Analysis
- user interaction
yes - max time kernel
630s - max time network
632s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
03/10/2026, 17:15
General
- Target Antivirus protection.exe
- Size 149KB
- Sample261003-vsm93sty5k
- SHA256 f4ad17b38a66eae090829132e6db35b975b12bb740d79e4de057c94d8c5a4978
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies data under HKEY_USERS 7 IoCs
- Modifies registry class 43 IoCs
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 58 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Antivirus protection.exe"C:\Users\Admin\AppData\Local\Temp\Antivirus protection.exe"1⤵
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Antivirus protection.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Antivirus protection.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffaf352c728,0x7ffaf352c734,0x7ffaf352c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,10776876615306239393,16803098953720308949,262144 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=1884 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1944,i,4339394390081961570,14539534920372650870,524288 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,9263244958805251801,7441395842640892683,524288 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3276,i,4843304587194622052,10909679271564532444,2097152 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3356,i,10727183038360349636,10479486987491216294,2097152 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4732,i,7681718543596483469,16038443192170299488,2097152 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4920,i,13919959336125651621,4421118050776957604,2097152 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5560,i,18339226134403649083,479511323257159494,524288 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5612,i,707385410624076800,1195790319701353290,2097152 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5648,i,10116598890588202305,1845769228502383432,2097152 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6016,i,2933569059095577361,11462758458180571037,524288 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5972,i,16996293194473805261,18314755285663546968,2097152 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6128,i,4686635631848244556,5192540435974500485,2097152 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6404,i,1671064045821496620,270448398704802223,2097152 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6440,i,16318481140709900813,3310687630346039788,2097152 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6796,i,13752708565227921394,7887870745955977397,2097152 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6280,i,9565322873858731399,914552765464822889,2097152 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6432,i,14140531729121805875,14729674535554654494,2097152 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4764,i,7974994467685365332,4863672764497302037,524288 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6276,i,13169929294829360960,15028828533622878920,524288 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6116,i,244968814332809501,5104796548586402205,524288 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5808,i,7399774459157529557,6862433008319242450,2097152 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5772,i,15107429773491289391,4578815256289266897,2097152 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6008,i,14707875817866880641,7297049881658896324,2097152 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6368,i,17021001049618011928,8562508212308373827,2097152 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5960,i,11861469728741323099,13440762807786696768,2097152 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=3956,i,10100986191405530047,10454021392868533515,2097152 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5580,i,11420660065122643162,8632729593596205209,2097152 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6732,i,9051876963363705434,731709509901752041,2097152 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6056,i,8658406265891029491,3626386285887790628,2097152 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6716,i,1855057489764552325,10032394520444808653,524288 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6008,i,6799556714108553499,14385534568883011092,524288 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4980,i,11697989679575733749,12968159023484260456,524288 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4968,i,18030100810584051026,13849540528641983979,524288 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,5558638029982828379,3950770872629383163,524288 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:142⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5116,i,5339550785628627569,15823823206687114904,262144 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4608,i,15959782910880260536,9052283247652474099,524288 --field-trial-handle=1888,i,1687725754444003720,4421817809880756139,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
1b952e16-cf56-4202-a7ac-c7931c0873ba.tmp
2685ced4-401d-4b94-9932-8d0e833622d6.tmp
52c57863-7760-4019-ae6a-26d813be5ca8.tmp
70962b55-33c0-46c2-aa40-010e6543c2ae.tmp
83d2fb08-d8d7-4251-b6da-de2078ee158e.tmp
04ea3715-e481-4f70-af96-fdbb3b1aa729.tmp
141043e2-1508-48c8-83dd-42f82424f8f6.tmp
3f26de9f-6a54-4b02-851a-0b7465d798c4.tmp
5e4d6de2-551f-424c-81a4-d473fb8f1f98.tmp
f_000007
f_000008
f_00000a
f_000058
f_000059
f_00005d
temp-index
messages.json
craw_background.js
CURRENT
MANIFEST-000001
MANIFEST-000001
1716296e-792f-444d-a7a1-3d8a13ed17cb.tmp
22754f56-e7e3-4afe-854b-aef5096acd08.tmp
61659e7d-ebfa-4466-9215-094c75d2eea2.tmp
index
index.txt
index.txt.tmp
index.txt.tmp
temp-index
temp-index
temp-index
temp-index
data_0
data_1
data_2
data_3
512.png
512.png
512.png
b94ffaaa-a47d-4432-9f5b-478244302911.tmp
bb6580ee-7a45-4290-87d9-cd9580e3d326.tmp
c9e02678-a043-4c02-aec8-e23276c7d30f.tmp
d0fbf1f7-455e-4c1b-8b36-e483eb528524.tmp
StartupProfileData-NonInteractive
prep_Activatable Class_Hermes_perf.cache
__PSScriptPolicyTest_ujtdvdzw.plv.psm1
ba281457-38d0-4848-ba86-e040753b44d5.tmp
messages.json
memory/4036-1194-0x000001FD14200000-0x000001FD14220000-memory.dmp
memory/4036-1180-0x000001FD03C80000-0x000001FD03CA0000-memory.dmp
memory/4036-1162-0x000001FD03A20000-0x000001FD03A40000-memory.dmp
memory/4036-1149-0x000001FD001E0000-0x000001FD002E0000-memory.dmp
memory/4036-1150-0x000001FD001E0000-0x000001FD002E0000-memory.dmp
memory/4036-1148-0x000001FD001E0000-0x000001FD002E0000-memory.dmp
memory/4036-1163-0x000001FD13E60000-0x000001FD13F60000-memory.dmp
memory/4872-18-0x000001B0E9FE0000-0x000001B0E9FFE000-memory.dmp
memory/4872-20-0x000001B0E9B80000-0x000001B0E9B8A000-memory.dmp
memory/4872-19-0x000001B0EA090000-0x000001B0EA142000-memory.dmp
memory/4872-13-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp
memory/4872-12-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp
memory/4872-11-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp
memory/4872-23-0x000001B0EA089000-0x000001B0EA08F000-memory.dmp
memory/4872-22-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp
memory/4872-32-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp
memory/4872-10-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp
memory/4872-9-0x000001B0E9AD0000-0x000001B0E9AF2000-memory.dmp
memory/4872-6-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp
memory/4872-15-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp
memory/4872-14-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp
memory/4872-5-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp
memory/4948-1-0x0000000000680000-0x00000000006AA000-memory.dmp
memory/4948-0-0x00007FFAFD92F000-0x00007FFAFD930000-memory.dmp
memory/4948-33-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp
memory/4948-2-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp
memory/4948-31-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp
memory/4948-3-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp
memory/4948-4-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp
memory/4948-30-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp