Analysis
- user interaction
yes - max time kernel
900s - max time network
556s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 19:57
General
- Target tokoyo (2).bat
- Size 48KB
- Sample260808-yn95tsteld
- SHA256 e5edea2b5e1a52645b01fb1cb4f4a04bf6bc06f29152cb829181c12449cb2af5
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies data under HKEY_USERS 9 IoCs
- Modifies registry class 39 IoCs
- Suspicious behavior: EnumeratesProcesses 15 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 56 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 59 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tokoyo (2).bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con: cols=120 lines=602⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "& { try{ $r=Invoke-RestMethod -Uri 'http://apilayer.net/api/validate?access_key=demo&number=+1 (239)662-4977' -ErrorAction Stop; Write-Host 'Country:' $r.country_name; Write-Host 'Carrier:' $r.carrier; Write-Host 'Location:' $r.location }catch{ Write-Host '[ERROR] Lookup failed' } }"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "& { try{ Resolve-DnsName -Name outlook.com -Type MX -ErrorAction Stop }catch{ Write-Host '[ERROR] No MX records' } }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "& {2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa8,0x134,0x7fff4081c728,0x7fff4081c734,0x7fff4081c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1852,i,18181451532973702455,13876669568465980843,524288 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,1260937490072889060,13047395103677771479,262144 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,10409786697845392682,5307072248370003393,524288 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,15212375535368861800,12703036515430361611,2097152 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,16064832883526940898,898039160709901051,2097152 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4664,i,8259791927591377576,9236901302671162538,2097152 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4832,i,15192151444869678151,958735571020988154,524288 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,12455992719923379569,13645389968314634739,524288 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5456,i,11047377361473356314,16515598950387926249,2097152 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5480,i,7056294102149016636,770655901136396623,2097152 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5796,i,9077663622180211745,9592851888716620739,2097152 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5940,i,12491742680606755189,15447955450905911135,2097152 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,1724757698368646987,10724127776413154056,524288 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6112,i,17449360751979899545,1572961478778295217,2097152 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6116,i,818808335507987988,6237539618177507652,524288 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5616,i,11104547593758388653,2398889863101638891,2097152 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5728,i,3182745249643245685,8603589427375247523,2097152 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6548,i,1426717967623787592,8059898896944909903,2097152 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6016,i,453849736269013881,4794486685719410956,2097152 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,6385015701803621916,18379500526457780774,524288 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3492,i,15753128449786797413,8990470764698203041,2097152 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6584,i,4678028587647404368,1639068824412540421,2097152 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3708,i,4138035904838203992,12935791012993863674,524288 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3228,i,17602480300068001593,17392663766963904159,524288 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4676,i,1654547824144822234,16421862560808209911,524288 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6252,i,7145893766628560978,6245852928990082519,2097152 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5592,i,12620201832691041378,8949472708415448421,2097152 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3604,i,494687757559830408,2663565865083164042,524288 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3700,i,13306384374579087234,4186743465271390182,524288 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:142⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5928,i,373094436890750427,2316644158367253500,262144 --field-trial-handle=2012,i,13977531035406520762,5194068365772627149,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\System32\CredentialUIBroker.exe"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
BookmarkMergedSurfaceOrdering
f_000006
temp-index
the-real-index
messages.json
craw_background.js
CURRENT
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
index
index.txt
index.txt
index.txt~RFe5ced26.TMP
the-real-index
the-real-index
the-real-index~RFe5c676c.TMP
data_0
data_1
data_2
data_3
MANIFEST-000001
8f79b02d-cab4-4bf6-a59f-7cf6afa9ce92.tmp
Network Persistent State
Local State
Local State
Local State
Local State
Local State
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
prep_Activatable Class_Hermes_perf.cache
__PSScriptPolicyTest_g554ggqc.rgf.ps1
messages.json
memory/1592-1694-0x0000015781C80000-0x0000015781CA0000-memory.dmp
memory/1592-1695-0x0000015781E60000-0x0000015781F60000-memory.dmp
memory/1592-1715-0x0000015781DA0000-0x0000015781DC0000-memory.dmp
memory/1592-1729-0x0000015781DC0000-0x0000015781DE0000-memory.dmp
memory/1592-1683-0x00000157801E0000-0x00000157802E0000-memory.dmp
memory/3672-38-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp
memory/3672-25-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp
memory/3672-37-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp
memory/3672-35-0x0000017B4C740000-0x0000017B4C75A000-memory.dmp
memory/3672-24-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp
memory/3672-22-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp
memory/3672-34-0x0000017B4C710000-0x0000017B4C720000-memory.dmp
memory/3672-31-0x0000017B4C100000-0x0000017B4C11E000-memory.dmp
memory/3672-33-0x0000017B4C5B0000-0x0000017B4C5BA000-memory.dmp
memory/3672-26-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp
memory/3672-19-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp
memory/3672-27-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp
memory/3672-32-0x0000017B4C3F0000-0x0000017B4C4A2000-memory.dmp
memory/3672-28-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp
memory/4704-1-0x00007FFF25B4F000-0x00007FFF25B50000-memory.dmp
memory/4704-7-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp
memory/4704-8-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp
memory/4704-6-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp
memory/4704-5-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp
memory/4704-9-0x0000022D61B20000-0x0000022D61CE2000-memory.dmp
memory/4704-18-0x0000022D614D0000-0x0000022D615D8000-memory.dmp
memory/4704-10-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp
memory/4704-4-0x0000022D48DF0000-0x0000022D48E12000-memory.dmp
memory/4704-11-0x0000022D62220000-0x0000022D62748000-memory.dmp
memory/4704-12-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp
memory/4704-13-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp
memory/4704-14-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp
memory/4704-15-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp
memory/4704-17-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp