hxxp://cmd /c "TWqz2Dv1[.]cmd"

Analysis

user interaction
yes
max time kernel
900s
max time network
888s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/09/2026, 21:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://cmd /c "TWqz2Dv1.cmd"
Sample260923-1eb8jsdf43

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6084	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134346728186172148"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
4292	chrome.exe
4292	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 4556	2532	chrome.exe	90
PID 2532 wrote to memory of 6084	2532	chrome.exe	92
PID 2532 wrote to memory of 1164	2532	chrome.exe	93
PID 2532 wrote to memory of 1164	2532	chrome.exe	93
PID 2532 wrote to memory of 4364	2532	chrome.exe	94
PID 2532 wrote to memory of 4364	2532	chrome.exe	94
PID 2532 wrote to memory of 2988	2532	chrome.exe	95
PID 2532 wrote to memory of 5692	2532	chrome.exe	96
PID 2532 wrote to memory of 2988	2532	chrome.exe	95
PID 2532 wrote to memory of 5692	2532	chrome.exe	96
PID 2532 wrote to memory of 3532	2532	chrome.exe	97
PID 2532 wrote to memory of 3532	2532	chrome.exe	97
PID 2532 wrote to memory of 2928	2532	chrome.exe	98
PID 2532 wrote to memory of 2928	2532	chrome.exe	98
PID 2532 wrote to memory of 3220	2532	chrome.exe	99
PID 2532 wrote to memory of 4432	2532	chrome.exe	101
PID 2532 wrote to memory of 4432	2532	chrome.exe	101
PID 2532 wrote to memory of 5404	2532	chrome.exe	102
PID 2532 wrote to memory of 5404	2532	chrome.exe	102
PID 2532 wrote to memory of 4372	2532	chrome.exe	105
PID 2532 wrote to memory of 4372	2532	chrome.exe	105
PID 2532 wrote to memory of 1984	2532	chrome.exe	106
PID 2532 wrote to memory of 1984	2532	chrome.exe	106
PID 2532 wrote to memory of 468	2532	chrome.exe	108
PID 2532 wrote to memory of 5352	2532	chrome.exe	107
PID 2532 wrote to memory of 468	2532	chrome.exe	108
PID 2532 wrote to memory of 5352	2532	chrome.exe	107
PID 2532 wrote to memory of 2768	2532	chrome.exe	110
PID 2532 wrote to memory of 6060	2532	chrome.exe	109
PID 2532 wrote to memory of 2768	2532	chrome.exe	110
PID 2532 wrote to memory of 6060	2532	chrome.exe	109
PID 2532 wrote to memory of 824	2532	chrome.exe	112
PID 2532 wrote to memory of 824	2532	chrome.exe	112
PID 2532 wrote to memory of 3820	2532	chrome.exe	116
PID 2532 wrote to memory of 964	2532	chrome.exe	117
PID 2532 wrote to memory of 1744	2532	chrome.exe	118
PID 2532 wrote to memory of 4116	2532	chrome.exe	119
PID 2532 wrote to memory of 4116	2532	chrome.exe	119
PID 4036 wrote to memory of 2468	4036	cmd.exe	120
PID 2532 wrote to memory of 4632	2532	chrome.exe	121
PID 2532 wrote to memory of 4632	2532	chrome.exe	121
PID 4036 wrote to memory of 1316	4036	cmd.exe	122
PID 2532 wrote to memory of 4292	2532	chrome.exe	123
PID 2532 wrote to memory of 5012	2532	chrome.exe	124
PID 2532 wrote to memory of 5012	2532	chrome.exe	124
PID 2532 wrote to memory of 1252	2532	chrome.exe	136
PID 2532 wrote to memory of 1252	2532	chrome.exe	136
PID 4036 wrote to memory of 3836	4036	cmd.exe	137

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	52	curl/8.8.0

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://cmd /c "TWqz2Dv1.cmd"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x138,0x13c,0x140,0x114,0x144,0x7ffb8c3fc728,0x7ffb8c3fc734,0x7ffb8c3fc740
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,7581186035717851715,15451270944751287350,524288 --field-trial-handle=2532,i,11800391487318556486,16377583892103319033,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,15282076875399311632,8771789003557985021,262144 --field-trial-handle=2532,i,11800391487318556486,16377583892103319033,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:2
  2⤵
  PID:1164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2064,i,809335652227726570,18066230032104655546,524288 --field-trial-handle=2532,i,11800391487318556486,16377583892103319033,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:13
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,13156781372392850363,15198345967320579786,2097152 --field-trial-handle=2532,i,11800391487318556486,16377583892103319033,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3200,i,89384947651901983,15988753810036271263,2097152 --field-trial-handle=2532,i,11800391487318556486,16377583892103319033,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4664,i,8214999041500719422,4153537032178436722,2097152 --field-trial-handle=2532,i,11800391487318556486,16377583892103319033,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3232,i,16218505624137352801,22200402466994272,2097152 --field-trial-handle=2532,i,11800391487318556486,16377583892103319033,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4668,i,15342396782862685110,5154180855820418858,524288 --field-trial-handle=2532,i,11800391487318556486,16377583892103319033,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:14
  2⤵
  PID:3220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5372,i,1549534477829832467,13660203323931971601,2097152 --field-trial-handle=2532,i,11800391487318556486,16377583892103319033,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4748,i,2611198751987718971,994571091164688675,2097152 --field-trial-handle=2532,i,11800391487318556486,16377583892103319033,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5384,i,2146946813718099885,17563712873191163774,2097152 --field-trial-handle=2532,i,11800391487318556486,16377583892103319033,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5804,i,2621458278693056692,13020082942709113050,2097152 --field-trial-handle=2532,i,11800391487318556486,16377583892103319033,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5436,i,1380531124765166298,3368788706411442812,2097152 --field-trial-handle=2532,i,11800391487318556486,16377583892103319033,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4792,i,13317469341467984258,11326388691509096082,2097152 --field-trial-handle=2532,i,11800391487318556486,16377583892103319033,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5388,i,5381236530301626628,5951427853975873858,2097152 --field-trial-handle=2532,i,11800391487318556486,16377583892103319033,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5812,i,5465641832739236443,8989882048669988817,2097152 --field-trial-handle=2532,i,11800391487318556486,16377583892103319033,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5348,i,2819450948370472087,7946697318945891159,2097152 --field-trial-handle=2532,i,11800391487318556486,16377583892103319033,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4708,i,8139002698472081726,12598427110168781125,524288 --field-trial-handle=2532,i,11800391487318556486,16377583892103319033,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
  2⤵
  PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,13024884709018587479,4593282183934421801,524288 --field-trial-handle=2532,i,11800391487318556486,16377583892103319033,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:14
  2⤵
  PID:964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4756,i,3703102463768917628,7897317504266571306,524288 --field-trial-handle=2532,i,11800391487318556486,16377583892103319033,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4844,i,9473257029739659113,4492487943415271990,2097152 --field-trial-handle=2532,i,11800391487318556486,16377583892103319033,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=1040,i,2064987568843429530,12706107370300541015,2097152 --field-trial-handle=2532,i,11800391487318556486,16377583892103319033,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4432,i,2409353174356020943,6032804756689889610,262144 --field-trial-handle=2532,i,11800391487318556486,16377583892103319033,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,7264484533760634619,1531752245647836807,524288 --field-trial-handle=2532,i,11800391487318556486,16377583892103319033,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:14
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4708,i,9750024948789761361,15149420560338050383,2097152 --field-trial-handle=2532,i,11800391487318556486,16377583892103319033,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:1252

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5644

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Windows\system32\cmd.exe
  cmd /c"TWqz2Dv1.cmd
  2⤵
  PID:2468
- C:\Windows\system32\cmd.exe
  cmd /c"TWqz2Dv1.cmd"
  2⤵
  PID:1316
- C:\Windows\system32\curl.exe
  curl.exe downloads node-v18.20.5-win-x64.zip from nodejs.org followed by tar.exe extraction
  2⤵
  PID:3836

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2652

C:\Windows\System32\where.exe
"C:\Windows\System32\where.exe"
1⤵
PID:1744

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d4c354c723dc7c8a5a32d2b64e722b94589248ba99259cb4d8996618ef1874da
MD5 b6f043461aebb105a4e6c7a0659f524b
SHA1 255788e3835bfaf27dec635a346f6a68d7325fc4
SHA512 c89dfb3c298a5f5224be2af1703c51db1a6eb74679e2984de1f339a80f7dd85f62b55fcf8207d9ad3c0bba42a5860ec42a914bf3d4d9164a5d7225f8308de1ef
TLSH
T1EE416BF7C3D8967D890156F4A715AF1FCE290A14532C3C6AC8D4AE1B97E28B2D21075F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8e7f75ba3bdc1dfbad9d2964d33025d151041f82cc0d2cbc6515fd32e6b36c2b
MD5 878e79cf6f21d707db704ebd2bb58f07
SHA1 4e8e9fde3bd4510aa1cb7fc7890d3d56dd720c4b
SHA512 34f32ecabf8f1981621f8fb9e1fd4f0e4c587871a25e06b90ccc87c615725eb58e7031dc2c65124ea398cd00f9108859b9b4f80d1bc75ef3542db12ad5226252
TLSH
T18C419FF7C3D8967D890156F4A715AF1FCE2D0A18532C3C16C8D8AE1F93E28B1D21065E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a2a050aefa616bdefa98c57a1f2fdfdcd6bba297203270804cdba0700b44c566
MD5 11fcb891e226e5412dc748584cfe2520
SHA1 cb36f958ec9e3e01a350aa346139fce147babc3b
SHA512 163b7ede91e47817fe14fb9f19cbb4a18d1b5890da8b678522b053da6b7166ed9538db98877aee30fa9cbaf47e46967cf483907770667d303bf5f25d726418ee
TLSH
T12D419DF7C3D8967D890056F4A715AF1FCE290A14532C3C66C8D4AE1B93E28B2D21075F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 c2368e9305f77cbcc675bad96f7bdbd6cdc3085c8ce2b446d864cf6d112e35a6
MD5 a83f9c59ecb3d6d44b9404beb28080fc
SHA1 08c283c39b31a1a8d88b15b65a2a532b758a5eba
SHA512 3af10bdf8424fa4c9d9d5119480680e7de5b9b1d589a1a6ff2e0ab01d328db9bfa2afcb1540df77c8082f1470607d61ef6876c9a2197b3f7fd87ae02e01f7264
TLSH
T1A1F09EE7E6FFB47B10B947AB1D04F84565B6AC700342ACE4CE9A826DA0C45E31F17447
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c506ceea425deaf00968d47c3ba5bd8679f810d12095279071399e36049fecc2
MD5 24510da548d39be7e0092a47889bfdbc
SHA1 913cf82edca826fcfbe9cd2991da4eaf0215e577
SHA512 b65012a3043ca7079fe7cb33c5f55b53481c643cbac3b6f68729f442cc8b9ba1a77c8e251916abb2b3fa9f7ff0ad0080f802db86edbfb6f244d336c95129245f
SSDEEP 192:vRhXbcqbHbAAMLKzTtv7DvAPRp2FhY9bHsb+WNnhQQP3Qo278kwxCPd+VyIsnAUp:vRurx8/6XTBwRPN2YRC12e
TLSH
T1F632A32DEE20B53B9DDBC32AFA657B97D6F5102161902E84E6F8893C21E76CC7217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 98df85bcee34843d5991818545cdeee92a970146c3dc349d7002a45f41727f9a
MD5 2469ca1aa50816ff49853dbb55c7dc60
SHA1 d2c86d8554cf1084b17814d4986c3c1c915d09af
SHA512 fa34a6d8d099969528d41a3691ef7799e4d9344130213f754557d08a3a36a943458ff6fff2ea8a32d6dc65b315c43ee7b80d03f80c10c88a264f302f6d95164b
SSDEEP 192:vRhXbcqbHbAAMLKzTtv7DvT4PRpQSFhY9bHsb+WNnhQQfhcdO2CfQo278kwxCPdF:vRurx8/2XIBwRB2+2YRC12E
TLSH
T18F42A42EED10753B9DDBC72AFA657B96E6F4102161902E84E6FC8A3D21E76CC7217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 a8d05ce4258ab69f052919f11b91415edd181d302260d8a8fc99e05bae9a7b6c
MD5 83c8f05d54aeb219a726e1f5f46aaa06
SHA1 2fec40bf9b80b7be99550b6b0df5894cf6926f1e
