hxxps://codeload[.]github[.]com/Da2dalus/The-MALWARE-Repo/zip/refs/heads/master

Resubmissions

25/09/2026, 18:35

260925-w8nq8axtev10

25/09/2026, 18:14

260925-wvhm2sty7n3

25/09/2026, 17:16

260925-vs4bassajh8

25/09/2026, 17:06

260925-vmxass1gqc3

Analysis

user interaction
yes
max time kernel
899s
max time network
884s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://codeload.github.com/Da2dalus/The-MALWARE-Repo/zip/refs/heads/master
Sample260925-wvhm2sty7n

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2716	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
1868	chrome.exe
1868	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe
Token: SeShutdownPrivilege	4816	chrome.exe
Token: SeCreatePagefilePrivilege	4816	chrome.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 4416	4816	chrome.exe	88
PID 4816 wrote to memory of 2716	4816	chrome.exe	90
PID 4816 wrote to memory of 5660	4816	chrome.exe	91
PID 4816 wrote to memory of 4548	4816	chrome.exe	92
PID 4816 wrote to memory of 5660	4816	chrome.exe	91
PID 4816 wrote to memory of 4548	4816	chrome.exe	92
PID 4816 wrote to memory of 1140	4816	chrome.exe	93
PID 4816 wrote to memory of 1140	4816	chrome.exe	93
PID 4816 wrote to memory of 1612	4816	chrome.exe	94
PID 4816 wrote to memory of 1612	4816	chrome.exe	94
PID 4816 wrote to memory of 4324	4816	chrome.exe	98
PID 4816 wrote to memory of 4108	4816	chrome.exe	99
PID 4816 wrote to memory of 4108	4816	chrome.exe	99
PID 4816 wrote to memory of 2480	4816	chrome.exe	100
PID 4816 wrote to memory of 2480	4816	chrome.exe	100
PID 4816 wrote to memory of 2972	4816	chrome.exe	102
PID 4816 wrote to memory of 3368	4816	chrome.exe	103
PID 4816 wrote to memory of 5588	4816	chrome.exe	104
PID 4816 wrote to memory of 3224	4816	chrome.exe	107
PID 4816 wrote to memory of 2084	4816	chrome.exe	106
PID 4816 wrote to memory of 1520	4816	chrome.exe	108
PID 4816 wrote to memory of 3224	4816	chrome.exe	107
PID 4816 wrote to memory of 2084	4816	chrome.exe	106
PID 4816 wrote to memory of 5096	4816	chrome.exe	109
PID 4816 wrote to memory of 5096	4816	chrome.exe	109
PID 4816 wrote to memory of 4420	4816	chrome.exe	111
PID 4816 wrote to memory of 4796	4816	chrome.exe	110
PID 4816 wrote to memory of 4420	4816	chrome.exe	111
PID 4816 wrote to memory of 4796	4816	chrome.exe	110
PID 4816 wrote to memory of 6116	4816	chrome.exe	112
PID 4816 wrote to memory of 6116	4816	chrome.exe	112
PID 6120 wrote to memory of 5840	6120	cmd.exe	115
PID 4816 wrote to memory of 1868	4816	chrome.exe	116
PID 4816 wrote to memory of 5012	4816	chrome.exe	117
PID 4816 wrote to memory of 5012	4816	chrome.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://codeload.github.com/Da2dalus/The-MALWARE-Repo/zip/refs/heads/master
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffed029c728,0x7ffed029c734,0x7ffed029c740
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1904,i,17181559387995861087,172963987717962776,524288 --field-trial-handle=2312,i,16593233054863391146,16060915490261078264,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,215269996924386138,8922078529133326613,262144 --field-trial-handle=2312,i,16593233054863391146,16060915490261078264,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:5660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2012,i,4828162530750552665,16979213537540421779,524288 --field-trial-handle=2312,i,16593233054863391146,16060915490261078264,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:13
  2⤵
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,6051229001168392107,15959694824131868344,2097152 --field-trial-handle=2312,i,16593233054863391146,16060915490261078264,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,12917838901695181534,16237407919101055164,2097152 --field-trial-handle=2312,i,16593233054863391146,16060915490261078264,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6052,i,13877133966299272782,12862831395293067286,524288 --field-trial-handle=2312,i,16593233054863391146,16060915490261078264,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=6108,i,3566814309950734840,11769270569017016440,2097152 --field-trial-handle=2312,i,16593233054863391146,16060915490261078264,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=6120,i,1556382173259320684,5833408283343088253,2097152 --field-trial-handle=2312,i,16593233054863391146,16060915490261078264,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6444,i,5664346339367940411,18439700430203858470,524288 --field-trial-handle=2312,i,16593233054863391146,16060915490261078264,262144 --variations-seed-version --mojo-platform-channel-handle=1012 /prefetch:14
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6448,i,9837191596107636812,15275980249790263970,524288 --field-trial-handle=2312,i,16593233054863391146,16060915490261078264,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6452,i,2742456910990849837,12343107585582180703,524288 --field-trial-handle=2312,i,16593233054863391146,16060915490261078264,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
  2⤵
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6500,i,8851369126272115853,5992580063700517091,2097152 --field-trial-handle=2312,i,16593233054863391146,16060915490261078264,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6112,i,4417648058725739351,14089265458260085178,2097152 --field-trial-handle=2312,i,16593233054863391146,16060915490261078264,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4856,i,2422839209031933508,8032526224742501162,524288 --field-trial-handle=2312,i,16593233054863391146,16060915490261078264,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5748,i,11858527861682292745,16055532219614535496,2097152 --field-trial-handle=2312,i,16593233054863391146,16060915490261078264,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5820,i,9456122613358223649,13248261281430912240,2097152 --field-trial-handle=2312,i,16593233054863391146,16060915490261078264,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6300,i,10752784586459375251,6165716605244520659,2097152 --field-trial-handle=2312,i,16593233054863391146,16060915490261078264,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6204,i,17685532598629183656,9428512240636158095,2097152 --field-trial-handle=2312,i,16593233054863391146,16060915490261078264,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6096,i,10586436323525880679,409911487429574063,262144 --field-trial-handle=2312,i,16593233054863391146,16060915490261078264,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3856,i,6174393487564123254,6459616077527905617,524288 --field-trial-handle=2312,i,16593233054863391146,16060915490261078264,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:14
  2⤵
  PID:5012

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2384

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6120
- C:\Windows\system32\certutil.exe
  certutil.exe -hashfile The-MALWARE-Repo-master.zip SHA256
  2⤵
  PID:5840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2244

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 12c912df7c1c17235e5c380cdbc6b8f0b871fcc5dc908834cd20d67530739232
MD5 a3643ecc40065633e23dff664309ecfd
SHA1 677eae26e33e9ef39e810c45d02e35542caa6f92
SHA512 e5ea3e0881aa995e5d23de0d00cfb7a801557c9383798424287eb8ea8b506809c79c97b52a711be3beffe1f0ed5d9c0eb68bcc5841c515b45fe9931203b8b85a
TLSH
T15C419BF7C3E4867D891056F8AB156F1BCE290A14532D3C66C9D8AE1B93E28B2D20064F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 eea262496c04b182146bb92bf52774917af13f6e806318e2335e926750b3bff1
MD5 423aebcf542ce397474275f8b7c8ad02
SHA1 2f5bec46dcf6c9557d7f403e0a86a295d96390c9
SHA512 6b9210a757e841ebf53733cf873a32baad912c8de787495a4e2c106e253cc82125558101d0492c44c597c74b63cc510fe5757a5559927fb5d8fb3291663c28fc
TLSH
T1CA41ABF7C3E8867D891156F8AB156F1FCE290A14032D3C26C8D8AE5B93E28B1D24064F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 691B
SHA256 b7c7df991922df62ae477fa4daa70a174c1fc4baab4a734f589233d27701efba
MD5 ed626f4df6e76f8a9d459ddc2e03d934
SHA1 2a817e42d85dc2c984d3da3ad318e6a7dfca1ad8
SHA512 e36429aecc266fd2f73cb234c28bc9516ad7451034acb4a466662404251419ee5f6b01fb5c71155d5deae823d030fbd7ba5405531b7ce45182bfce8bba929dee
TLSH
T16301CB6BAA7E7067107D06A71E42BC0629BBE430038268F4CF5F822DE0824F70B06456
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 99cb2faed16fcded1b213a18bcdf78f6704e6107f42f43342bc0498f2017b266
MD5 b02f7a3e7486f9c67a9ea9b42caaedd5
SHA1 b8e827758cb179ac4ac4e3da0f2f4129182d28c3
SHA512 c18e9eb51ab5f4e375ad3d187b2abbf0f8d9e8c7e129d44e30c72c05a2bb61c2831c17bd80f1063fcc9f40327d78fbb65289c0a9d1f0b868d50cb3c48ac50bc6
SSDEEP 192:/RBcXNMv7NvAPRp2Hj9zHsb+WNnpmPT92leuWoVyIsnAUgR:/RBcdYZ6XglwcPp2BpR
TLSH
T19232822EEE14793B5CDBD21AF9217B53E6F5003221D52E84EAF8896C15EB5CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 5f5fd11e713c3d426a8aaf2d83320e8341695878c80d703bc913b8ba8e52a84c
MD5 e957ea14f79bae339c564015c95499f6
SHA1 856c456618256c49cfad253fe1fc191bcb437907
SHA512 eaf360423588615ea944859892ff9d26c1ff927a3840ca519354081985d99c9a3595a0d60f51ef28013eadb8826f8c22c441b7bb2e1609d966c8d14b58aff302
SSDEEP 192:/RBcXNWv7NvAPRp2Hj9zHsb+WNnpmP/92leuWoVyIsnAUgR:/RBcdiZ6XglwcPl2BpR
TLSH
T1D232922EEE14793B5CDFD21AF9217B53E6F5003221D52E84EAF8896C15EB5CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 273a04229a3b5835dde7b527cabf7d84182facffe43dc51a067f1c8d266375ec
MD5 fd078a5ade69a19b68cd6be1342118c3
SHA1 cf7f0b2e0357b2e42f45c980634e12631b49592c
SHA512 071731cb7f4dc9e4366cb3deef22cc9e20f8ed3ec30906e6fa0a5f083f9b525be5559ba435a27d9a86a3ea16cf4b625f08ecc23512198fe032ac1424021596d3
SSDEEP 192:/ResXNWv7NvwPRpfPHj9zHsb+WNnpmPZ92leuWIVyIsnAUgE:/ResdiZKXTlwcPv2BHE
TLSH
T1F842A32EEE14793B5CDBD21AF9217B53E6F5103221D12E84EAFC896C25EB6CC2217117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 f2550f4a49be1ad65c8882f346e63ca51d51e6fb54dfa2856c956b9880d147e3
MD5 34a07c01b8f2c390ad5ed0dd7fae9c8b
SHA1 15176a01062549c7353989d39461d62a95dfb4bd
SHA512 bb7899c55da5f6c90b33d8b2cd6d07d698bcbc381fcc3fa62abcb5eee5b24fbbe649789db4c1730289ff9a98175e3a36c2184e9aea0626015444660d02f04b66
SSDEEP 192:/RBsXNWv7NvAPRp2Hj9zHsb+WNnpmP/92leuWkVyIsnAUgE:/RBsdiZ6XglwcPl2BpE
TLSH
T14932A32DEE14793B5CDFD219F9217B53E6F5103221C52E84EAF8896C25EB5CC221711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 290c88fe9c412da1c16f7bd96e1362bea3e46513103adf9b00c5a96c6e7df4b4
MD5 4fe0aff2d3a52bf9f54afd692f5fbe8d
SHA1 94940954d5f3353d160b15871e0aa1f88668c9d4
SHA512 5808add8f6dedcc688480dc73f784178365f885a34e58036b942b7b17d1600aa9ae6de7c186b72f8ebead1cdad88146498444974df703c2bd0f68c96e5415798
SSDEEP 192:/RBsXNWv7NvwPRpfPHj9zHsb+WNnpmPZ92leuWIVyIsnAUgE:/RBsdiZKXTlwcPv2BHE
TLSH
T12442A32EEE14793B5CDBD21AF9217B53E6F5103221D12E84EAFC896C15EB6CC2217117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 e4a6798a5a3ac5bfcdca0be1de7c1ba068de128e43648674a2965116a3931261
MD5 c2e8f234a92abc64bc610b7387f9806c
SHA1 f391f849e102e728082921cd7df078c80707f1ed
SHA512 1c7b51743330bbd656e783f6581c9cb403cd9fe0dbd23cc414c76dfc22d081a5d17455cd1f856f26622876f41f28b2b2204584121c65fd63978ca7f2e5db05fb
SSDEEP 192:e/k4K6dF7KxkXqK4I40pUZNCgVLHrKHfFKslEoHNXzKD/SF+ErUkKN9RK5Fc3DoU:GkjKF7KxkXqKf/pUZNCgVLH2HfgslVNS
TLSH
T1A732FA27A44DAA7F4FD8D50DCC136F8B7DF5029262780C28A6FB9C0803E978A51595BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 560b9512f69e0928cb523c66be59eb98910775bde9aa25dbe85df53afe403632
MD5 78fbe41fcaaeea6c001a55981eda1df6
SHA1 47681192d8ee8894cd34d980f2835f3e7d449155
SHA512 82909ca00acf254b1038b537953a97bc9a02254c3452f2d84372c64c81fc0db34ee3b5fe63a058e8ec91ac6ed5bb3ccd39eba829439d98d8249d9123896be00f
SSDEEP 96:OC0d+2+07WJ3aJPWyqgfdffgySl8h4otop5hsDkB6XGyvQClg7cOqWdSNJS90j9J:OC0d57WJ3aJ+yh3iU2UIHlBqJNJS9UHp
TLSH
T1CEC129B5B43EA87B65E79851F5033D83CDE861AB5850AF50CADA0F1A11F70EC1383123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 72ef8bc76de2c6e0b9abb64843a0e6f1124a4e44949168c8751e1eb9e4c41db0
MD5 0bcfd38e58357863588510de0b8d7f5c
SHA1 7887d3f8eb192bcc553e0f5e3daaf47901c7b597
SHA512 0c90eaef161f048e9e0ce2255c3bfa24d6b5c3c36ba4cc1e93af6cc706c1303c271d17f8d22575b95b694c272cc6c9d4e768e2fb8804e25bded7953f341754da
SSDEEP 96:ObJod+2+07WJ3aJPWyqgfdffgySl8h4otop5hsDkB6XGyvQClg2SXJSARNC39Q8w:Otod57WJ3aJ+yh3iU2UIHljXJSAuHVoh
TLSH
T1A8C108B4A46EAC3B5DF6A885B1033D43DDE861AF6914BF58E9E90E4900E34EC1383123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 202fa660e612f580aa45f9ff7d2d50317e33ed379b6884097c79a97899b9eb90
MD5 d1bceeefabb5a972cdf3ad74030a9fa6
SHA1 26d30ca5a411c372162d82b414dda52d4270d5a8
SHA512 4fb3c4542b320fcae96e833a3d373b0165b25c4cc57d33e10be49f6d3d5e7d59063a081c863ad9b119b15ce79c81e20a050d31716b97227551c94e2df88143d6
SSDEEP 96:8C0d+2+07WJ3aJPWyqgfdfrgnRDotok5h4DkB6FJGyvQCl47YSZPE4/Rv4a:8C0d57WJ3aJ+yhYDUD8IS0rYSZsM
TLSH
T14AA108B0F46D993B55FAD986F9023A47DEA8A25BA920EF80D5D90E0921F70E80343123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 bfff65bbf7051de64940fe95b88338e5d25041f1c6acc5db66412f0ab5edcd87
MD5 6a20fb5ac1b074c7aa0fd48ae6f7906d
SHA1 d392c6cca30b8d1382ae5a6e69ac0cb316c1e85f
SHA512 6b8533ff66c638c4d9f7157e9080933dc1feaec529b7aeaffe7118fe6681c98234ead01ec9bcac57636a14f5d2113d7e33d45cd68c809d2f6e2fbc706b57adb0
SSDEEP 96:ObJ0d+2+07WJ3aJPWyqgfdffgySl8h4otop5hsDkB6XGyvQClg7cOqWISNJS90jL:Ot0d57WJ3aJ+yh3iU2UIHlBq8NJS9UHp
TLSH
T12DC118B5B43EA87B55E69851F5033E93CDE861AF5850AF50DADA0F1A11F70EC2387123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d9bdb506-0364-4b7d-b09e-0c386c5105bf.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d9bdb506-0364-4b7d-b09e-0c386c5105bf.tmp
Size 5KB
SHA256 6ad8b3ad56703d3fb94b16161760c3182335266dca6a49814b0843aec0a18d8b
MD5 bf847262966241e863a894bd0f4511b0
SHA1 3ec3ba1d3b7b722fdca3307a88ee03d3433aae92
SHA512 69459b095bc6c8b3ff3134801470e5a7d00ec27bb4a8924751db2fb6493655bdf7c8ee1c33cf226bc965ab1990d8847bcf54cb92d1fe26f50d8e24b5ead87956
SSDEEP 96:ObJ0d+2+07WJ3aJPWyqgfdffgySl8h4otop5hsDkB6XGyvQClg2SXJSARNC39Q8w:Ot0d57WJ3aJ+yh3iU2UIHljXJSAuHVoh
TLSH
T188C11AB4A46EAC3F5DF6A881B1033D43DDE8616F6914BF54E9D90E4910E38DC5383123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download