bff4f1773234443f15224349ca29867e1dae451eae49a2d54b9959633519f364

Analysis

max time kernel
899s
max time network
890s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 279KB
Sample261024-tkhtysfc47
SHA256 bff4f1773234443f15224349ca29867e1dae451eae49a2d54b9959633519f364
MD5 61adc69bc282066129f566e575f0f87e
SHA1 1ddcc833317a76ac7dc38a6b73c13670d9c2ab3d
SHA512 ad60c2e4d7e7898bb56a7fa4bf12311aaba5610daa23cb73883ff5e9b52fd6f5566684d8b86af0898144889fe5f426b7179d235a8b69035f5ab8610ac6ba267e
SSDEEP 3072:io74FgHwX3zqjnTEIZjUOllymJE3xxbYKoIjrXdJ80M0KJZp:174FgHwnzqzwIZjRymJG8VInQrJZp
TLSH
T1F3545B726210B13BB413DDA0A6BF6E0E3C66E127DD0A86F8A491E470DFE2EB1111575E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5804	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
624	chrome.exe
624	chrome.exe

Suspicious behavior: LoadsDriver 9 IoCs

pid
4
4
4
4
4
4
4
4
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5648 wrote to memory of 5524	5648	chrome.exe	88
PID 5648 wrote to memory of 2844	5648	chrome.exe	90
PID 5648 wrote to memory of 2844	5648	chrome.exe	90
PID 5648 wrote to memory of 5804	5648	chrome.exe	91
PID 5648 wrote to memory of 2672	5648	chrome.exe	93
PID 5648 wrote to memory of 2672	5648	chrome.exe	93
PID 5648 wrote to memory of 5684	5648	chrome.exe	94
PID 5648 wrote to memory of 5684	5648	chrome.exe	94
PID 5648 wrote to memory of 4144	5648	chrome.exe	95
PID 5648 wrote to memory of 4144	5648	chrome.exe	95
PID 5648 wrote to memory of 2468	5648	chrome.exe	97
PID 5648 wrote to memory of 1540	5648	chrome.exe	99
PID 5648 wrote to memory of 1540	5648	chrome.exe	99
PID 5648 wrote to memory of 688	5648	chrome.exe	100
PID 5648 wrote to memory of 688	5648	chrome.exe	100
PID 5648 wrote to memory of 5844	5648	chrome.exe	103
PID 5648 wrote to memory of 5844	5648	chrome.exe	103
PID 5648 wrote to memory of 5948	5648	chrome.exe	104
PID 5648 wrote to memory of 5948	5648	chrome.exe	104
PID 5648 wrote to memory of 5176	5648	chrome.exe	105
PID 5648 wrote to memory of 3408	5648	chrome.exe	106
PID 5648 wrote to memory of 3408	5648	chrome.exe	106
PID 5648 wrote to memory of 5176	5648	chrome.exe	105
PID 5648 wrote to memory of 240	5648	chrome.exe	107
PID 5648 wrote to memory of 1076	5648	chrome.exe	108
PID 5648 wrote to memory of 240	5648	chrome.exe	107
PID 5648 wrote to memory of 1076	5648	chrome.exe	108
PID 5648 wrote to memory of 2520	5648	chrome.exe	110
PID 5648 wrote to memory of 2456	5648	chrome.exe	111
PID 5648 wrote to memory of 296	5648	chrome.exe	112
PID 5648 wrote to memory of 624	5648	chrome.exe	113
PID 5648 wrote to memory of 4920	5648	chrome.exe	114
PID 5648 wrote to memory of 4920	5648	chrome.exe	114

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff6b89c728,0x7fff6b89c734,0x7fff6b89c740
  2⤵
  PID:5524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,10396012111658802186,1798467917044673444,262144 --field-trial-handle=1908,i,5636487177288671562,10052685656301481045,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2176,i,2038682806506057533,5266296462451364898,524288 --field-trial-handle=1908,i,5636487177288671562,10052685656301481045,262144 --variations-seed-version --mojo-platform-channel-handle=1464 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,12149816876947900093,6433872745040384418,524288 --field-trial-handle=1908,i,5636487177288671562,10052685656301481045,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:13
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,11062044783669705239,18246451057935790731,2097152 --field-trial-handle=1908,i,5636487177288671562,10052685656301481045,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3200,i,12281451588713020923,10577551022713073214,2097152 --field-trial-handle=1908,i,5636487177288671562,10052685656301481045,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,16907417634380284074,5940863096538023707,524288 --field-trial-handle=1908,i,5636487177288671562,10052685656301481045,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5544,i,7069033757045690346,6988063656418907152,2097152 --field-trial-handle=1908,i,5636487177288671562,10052685656301481045,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5592,i,2134380103874595003,17788552803960753286,2097152 --field-trial-handle=1908,i,5636487177288671562,10052685656301481045,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5524,i,1060422575059541933,3744253991512065870,2097152 --field-trial-handle=1908,i,5636487177288671562,10052685656301481045,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5680,i,9381995906169674661,17385909603667804982,2097152 --field-trial-handle=1908,i,5636487177288671562,10052685656301481045,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5656,i,13139690487800515141,9452961915511863667,2097152 --field-trial-handle=1908,i,5636487177288671562,10052685656301481045,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4752,i,8415415806606193125,18407454896346227987,2097152 --field-trial-handle=1908,i,5636487177288671562,10052685656301481045,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5928,i,14158228173006377626,10030490025104940935,2097152 --field-trial-handle=1908,i,5636487177288671562,10052685656301481045,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4688,i,14254970548759091734,16874736504774042861,2097152 --field-trial-handle=1908,i,5636487177288671562,10052685656301481045,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5868,i,11573337676768215348,4696808664581175977,524288 --field-trial-handle=1908,i,5636487177288671562,10052685656301481045,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
  2⤵
  PID:2520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5576,i,7447651588679225260,4257552345681574489,524288 --field-trial-handle=1908,i,5636487177288671562,10052685656301481045,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
  2⤵
  PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5752,i,4497521336207507920,13805895279565029243,524288 --field-trial-handle=1908,i,5636487177288671562,10052685656301481045,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
  2⤵
  PID:296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5848,i,12654104575499036954,13376513086563786900,262144 --field-trial-handle=1908,i,5636487177288671562,10052685656301481045,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3884,i,15123265480833153415,14082574724435610512,524288 --field-trial-handle=1908,i,5636487177288671562,10052685656301481045,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:14
  2⤵
  PID:4920

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1432

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3816a11c-83da-4d24-829f-2099dde10c49.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3816a11c-83da-4d24-829f-2099dde10c49.tmp
Size 5KB
SHA256 0e01d0473e0b71495213c1aa08ee248423451064dcddf818ba4e06190a6d085f
MD5 b474ba740d75b21a902db837d8698b5e
SHA1 42659f8983d73cb08f2293bb7643454b11541373
SHA512 a1a184ceb4742422545d05cfe8f27b3941f37e161e6f1b559a4c22f4785b0fc1552c9856019b9474cb4b4cd084daa36a38d06e49c95c2076ead94986d11d9032
SSDEEP 96:4bJ0d+qw+CWJKhPPf36vjt9Sl8h4otop50ivYDUB6HGyvr7jAixwzFWZf2K2u0jd:4t0h2WJiiFiU2xuYHqj9x7Zf2K2uUH
TLSH
T191C10A71A46C6C379AF7DA41F4032947CEB426AF96147E50E6E91E1800E72DD2753A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f707adb-daa5-49f0-b59e-cadfc4c1e21a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4f707adb-daa5-49f0-b59e-cadfc4c1e21a.tmp
Size 5KB
SHA256 7a64f1485107c0b7d62bd4dc049c3695e22d9dab8ebf8b8820ad1e9f7f4a8862
MD5 0855d248d5b5688716ccd163622dfe04
SHA1 47e19416fa05814dfd95afc0742c61b9d458a749
SHA512 b11819c3506b831e47a9e0723973244f981c38447ed95aa13437d6e775fbf54579d7261f4a31f17270749dcba4231537a0c27fe71d0d14b5d8b004cae57a0436
SSDEEP 96:6C0d+qw+CWJKhPPf36vjt9Sl8h4otop50ivYDUB6HGyvr7jAixwzFWZdBK2u0j9H:6C0h2WJiiFiU2xuYHqj9x7ZdBK2uUH
TLSH
T1FCC10A75A47C6C379AF3DA41F4032D47CEB422AFA5147E50E6E91E1800E71DD2393A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5daf1b22-a5f1-48ed-9f63-af502e73ee9c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5daf1b22-a5f1-48ed-9f63-af502e73ee9c.tmp
Size 4KB
SHA256 77288b0f56a55ef05b285d20e68a707126ab4c968dbb05ed830230d7514debf5
MD5 85dbfc0481154218b64fbcc65d232931
SHA1 c2e98fd2a5105ba97c870115589158886811b260
SHA512 b7820e6c1f6a355eb96b999f63734ca83fd8427b49b090c3224802a70f6d1d2201aee2444fa4032a87b19824c2d6cbf4860ea7d378f3efb17cedb19319962d85
SSDEEP 96:9C0d+qw+CWJKhPPf36v+twERDotok50ivsDUB6WGyvr7w72sbm3v4a:9C0h2WJiiniDUDx6Yaqw72sbC
TLSH
T13CA1F872D46C5D7B89B6C985B8432A47CEB422ABA521BF40D5DC1E0811F72EC1392A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69acdc23-92d5-4be3-b8fc-51e0d60fcd22.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\69acdc23-92d5-4be3-b8fc-51e0d60fcd22.tmp
Size 5KB
SHA256 7cefa057ee5fd218b3f132ebcbd95610d31a8cbcb1fed476e2978f172ea24e26
MD5 95ceb78364e2ee345d78b8170a594f63
SHA1 c2c2c9bbb3d38dddd073f29d5f1b2cc9eafbe9bb
SHA512 718de909a7d087cb12b93483548cfba2e84fe82f5a1f09aa8e941666f8ab95947a720e86c1e5346aabb2dcdd96f956b33382cb27fbe639eaf19ee92dfce122cb
SSDEEP 96:4bJ0d+qw+CWJKhPPf36vjt9Sl8h4otop50ivYDUB6HGyvr7jtfcK24vRNC39ISyt:4t0h2WJiiFiU2xuYHqjtfcK2SuCV9
TLSH
T1BCC10871D42C6C3B8DF2D985B0032D47CDB426AF69147E58EAEC1D1801E76DD5393A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94fd4858-bf94-4457-8979-4430eb2a7338.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\94fd4858-bf94-4457-8979-4430eb2a7338.tmp
Size 5KB
SHA256 955b420a5654c5c37d678aa06d9b3d2bcfaa24df5032155604ccd871fe03206b
MD5 7ab1475c6089bbcb04b7e158a02c04d7
SHA1 fd8aadd26078262d68310caca4381c21733de307
SHA512 356d851f2cf3dfe973837a8fc9c4bc0fca591cea03d0d7240a8c78fbbf98873a8c8587f6adcd117c00a9af3c91c393438452951ceae1a7b72f7b2dfb726d61a4
SSDEEP 96:4bJod+qw+CWJKhPPf36vjt9Sl8h4otop50ivYDUB6HGyvr7jtfcK24vRNC39ISyt:4toh2WJiiFiU2xuYHqjtfcK2SuCV9
TLSH
T12BC11771D42C6C3B9DF2D985B0032D47CDB426AF69187E58EAEC1E0801E75DD5393A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

043cce80-dd19-476c-a47e-65408ab7c60b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\043cce80-dd19-476c-a47e-65408ab7c60b.tmp
Size 12KB
SHA256 c9d3da0f7c4f07ca4f387a78a9217c362beb18032045e2646664944c5ee0522b
MD5 042fd0b609cf709adc020c13b65d83dd
SHA1 82264edbe9c434f71a92c53a740f010bf969bd12
SHA512 581705771699771d70f89547debd6ac3f4d6891bf67033694bf8c552e912defbcc54c2f57ff50175fc7af3919d9f265584c347708778f6f632ba68f4e6c588cd
SSDEEP 192:xBRjhyAkkv7dvzPRpPBm9JHsb+WNnFV0PHfwAJaL+VyIsnAUgE:xBRjYLApjX4Hwz0PHfJs2E
TLSH
T1CE42B42DB914793BACDBD269F9617B53D2F5202121901F84EAFC893C25E7ACC222B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ddede5c-d6db-456e-a653-316df52f1a08.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7ddede5c-d6db-456e-a653-316df52f1a08.tmp
Size 11KB
SHA256 b0e5d172cb9ac0c2bda5d3059366db21a8b3157d27f5340eabe47b7b6643b6d9
MD5 ef660e08c0ad5777f7c784ca58f494cd
SHA1 9d5f20450b7f99601230dd611f9e45d562f5c134
SHA512 9070a3572c750e77a68de7e20216daba37d6cee4a6dd337ae3e6a090a7a86e953b0460140e3b6d1263eb566748c2ef2c1685264331339b4d92a3a6093b4a0c60
SSDEEP 192:xBRjhyAkkv7dvAPRp2Bm9JHsb+WNnFV0PHeAJa/+VyIsnAUgR:xBRjYLAp6XPHwz0PH3y2R
TLSH
T1F532B429F924793BACDBC229F9617B53D6F5202125911F84EAFC893C25E7ADC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

523e5612-2bb8-41cb-ae39-e37a5bf8fa38.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\523e5612-2bb8-41cb-ae39-e37a5bf8fa38.tmp
Size 2KB
SHA256 4c5da39da2b1e982b4f07f4df5bd843912ff5318b5ee8943c63b62ee6bb591d3
MD5 a4775f513936ac173aa81ff591d94b9f
SHA1 dfce5dcef48682919bbe9480fa9dcee4c6ea6bc8
SHA512 4d0bb6b7ea490964abc3ff5da6a42a97f25e86ef2e037fba4b19d3fedb37fc3f1085d05e4df64a790a1a9503078d87912be16b8ed9db61b6ed75a4b89d3ce2c0
TLSH
T1EC518CFB83E48A7E891592F4DB266E1FDD790515032C3C6288E4AE1B53F2972D20079F
MD5 SHA1 SHA512 TLSH

Submit Download

8308c765-a0d5-48cf-a71d-8519c0ed4e71.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8308c765-a0d5-48cf-a71d-8519c0ed4e71.tmp
Size 2KB
SHA256 d033fc5196e84359872d0e0d8c7ea642db20fc10b44c74581343c785d89d0db0
MD5 1abfe853d34bec9e8bc751474f02a7df
SHA1 6cad7603e736a7edd3636b6a4b31a8e9d437d81a
SHA512 d01e075346aa1555cbee51ea2d7faaec22f4ffc139065a19ed37b7eb71f8f99bcb63a4cc76667602585c71f43c6b1f241c9690cf28226c07a96a8176a7267a69
TLSH
T12C517DFB83E48A7D891592F4DB266E1FDD790515132C3C6288E4AE1B53F2972D20079F
MD5 SHA1 SHA512 TLSH

Submit Download

8a273d85-ceef-42ac-baea-fb893a57c3f8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8a273d85-ceef-42ac-baea-fb893a57c3f8.tmp
Size 523B
SHA256 d30f7519c4f48ab74b81d7b4dcc39c4dfa8d5a48e97bdb94188827a95cbac1db
MD5 4084de06a37cee9b130fa8ad09f71def
SHA1 1f4d55a1f9472e7a30751af570e45ce8411d3245
SHA512 8975f37a4e6a4b1804ceb5cd2da62175a1b5db7966879ac63aded4249d752bca73b5b1d5e30c49228d0f673e348291776775f175178d6b934f247af33cb416a8
TLSH
T1FDF059E7D679743700BA59F75D05B80A55B6A431024168E4CE9A427DE0C15B71B1249B
MD5 SHA1 SHA512 TLSH