SHA512 e6823013afe0c7bdd16396b10c2ce20b92404ccca4c1bbea09fc552180b9787216ecb61fe741df025eeb9ed5172c7f411c0028f299a76de5a329d4abc27c8f4d
SSDEEP 192:egn4K6m87KxkXqK4I40pUZNCgVLHrKHfFKslEiYeXzKD/Zk+ErUkKN99WvSNmMsJ:FnjB87KxkXqKf/pUZNCgVLH2HfgslYe/
TLSH
T1B332D927D48DAA3F4FD8D91CCC166F8F6DB5025672680D2496FB9C1403A978A224A1BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 1e4ecac3f326f4f425ba02399ae5fb85515a9f0fe74cd8179f75db970455dfe3
MD5 fd7aace02090ee803ad1b19ef4f54df6
SHA1 81f668a1646be2092ce1c21bcc32e935d1bd25c3
SHA512 caa9eaaf0813cb228c015e30ded445912feade93f0029d30d13a3a0d276e4793c2331aac53660cd0c1b92f3f7d0522c4315787a577998a7ad649aa2c48ac2e44
SSDEEP 96:qC0d+qJw6eq8Em6eifKcIz9NURDotok5hj8Dh+B6vGyvQH4jYE30bblDv4a:qC0xJPz8/CkqDUDhOh+fr4jYE30bb1
TLSH
T189A11931A8694DB784B6D585B2432E03CF64B197E621AFC0B5DD1F1C10F71F81742A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 4d2718056a41e0f279630208cc59fe4d1b36098c2cd2cfd719498bee156e7c52
MD5 d21c97b75449f0edd8dd23b42f692dd5
SHA1 363f37ea4a7d7285be189f4cde583f530b044bf8
SHA512 98820035287f193e2578b4282f4c5ed7c03f6fa950ec0e2c1233af421af771b163c19ba504a91fba672e78c3b3da127a6ed316973ee0ed07f499d92f42e4f6ba
SSDEEP 96:obJ0d+qJw6eq8Em6eifKcIzntANQSl8h4otop5hjdDh+B6lmGyvQH4QQlJE3hRNz:ot0xJPz8/CkntLiU2hBh+OPr4QQlJE3d
TLSH
T1F8C10A74A85D5C7788F2E985B1032D03CEA96067BA147E94FADA5E1C00E75EC1783633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 95c52f9cbff344588b714b49fcd11cca2621aca6869e6300e2d7635f08b427a7
MD5 c147bc2cd007c890bea3305b58914cd8
SHA1 45c8886d826abb37d9570551377636f0eee28a06
SHA512 64b067dbbd689c9f8ac26e616aef06f0851ae9bfc66e191338525dfec07b48f64e112f7139d2e739ee7b05f565d59b20f012c6731d428d6d66d4e94fc570e969
SSDEEP 96:obJ0d+qJw6eq8Em6eifKcIzntANQSl8h4otop5hjdDh+B6lmGyvQH4Q8TBlOnJEk:ot0xJPz8/CkntLiU2hBh+OPr4Q86nJEk
TLSH
T1AFC11A75786C9D7359F3E695B1433A03CEB471A7A614AED0EADA0F1C00EB1EC1746623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 23f809b9da002c231cf094e46958e8739519163ebd6771d3130ebc27712c39f5
MD5 1dcbe808e805c5b76a0c9ee0d9a53e87
SHA1 0ef05691cf891dd1609f7af32c878ad73c486d94
SHA512 30ab52e2e881b13fc2e6002ace44e7807e30f666e22ca3a4f7ea1237e81c5895163eb00411cc62b8050fff06385aaca0bd6d50c949ad305168570be53c2cfd35
SSDEEP 96:obJod+qJw6eq8Em6eifKcIzntANQSl8h4otop5hjdDh+B6lmGyvQH4QQlJE3hRNz:otoxJPz8/CkntLiU2hBh+OPr4QQlJE3d
TLSH
T148C1F974A85D5C7B98F2E995B1032D03CE65616BBA147E94FEEA1E1C00E71EC1783623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 8afba03c8507a7e58c9a5760e88852a46d127e4fdd0532cbccb9e9805e4324a3
MD5 44306c1922bc4af394c418f480d3c547
SHA1 8d904892c9b982ff12af8db82d6a6acd6c4871af
SHA512 a818ec3975e6fcaf3976f85388f7c46506efd96004bb4469746d1d455740f6969a3a9442a0c4e9060bb857521ecf36e51855d6a269b31846d64386fd313988df
SSDEEP 96:oC0d+qJw6eq8Em6eifKcIzntANQSl8h4otop5hjdDh+B6lmGyvQH4Q8TBlOnJE3U:oC0xJPz8/CkntLiU2hBh+OPr4Q86nJEk
TLSH
T1FFC11A7578689D7359F3D695B0433A03CEB471A7A614AED0EADA0F2C00EB1EC1746623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download