Analysis
- user interaction
yes - max time kernel
149s - max time network
138s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
06/08/2026, 15:30
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://share.articulate.com
Resource
win10ltsc2021-20260513-en
12 signatures
150 seconds
General
- Target http://share.articulate.com
- Sample260806-sxt73svbla
Score
6/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4460 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305038545484504" chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4232 chrome.exe 4232 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe - Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4232 wrote to memory of 3024 4232 chrome.exe 82 PID 4232 wrote to memory of 3088 4232 chrome.exe 83 PID 4232 wrote to memory of 3088 4232 chrome.exe 83 PID 4232 wrote to memory of 4460 4232 chrome.exe 84 PID 4232 wrote to memory of 4624 4232 chrome.exe 85 PID 4232 wrote to memory of 4624 4232 chrome.exe 85 PID 4232 wrote to memory of 3544 4232 chrome.exe 87 PID 4232 wrote to memory of 3544 4232 chrome.exe 87 PID 4232 wrote to memory of 3320 4232 chrome.exe 88 PID 4232 wrote to memory of 3320 4232 chrome.exe 88 PID 4232 wrote to memory of 3464 4232 chrome.exe 89 PID 4232 wrote to memory of 3464 4232 chrome.exe 89 PID 4232 wrote to memory of 4168 4232 chrome.exe 90 PID 4232 wrote to memory of 4168 4232 chrome.exe 90 PID 4232 wrote to memory of 2920 4232 chrome.exe 91 PID 4232 wrote to memory of 2920 4232 chrome.exe 91 PID 4232 wrote to memory of 3352 4232 chrome.exe 92
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://share.articulate.com1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffeb96cc728,0x7ffeb96cc734,0x7ffeb96cc7402⤵PID:3024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,1263445435806808864,3206749510131497872,262144 --field-trial-handle=2028,i,8465875304016312623,16128704199137644706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2024 /prefetch:22⤵PID:3088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,13578654909594402241,12865663362056775452,524288 --field-trial-handle=2028,i,8465875304016312623,16128704199137644706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2284 /prefetch:32⤵
- System Time Discovery
PID:4460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,18231010839100048447,7647160278064512180,524288 --field-trial-handle=2028,i,8465875304016312623,16128704199137644706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2564 /prefetch:82⤵PID:4624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,11250864255022895493,15182388031859086271,2097152 --field-trial-handle=2028,i,8465875304016312623,16128704199137644706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:3544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3148,i,11212970755268477250,10790985160135768084,2097152 --field-trial-handle=2028,i,8465875304016312623,16128704199137644706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:3320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4196,i,10933420251865151225,2436523398151385288,2097152 --field-trial-handle=2028,i,8465875304016312623,16128704199137644706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4212 /prefetch:22⤵PID:3464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,6812418126070526477,15340144021115236154,2097152 --field-trial-handle=2028,i,8465875304016312623,16128704199137644706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4720 /prefetch:12⤵PID:4168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4868,i,17412974865495467348,2085029409627811954,2097152 --field-trial-handle=2028,i,8465875304016312623,16128704199137644706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4884 /prefetch:12⤵PID:2920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5240,i,13484409270806668649,6022800791716119399,524288 --field-trial-handle=2028,i,8465875304016312623,16128704199137644706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5248 /prefetch:82⤵PID:3352
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1728
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1136
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 235344329c50fd828300292a3a7868925407e1e1bd2c959ed88f13b24c620346
- MD5 f1a8112aa0ce4e2a8f720b861094642a
- SHA1 e6a28fe31ab731f652b070b045c9fb6799011612
- SHA512 783dd80db44609efa3754b749b39085e8d4afa3390d43e6526047d4c5065079ff5fe0a7dd489bfe17c9b1c00531f100d7cf36bb49eb8344effc5ebb8b75ea42c
- TLSH T121E022A9CC32BD3719FC4B2950584A46E74153A62A84892F3F3D811C8FB463A46CAC2C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 2884241e3c937c0f6b1d9e016a84a2255f179065acf06cc536e26888f4aad184
- MD5 70625336e35772318e2862ffbe9b4533
- SHA1 a343a416e2c9cbac91814498b1371162bc34e199
- SHA512 9dca1ae7c900ece9a42506dc4f5f6398fb38d40c2fc8b2baa084c459cdbdae7cb7aa8d1dcc8460468fb669e089ac66c9306824138dbd75dd77a2b6121104e518
- TLSH T1F5318BF793B4997E8A0092F4EB156E1FCE690524131C3CA689E46E1B53F28B2D10078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 691B
- SHA256 7ec7943ece74243e06c32023f5dd9f7bd2aa766db6cc46fe52fe7c9b00659fed
- MD5 5ae940740a3e74746fae300ab78fd075
- SHA1 5bfd38b4d4f0d68e217ea14ff420cfc9690d6e8c
- SHA512 e5758c1f1ab71dd1a035bd8a63c20b8f89bdfe11ca0e0e23d22754cb08efafcc659890c8e17db55144102c38af689ce8cc85669d666dc870a6e4f9b3426f5140
- TLSH T10D017BAB977E7867117D1ABF5F04BC0555B5A431028198F4CBA6416DF0C56B31F1206B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 6a189e6b805a86e8912c8058d8882ef93e40c2270b87d98cd84f1277341c631f
- MD5 66e5b6364c9d79b75dc2190228fa77b2
- SHA1 d9c837671efb67ff205b5a3467c1c4bd24c5a908
- SHA512 c7dbc389379d17583bcff399eed5b387ac4ff16bce6231c5092a6c52fb1f64374fc3bd2323455cd269d91ffd0dc930b53364a87281972057253b4db2dd9382cd
- SSDEEP 192:AROpihpCzuqgv7YnpAPRp2F69oHsb+WNnQJP9PPyIsnAUge:AROpIpw8kUXtuwmPhe
- TLSH T17932A51EA924A93B5CCAD32AFA767B53E3F6102120D12E48D7FC892C15E75DC221741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 3f9b2ff6733d6ea176b7f87b97bfc00f43ce5ae2fc7db0bf43e5673b611d2981
- MD5 a8d99a89af5bdc4d36bda0a26f9a1835
- SHA1 eb4f61f12dbd8bc006b66b5635e820349ee33d41
- SHA512 c99be19c76c0ad1a08682264926ddb11a255acc2f228d7157f1abd1d4a7df9d1f680e336435cd220b8f27397dfc7a98def0531d0590cc20f63719683618de399
- SSDEEP 384:GYjax7KxkXqKf/pUZNCgVLH2Hfgslzh7pLuLcSjoJXODap+ErU3+pHG2xw4483G:Gsax7KxkXqKf/pUZNCgVLH2HfgsVh7p2
- TLSH T15272F967AC48DD370F94CA8CDC277F4FADB9024B65ED846442FA982903D5ADA11062FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 51d25542b9e4181f92b14bacde57fca59f8ab816a23b10b37612e864b529775b
- MD5 659e3412b9833d20425a99b670a58618
- SHA1 dc1540855cdbab00bb976af684ccd73773e18637
- SHA512 edb5e44e68854f0d7b24adfde67a9ac961cec1325738b0a9a45de013451e138cc3c976ff6c4aa5ceb72423a315c05195cf8528b416a2d68c173b3f8dbe0c750b
- TLSH T155B0120080019300C00202B4154218C8A114EF119609270143F06A26CC35161C014050
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5817aa.TMP
- Size 96B
- SHA256 a82325ad9fce69b72a2e9f63c525060f170b9126c47b4968e35835a71056e671
- MD5 1dbdbe7c0c86ab20ab81b3fd6a4cdd7c
- SHA1 45720c5213d26e8edb57448ca7236fd2d4a5636d
- SHA512 dafa0a762914145b7d1deae0c9fd1abc3880f8cdf77723ddc8dafd76363d944cc2d1471c45a3d0c4175262bc510f340aece526fc3b9229f90471e2738532867c
- TLSH T164B022C0C003A203C0020BF0288080E8F020CF20E2030223A2F02B23CC32220082A020
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 574db8f37fe4a0432f5e46fb4c233a1fa5bf5590027f570de25962b8ac68a8fb
- MD5 3f4dafdf8715a1ee94e3d6270c41f3fe
- SHA1 9fabf42a1c44cc9c810eaf139621eee161853c4a
- SHA512 07a0adc5d7e17344ad52324c92cceffe530a0e6d5925b2df88ff4c325a924d6d6d606ad120d23b219cd95a8fe66a21f8f0ff9322cea995547be1b9da644fbd2a
- SSDEEP 3072:5YajfaNqkTzjzEndotdvR01Ad4DzaDtBKU7f2GuO48mK0v81N:xjSNqOjQC362d4YtkMf2GuP8mKm+N
- TLSH T197C302D1CBF2CC5BC26546CDE4355BCA49D08DA4E945EA8663DA3B5B382F1CA7A03431
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 9f42edb6b02225e4ec55eda8a788740284e748466d1179e0083f410e5212a4ef
- MD5 f11fe35bcc0e99fe6473ef8abd382246
- SHA1 f415cd690930b9eff14341439b9100bbe85ed0f1
- SHA512 03bb4939636eef3b3f5be320b84a92e3544360a54f3d13649329a99d53a3d1e68c4ddf26734bec085f624ac8a3cb0daf9cdc74371f62c776c1ba048f54061f00
- SSDEEP 3072:BcajfaNqkTzjzEndotdvR01Ad4DzaDtBKU7f2GuO48mK0v81N:ZjSNqOjQC362d4YtkMf2GuP8mKm+N
- TLSH T17AC312D0CBF1CC9BC26542DDE4359ACB89D08DA4E945EA8663DA3B5B342F1CA7B43431
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP