DC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 0b6c0724eb79021b8153eb9a795e96b74d42cebd0df9908639c735839c62adee
MD5 40c6929e95945e1d515c40d205561300
SHA1 dfd74fffe870ddad81e54e42e81537a2965e5698
SHA512 8b2f5455668584ec64b298247d0afc63674f83c8c032c44ebe266468373b79b7a9042f8b98134a3915ab9c752701f108b40a7c1775e11d67315279ad53abcacf
SSDEEP 192:ZR6zolUg2/fv7uvAPRp2Ety9UHsb+WNnSvPkCeq22Lu5lVyIsnAUgR:ZR6zaUBK6X3yGwsPf22cR
TLSH
T18F32946EAE10697B6DCBC229F92677A3D7F5102231D02E84E7FC8A2C21E75DC6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 93785f5a55dd4064becb4f1cff2db93ee5c453069390cd1f175b14efbc7c3712
MD5 3f745d2e721c8e8653083d0942fd1e3b
SHA1 65c5deb319ad77fa2904b9e80a68747d89661424
SHA512 1054802f590f58b87fcf7dd07e0c496be092915ce6b1963537363cc344b69aa858c5224a631afcd5370a01ccfdb24fd88e105054f3077d30b55a845f9d252488
SSDEEP 192:etK4K6nP7KxkXqK4I40pUZNCgVLHrKHfFKslEOlbXzKD/0T+ErUkKN9mO5a1AfTH:oKj8P7KxkXqKf/pUZNCgVLH2Hfgslxbg
TLSH
T10132EA67948D9E3B4FD8D518CC176B8B6CB4019673780824A6FF9D0403A67CE114A6BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 9705dbc58aa12262cc47311e4ab376a383ad9c414201740d04e22b17e787f7a3
MD5 89072049122a9263536bc539b2770ffc
SHA1 4894186a4fd573493bff65e4c96dde0810957971
SHA512 14faefef37dbb85737a936f399454135286e605b828344dec862ccc827a9f5946825f1b4d8ed6591e088df60ece975300fd28a894f801273fd8ed968bc5776ec
SSDEEP 96:CbJ0d+qKJku7fby2f2eaPphenWSl8h4otop5zItDGB603GyvODcyXxwzjQ4W1ahn:Ct0AJr7fbyVlRiU2iWGFcmxoQ4W1ahHH
TLSH
T112C12A71F86ABC7759F79555B0032E03CEB4A2ABAA406FA4D6DA0F0C00DB0DC1342117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 7c195acf317ee2b5d5b23b0deb3c09ad76c537fc56ee1adb97c6dff4dd4f3506
MD5 b94000974a7a1a4ed96767537b2f75c8
SHA1 0edbdedeaa1ca4e6dc2445114eeedd2b1e64b586
SHA512 ddbb73b374fed75892bf09b562c2d43f85ceaf8e7801fce0013ea966e63874f9300d49abedf32a9320e0c1c2d21ef3ed9790669d98fde78a4ec29690f62cc35f
SSDEEP 96:CbJ0d+qKJku7fby2f2eaPphenWSl8h4otop5zItDGB603GyvODc8ZTahLRNC39IJ:Ct0AJr7fbyVlRiU2iWGFc8ZTahLuCONY
TLSH
T17BC12B71E46E9C7B4DF3A445B1032E43CDA4A2AB7950BF68EAE95E0C01E74DC5383127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 489544e84dd6ced07e73afe7a223928fccdb6e781f8b2aff45706f91947a1fb2
MD5 ccbe396f28a4c0e072dc684506c06f29
SHA1 c7689a596425d1ffff7650bd98496a5607c75bbc
SHA512 8da2ff2aa7baa47c76ecdbacbc823753af854c4ff9a48d5b6d5ba0b6a4778691b8dd6f7432095820ea38296c54ad9f6464e7471c5697a19031d190341170a17e
SSDEEP 96:gC0d+qKJku7fby2f2eaPphrn3RDotok5z3DGB6AGyvODqLh/bjv4a:gC0AJr7fbyVlFDUD/WkFqLh/bH
TLSH
T1AAA11A71F4669C3B5DB7D448B5122E03CFB4B2AB7961ABA4D9DD1F0C01EB0E81741627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 0aaa2b7e769817d04d8ba542090d585a9acd30f8f9f12bd8a4afe8e07aba70a4
MD5 cb2eb1a7ab370ca443e51c8c22c7da29
SHA1 f58677f41ceb728ad623020c6b29448101bead0e
SHA512 7a4de45e944a074d7d8653cac9eb475e6cdf1a60da1033d9eb7fbe5b1ef356fe64125e432834398eddd56592dcebdee7bab4c6c15cc2efea7cdb3bea2af53e29
SSDEEP 96:gC0d+qKJku7fby2f2eaPphenWSl8h4otop5zItDGB603GyvODcyXxwzjQ4kmahHH:gC0AJr7fbyVlRiU2iWGFcmxoQ4kmahHH
TLSH
T1F7C11972F8697C7759F79565B5032E43CEA4A2ABAA506FA4D6EA0F0C00EB4EC1342116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download