ShellHawk

Low signal — weak indicators present

Only weak/low-confidence indicators were found. May be benign — use context.

Command

cmd.exe /d /s /c ""C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26050.15-0\mpextms.exe" chrome-extension://lcmcgbabdcbngcbcfabdncmoppkajglo/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.351126fb478d8ae8 > \\.\pipe\chrome.nativeMessaging.out.351126fb478d8ae8

Analysis

Uses the Windows Command Prompt to execute an inline Windows command.

The command leverages Cmd.exe, a Windows binary catalogued in LOLBAS as commonly abused for living-off-the-land attacks — known abuse categories: ADS, Upload, and Download.

While the detected binaries have legitimate administrative uses, their presence in an investigation warrants scrutiny of process lineage, network connections made during execution, and any files created or modified.

Export:

anonymous

Binaries in command

cmd.exeLOLBASADSDownloadUpload

The command-line interpreter in Windows

T1564.004 T1059.003 T1105 T1048.003

mpextms.exeUnknown

Threat actor attribution

🇷🇺APT28(Fancy Bear, STRONTIUM)

medium

Russian GRU Unit 26165 threat group active since at least 2004. Primarily targets governments, militaries, and security organizations.

2 matched:T1059.003 T1105

🇷🇺APT29(Cozy Bear, The Dukes)

medium

Russian SVR threat group responsible for the SolarWinds supply chain attack and numerous government breaches. Known for stealthy, long-dwell intrusions.

2 matched:T1059.003 T1105

🇷🇺Sandworm(Voodoo Bear, BlackEnergy)

medium

Russian GRU Unit 74455 group responsible for NotPetya, attacks on Ukrainian power grid, and Olympic Destroyer. Focuses on destructive operations.

2 matched:T1059.003 T1105

🇷🇺Turla(Snake, Venomous Bear)

medium

Russian FSB-linked group known for sophisticated backdoors and hijacking other threat actors' infrastructure. Active since at least 2004.

2 matched:T1059.003 T1105

🇰🇵Lazarus Group(Hidden Cobra, Zinc)

medium

North Korean state-sponsored group linked to the $81M Bangladesh Bank heist, WannaCry ransomware, and Sony Pictures breach. The most prolific nation-state financial threat actor.

2 matched:T1059.003 T1105

Attribution based on MITRE ATT&CK technique overlap. Confidence reflects TTP match depth — not a definitive attribution.