Submit Download

8abfbdf0-1a43-49a3-bda4-dbc2455670ce.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8abfbdf0-1a43-49a3-bda4-dbc2455670ce.tmp
Size 2KB
SHA256 843849f68ff9cd558ec6fc0eb12a7abc035fc8aa17285cd2b855ed50c2127b20
MD5 4fb92fff0926b78041e1672ce73061bb
SHA1 0a6ff98ad8b3a0338b1c9d09f75d6cde755907f1
SHA512 e38ba45182ea38160386620a9766767e0d1bade771474185205646979ee0b2d8b84630f56bc98317c066d137093db123090c38cd485f31aed95d6f15a73241f7
TLSH
T18B51ACF787E48A7E891552F49B266E1FDD7D0519032C3C6288E4AE1B53F2972D20079F
MD5 SHA1 SHA512 TLSH

Submit Download

b0dda56f-c9ae-4a27-bf4a-664959f5e375.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b0dda56f-c9ae-4a27-bf4a-664959f5e375.tmp
Size 2KB
SHA256 22292e46382a24b0a5d7a6742972d6c3c5bcf0e74763b24731364fe0f9b2537c
MD5 7db7b5168bebfe369dfc7f1213d9b088
SHA1 01d15e35e8751aea65ba914c3e4ddf58b407faa8
SHA512 af9897b9f0d5cc79de231299d648057405ea0e3177ebec2541aa0dc576fcf99afcbde12e80de5519ee478d837702275573695534f9938b62343603360c6025d8
TLSH
T1CB51BDFB83E48A7D891592F4DB266E1FCD790515032C3C6288E4AE1B53F2972D20079F
MD5 SHA1 SHA512 TLSH

Submit Download

b43fbe01-7290-4757-81cb-b547cff67f0c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b43fbe01-7290-4757-81cb-b547cff67f0c.tmp
Size 2KB
SHA256 b019a80bdb0c6e90b05c090602668221b2ce51260d53a7834130db358c1c31d2
MD5 d01e3b7d864f84b5bb4442b41c0ea103
SHA1 66596374787aa557ffbfe4d8cb4d08ff5f9b0c1c
SHA512 36ed403832ca372b0d2f881c5ac2b94cbab0a26073091dc448108b9dd0ac440f0bb0b3556eefe94e2782150d73579062dc3f5cb4f28f5f608fab61bc16ab37d7
TLSH
T1D051ADF787E4867D891592E49B266E1FCD7D0519132C3C6288E4AE1B53F2971D20079F
MD5 SHA1 SHA512 TLSH

Submit Download

bd6d114f-3b21-40e2-b1c4-c1a84ce29633.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\bd6d114f-3b21-40e2-b1c4-c1a84ce29633.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

acf15360-87e2-4f9b-b0f3-dd991cca2897.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\acf15360-87e2-4f9b-b0f3-dd991cca2897.tmp
Size 11KB
SHA256 b02a7a140b03e59bce11500225c2a8f7c95191067a5834f0adc31294f1be5527
MD5 1e5438eb89d255376c8f2e39f43a143c
SHA1 05a1c1d4fb615a86b80678cc2b2362432bdcdbfb
SHA512 1f5c3f61ac75bb09db5f83c61fc1d61a3ec6c0aed9da22eae347eda33c0d4a3a4ce1b057fe0e6a1bc3082cbd90b9c3ff9fa07d221d4e8e5b8738a4ac06d17ee5
SSDEEP 192:ezI4K6i47KxkXqK4I40pUZNCgVLHrKHfFKslEe75XzKD/dY+ErUkKN9/qSXnhHpi:uIj147KxkXqKf/pUZNCgVLH2HfgslT5x
TLSH
T19932E727A48D9E3F4FDCD50DCC126F8BACF4429663680D2852FB9D0803A578E515A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c75ec1b6-acbf-404f-9c4c-f2e7c0d6bc9f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c75ec1b6-acbf-404f-9c4c-f2e7c0d6bc9f.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download