hxxps://jskmarketings[.]com/acknowledgment[.]html

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
128s
max time network
127s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/10/2026, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://jskmarketings.com/acknowledgment.html
Sample261009-ejecta1z6q

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	chrome.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e591787.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e591787.msi	msiexec.exe
File created	C:\Windows\Installer\e591786.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e591786.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4504	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000003\HardwareID	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000003\Service	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000003	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\AcrobatSetup.iso:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
2300	chrome.exe
2300	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe
Token: SeShutdownPrivilege	1476	chrome.exe
Token: SeCreatePagefilePrivilege	1476	chrome.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe
1476	chrome.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1040	1476	chrome.exe	81
PID 1476 wrote to memory of 1364	1476	chrome.exe	82
PID 1476 wrote to memory of 4504	1476	chrome.exe	83
PID 1476 wrote to memory of 1364	1476	chrome.exe	82
PID 1476 wrote to memory of 3844	1476	chrome.exe	85
PID 1476 wrote to memory of 3844	1476	chrome.exe	85
PID 1476 wrote to memory of 4740	1476	chrome.exe	86
PID 1476 wrote to memory of 4740	1476	chrome.exe	86
PID 1476 wrote to memory of 4748	1476	chrome.exe	87
PID 1476 wrote to memory of 4748	1476	chrome.exe	87
PID 1476 wrote to memory of 1952	1476	chrome.exe	88
PID 1476 wrote to memory of 1952	1476	chrome.exe	88
PID 1476 wrote to memory of 1456	1476	chrome.exe	92
PID 1476 wrote to memory of 2868	1476	chrome.exe	94
PID 1476 wrote to memory of 1108	1476	chrome.exe	95
PID 1476 wrote to memory of 4220	1476	chrome.exe	96
PID 1476 wrote to memory of 3276	1476	chrome.exe	97
PID 1500 wrote to memory of 4844	1500	AcrobatSetup.exe	100
PID 1476 wrote to memory of 2300	1476	chrome.exe	104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://jskmarketings.com/acknowledgment.html
1⤵
- Enumerates connected drives
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffadde7c728,0x7ffadde7c734,0x7ffadde7c740
  2⤵
  PID:1040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,12232070070653939322,13077028540818390753,262144 --field-trial-handle=2008,i,7533007214903543380,4678478672835246813,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,3778152746259257828,10621162172048933018,524288 --field-trial-handle=2008,i,7533007214903543380,4678478672835246813,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2132 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,5945702666612911065,5972177370633962137,524288 --field-trial-handle=2008,i,7533007214903543380,4678478672835246813,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2164 /prefetch:13
  2⤵
  PID:3844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3032,i,16085695154627923402,16206240982260911998,2097152 --field-trial-handle=2008,i,7533007214903543380,4678478672835246813,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3088 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3036,i,3013059240045458388,2810250357585936427,2097152 --field-trial-handle=2008,i,7533007214903543380,4678478672835246813,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3108 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4284,i,9609644047282767244,6957515718279601,2097152 --field-trial-handle=2008,i,7533007214903543380,4678478672835246813,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4304 /prefetch:9
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,6950139373027400902,13622511214167794412,524288 --field-trial-handle=2008,i,7533007214903543380,4678478672835246813,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5332 /prefetch:14
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,13102489520241077077,15916326899922509330,524288 --field-trial-handle=2008,i,7533007214903543380,4678478672835246813,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5728 /prefetch:14
  2⤵
  PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5660,i,13436933787527117968,8553979115448894053,524288 --field-trial-handle=2008,i,7533007214903543380,4678478672835246813,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5732 /prefetch:14
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,1437408959146476387,12650781723268352385,524288 --field-trial-handle=2008,i,7533007214903543380,4678478672835246813,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5708 /prefetch:14
  2⤵
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,4551627436608294927,14388048706518102925,524288 --field-trial-handle=2008,i,7533007214903543380,4678478672835246813,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5884 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5820,i,5264960542950793611,1906490716171139523,262144 --field-trial-handle=2008,i,7533007214903543380,4678478672835246813,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5796 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2300

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2224

\??\E:\AcrobatSetup.exe
"E:\AcrobatSetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SYSTEM32\msiexec.exe
  msiexec /i "E:\MSEDGEUPDATE.MSI" /qn /norestart
  2⤵
  - Enumerates connected drives
  PID:4844

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
PID:4556

\??\E:\AcrobatSetup.exe
"E:\AcrobatSetup.exe"
1⤵
PID:1068
- C:\Windows\SYSTEM32\msiexec.exe
  msiexec /i "E:\MSEDGEUPDATE.MSI" /qn /norestart
  2⤵
  - Enumerates connected drives
  PID:4580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0e2bb4b9-d788-4e8e-8ac6-86366cb8a278.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0e2bb4b9-d788-4e8e-8ac6-86366cb8a278.tmp
Size 177KB
SHA256 38e84029389d5812f29895eee8f67448504850ecb2a02384fc5bd920923756f7
MD5 3b00785f5a0e68f2837768ca2bd6cb1c
SHA1 698389381e64694806420a59a8740cb2889adb69
SHA512 a7980548db1d2dd06cf7c1aa2fe1c179c4dffa084e63203a098d69b8ce95a0877811a860c80e93ee46e1b7aedeead5f13e0bfb847e349dc1abac4e5855c93e91
SSDEEP 3072:nX9Gbucbtb2WKNVSOgYT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXA:NGiyKN4vThDxWhaj5mjie/JYFobV
TLSH
T1D50412639DAC45FB19ECC54C213E7F0086E58DB39240EFA79EE86D8F60C6E54A357206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

48e1f7fa-798e-477d-b7e5-43088068dffa.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\48e1f7fa-798e-477d-b7e5-43088068dffa.tmp
Size 132KB
SHA256 99f6440d427be97e96a05c1ba6503a6c3add5191f291a9ec54ac20ef42bcc9ac
MD5 1d3379597760f175208994e5690bf807
SHA1 8044928f7ba370f55bdf55ac1cde2e08936b2a60
SHA512 d9f47a144691d80f5cc412dc42a696a0f54aa656b1ff938981632108d3d0eaab8f1acb6ba59c75808c38b4c56f04bf2099b89e0b90fae4d615c1476ff2d5f5a9
SSDEEP 3072:LT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXA:MThDxWhaj5mjie/JYFobV
TLSH
T1A3D31223ACFD00FB15BCC50880297F0086E989B3D640FFA79BD86A4F51C7EA4A357156
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

736b2721-0c3c-4747-949d-51fc97be76bc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\736b2721-0c3c-4747-949d-51fc97be76bc.tmp
Size 131KB
SHA256 57ea3ea0b5a61ba8ae8e3448e5c5cbca60285b25d19e7af877eeaca2066aac56
MD5 527e33b3ea65e8f3321c240dc0e618e5
SHA1 c1e96877aab3155088ba830c17607dcf5ba5abe4
SHA512 e0d370028d59c7004e95b64b96ec68e57b5243b9390c58a109466a9d2f415821a8ff5fde7a41fbe187fd05852bf95c90038b17922cda695a6700b1289e926560
SSDEEP 3072:IT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXA:/ThDxWhaj5mjie/JYFobV
TLSH
T128D312239CFE01FB14BCC50840697F0086E989B3D640FFA79ADC6A4FA1D7EA09356596
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

07c35652-4692-4399-9671-5dd36c9f2ff7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\07c35652-4692-4399-9671-5dd36c9f2ff7.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

4fc0e299-646c-4dcf-8b24-d01d945708c5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4fc0e299-646c-4dcf-8b24-d01d945708c5.tmp
Size 649B
SHA256 240e84eb890f5fdabfca2fb3dd8b9104caa718859dfb2bdee190d33f56392b6c
MD5 5d955bcccff041672ec62c4191570173
SHA1 b492e8382a8e56bbd551a61b34f30d7a21d66fc3
SHA512 7fbcb54cedfc387241644d4c887d7b35c7aa9a136a258966773addecc4d5126ccbc2a29c3368f7c7c5b32b145c01de9e48cc495b9522a836749329037545a412
TLSH
T1A8F028A6C831EC7718FD0B2870A44B86F751132B26908A4F7A3D920C8FB463F878681C
MD5 SHA1 SHA512 TLSH

Submit Download

64aa7473-13f5-40d9-8003-405f098635eb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\64aa7473-13f5-40d9-8003-405f098635eb.tmp
Size 12KB
SHA256 0b9e9f3ff05b6e02e0688f1fd3f4de2ef6db00c6c7342016000f3c25981392be
MD5 6e7dc80bfb1fb5d661e0ba41d6799908
SHA1 b6ebc324d828329c695f920eda35ca5941fb822f
SHA512 2add6ac8ac91408f163f390bbf51d46c3de1481c66d3f04ad7defe29074061a0184f1f58757a6c4410cc90fbc6f991e1b68c505692889a4e1f82dc29effcbebd
SSDEEP 192:vRTmkl98T6Rbv7ZYepAPRp2Sg9zHsb+WNn9DYNy29Z2pbkwxVyIsnAUge:vRTmkNjdhUXMZwtL2/2d3e
TLSH
T11142C52EAE24B53B5DDBC22AFA257B57D7F5102560902E88EAFC8D2C24D75CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a7bab4a-3b36-463d-bda2-b70bed9d1feb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7a7bab4a-3b36-463d-bda2-b70bed9d1feb.tmp
Size 12KB
SHA256 ee98361176171ce627cb09e2bf8b7d0beb6a176be03089e7b5e8d333d20ebd53
MD5 dec98227cbbc91ea07fcc3a3df871ce9
SHA1 d5cb04cd88ffbc8621d56178086d7bada0e03d91
SHA512 4483266d73dc0e34da352b16752aedf744d9216151059d64795d5a1d6b3cdda88ccb91e90ae9135706289dfd99a428f46ec53038b0f0814fbb406beb3e7df6df
SSDEEP 192:vRTmwl98T6RYv7ZYepAPRp2Sg9zHsb+WNn9DYp+ekZ2pbkw7VyIsnAUgE:vRTmwNEdhUXMZwtXeA2ddE
TLSH
T16E42D72DAD24B97F5DDBC22AFA267B57D7F5102560802E84EAFC8D2C21E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 144B
SHA256 eddda2a921a33c4806917f5a565ff57da8e484220360e4fd1a66c321f0e4fe58
MD5 94c4578227c5cf3ede9e20eaf67eb798
SHA1 b3cab9304df395c6c3d383d5fb370daa774dcd7b
SHA512 024de6ebe8b7e52ec84f2181825141e1d6f95f42441257af33fc2c531b434d3fc10349865d47769d4088a6d02526d3e9f319dba4219529afdbfdcdb3eb63becf
TLSH
T13DC09293DAC00100CF7406B488A70E4321137A699112A32B9180C281BE622F20011659
MD5 SHA1 SHA512 TLSH

Submit Download

4456de58-8bcb-4ecd-a54d-d12676addaf7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4456de58-8bcb-4ecd-a54d-d12676addaf7.tmp
Size 3KB
SHA256 3c3f526177687a529da385602056a71e2a102334ade0889fa8913e1351eaa8b2
MD5 aee0a533cdfd4b0f16404c77dafc8714
SHA1 fd52463a207e5a6cd1074ebd22790414e33cbcaa
SHA512 93325357a05d85a00acd13047ad05777e75a34be067ae832d34ced07ed5f4edd1eb150bf16c72168fe7ab37e66bd6206c347d0cb7c7d623f86b838cb123a469a
TLSH
T14C81AFF7C3E8862D891196F4AA152E1FCE2D0A58532C3C57C8E9EF0F93E19B1D24064E
MD5 SHA1 SHA512 TLSH

Submit Download

d1bdab93-0a85-4282-b202-ac962c9a7a31.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d1bdab93-0a85-4282-b202-ac962c9a7a31.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 e7dbe3f37a326b4eb187c67137b63b1636a24dc6ec7f6f6600737f863df6b17d
MD5 60d395cd3956578c2b2c5111129e69d0
SHA1 41ba9f377b85d4def19436ab3c88ffb298bef3cb
SHA512 18d4b83776c87c5603109c14cd9114b2a0f114f770f9f5d9b7a352ba8fa6a4efce1fc0e92f4c055e42ed49ad15c34d3638f2f9eb67fc050366b14a3f05e2970a
TLSH
T1E1B0125A81412301C45203703350E46432608F34E112238982E01E41BC312E04017109
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 52801be300ef93dfacc220b8e9c71af33491b8a8fa8eca9af3509f4eaf69e2a0
MD5 7a21565a2fd47283183379c01ce69fbe
SHA1 8c77a26ccf3f32896b7db4cfb92795f0c65291da
SHA512 8dbe08e7859cbc555f9dec6ae05f5659fe72feafd80616c267bf565a3818f4c08cb7a1d2e7d902c766f525d575abcef17154ace04a1964f35291f4804e92e33c
TLSH
T1E7B00256C202A223C0520FB076A6E5D9B162EFB9C643161692E11A6BEC266718525260
MD5 SHA1 SHA512 TLSH

Submit Download

fc2f6738-a31b-4bfd-915a-27b262a6bf84.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fc2f6738-a31b-4bfd-915a-27b262a6bf84.tmp
Size 17KB
SHA256 4bfbe324691a23a534db53a22993451495e8f99857a002d285586cc0fc8ed7a5
MD5 d057b7c85bf32212a239f24a704aff82
SHA1 a42e5b02a5f2368064007d69b1a51f5d692b8da4
SHA512 6b8dffc50b71f5d7d42a1590b183c8bb0c01f98f894f6bbaef1ee3fc69d01aadef3e79c5706326ebda020c1bec9e5d800afb5f994457546546cfc2f47ed220be
SSDEEP 384:71j3W7KxkXqKf/pUZNCgVLH2HfgslsF7pLuLceSRcXOD3y+ErU339HG+X2tt7I:7l3W7KxkXqKf/pUZNCgVLH2HfgsGF7pN
TLSH
T17072F9677C48993B0FD4CACCDC267E4F9CB5014B65E9886493FA5C2903D5BCE114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c9e9393d-19c0-4253-b7b4-2cc048579881.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c9e9393d-19c0-4253-b7b4-2cc048579881.tmp
Size 132KB
SHA256 3e607ef68a00c9f79a3ce119b5a8c4d2b17b7b5ae8794e2f5616d58927facdf6
MD5 f13986591f438bab635189ef6295ad97
SHA1 59571f6b3cb01e237fbf1dd9f97d98c351f9f2cb
SHA512 39f04bd5aca8b214b2e35bee404b6d21e8c5b4d17ab84fb9da4f0006c982f9969daaf92bbd696ed6e03092af12fcd28279cbf27eea83dd75b017610595a258ee
SSDEEP 3072:0T8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXA:TThDxWhaj5mjie/JYFobV
TLSH
T1F2D31223ACFD01FB15BCC50880297F0086E989B3D640FFA79BD86A4F51C7EA4A357256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2292e3d6-d49d-4685-bb2c-784e0d63b9c0.tmp

Path C:\Users\Admin\Downloads\2292e3d6-d49d-4685-bb2c-784e0d63b9c0.tmp
Size 8KB
SHA256 9f1dcbc35c350d6027f98be0f5c8b43b42ca52b7604459c0c42be3aa88913d47
MD5 0829f71740aab1ab98b33eae21dee122
SHA1 0631457264ff7f8d5fb1edc2c0211992a67c73e6
SHA512 18790c279e0ca614c2b57a215fecc23a6c3d2d308ce77f314378cb2d1b0f413acd3a9cd353aa6da86ec9f51916925c7210f7dfabc0ef726779f8d44f227f03b1
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

AcrobatSetup.iso

Path C:\Users\Admin\Downloads\AcrobatSetup.iso
Size 7.4MB
SHA256 f367768387fc1deea2ea904aed28e7017d40dd4e17f5c12a4e56bce9005101b5
MD5 232da9199266b94f21c8a05177ff57e2
SHA1 3264968c79e5af8b17c8aaf55db4adbfc951912b
SHA512 3998e446506c9d1a99358fd7b3fccb5f3d16165a9d69c02750f569478fcbca9e536fd6278aab59f53fb5e7d5f4fac51e5c5579510368f517838863ba472feba8
SSDEEP 98304:tWJV26n7BO9TSG/AUYzhuTGP8DhNuHoBX8mgxvBG2GCZDzvlGOlkQ5DUOgJ9z:tmV26709ObUvt8BvBGtCtltDUJV
TLSH
T1AA76CF1BE6A901ADD0A6D139CB464922E7317C490376AAEF1B809E722F733D0DE7D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcrobatSetup.iso:Zone.Identifier

Path C:\Users\Admin\Downloads\AcrobatSetup.iso:Zone.Identifier
Size 182B
SHA256 2c09408ba2925742cc01669700028576206d48d510488cd30452ab8eda53b8b9
MD5 ad1578bb9a86ff8b3063e1f7eeead274
SHA1 052921cc496dc621116a6642700e081c650f68e6
SHA512 f2c2ee809d83fb96588bd6bc89a563ff58e163bcd28d0f64e2d184ba698d91129c4bbe29f275d7edeb33b364761851ec9db9ea485fe5554ed2fbc607a7e53c30
TLSH
T1BCC0125A9D054118095551CC00BC6F2CBD1A671408D1A281DD2003AB7A485BC4798F26
MD5 SHA1 SHA512 TLSH

Submit Download

MSEDGEUPDATE.MSI

Path \??\E:\MSEDGEUPDATE.MSI
Size 3.5MB
SHA256 e3a7429edaefb398143fbe6eed31815d48d13b4cd704a7b232121c4c589ab6a6
MD5 c4bea32df29e241499c477ee24ace5b0
SHA1 350bd30158e6d39988f60cb39bbea9edf04575ae
SHA512 250dda4b54f8f04132dd37574c6a9301771a1336eff4276894b0588fcb07144177481b96cd100a6d7b52dc1ebc0d376a2bd86a665706fdcd728e692ca969021d
SSDEEP 98304:WhNuHoBX8mgxvBG2GCZDzvlGOlkQ5DUOgJ9zq:Wvt8BvBGtCtltDUJVq
TLSH
T11FF52302B5C1843AD3BF1DB1482A8675597CB9341BECC85BA7585C3E7E71790A7F2322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download