Analysis

  • geolocation tags

    brbrazilsouth-america
  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260130-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    16/04/2026, 14:57

General

  • Target
    http://teclado-ssl.fulltrack.net.br
  • Sample260416-sblc2sct2k
Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 58 IoCs
  • Suspicious use of FindShellTrayWindow 43 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://teclado-ssl.fulltrack.net.br
    1⤵
    • Drops file in Windows directory
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4804
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff9dd02c728,0x7ff9dd02c734,0x7ff9dd02c740
      2⤵
        PID:4836
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1784,i,5737271024948713088,3645903491832921515,262144 --field-trial-handle=2012,i,386075617801359250,5861403174623643609,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2008 /prefetch:2
        2⤵
          PID:3220
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,13509802557072232301,4244000357176716217,524288 --field-trial-handle=2012,i,386075617801359250,5861403174623643609,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2244 /prefetch:3
          2⤵
          • System Time Discovery
          PID:1728
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,7064198278881457176,11865939475159873938,524288 --field-trial-handle=2012,i,386075617801359250,5861403174623643609,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2300 /prefetch:8
          2⤵
            PID:5948
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3088,i,11655798607653074247,10943128862731192530,2097152 --field-trial-handle=2012,i,386075617801359250,5861403174623643609,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3212 /prefetch:1
            2⤵
              PID:3872
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3100,i,1811479683026621235,10860380097491329547,2097152 --field-trial-handle=2012,i,386075617801359250,5861403174623643609,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3248 /prefetch:1
              2⤵
                PID:3880
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4316,i,7220218635803426494,15861844336787371810,2097152 --field-trial-handle=2012,i,386075617801359250,5861403174623643609,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4336 /prefetch:2
                2⤵
                  PID:460
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5252,i,7701969063172783815,1420672717369598840,524288 --field-trial-handle=2012,i,386075617801359250,5861403174623643609,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5184 /prefetch:8
                  2⤵
                    PID:3556
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5492,i,9118072307486336944,3328596932483194182,2097152 --field-trial-handle=2012,i,386075617801359250,5861403174623643609,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5592 /prefetch:1
                    2⤵
                      PID:3464
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3444,i,3192270022477472225,355028701430861986,2097152 --field-trial-handle=2012,i,386075617801359250,5861403174623643609,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3452 /prefetch:1
                      2⤵
                        PID:5508
                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                      1⤵
                        PID:4256
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                        1⤵
                          PID:5288

                        Network

                              MITRE ATT&CK Enterprise v16

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              BookmarkMergedSurfaceOrdering

                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                              • Size 6B
                              • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                              • MD5 SHA1 SHA512

                              BrowsingTopicsState

                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                              • Size 414B
                              • SHA256 61e96f7e476a1ead06f94abb2a032c47618430d7991dc0482609e0a7aaa941ec
                              • MD5 SHA1 SHA512 TLSH

                              Network Persistent State

                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                              • Size 2KB
                              • SHA256 28598a28d779bc6cd0a4e3e58dd9813750f954ccfecee7570783f7f82dddb067
                              • MD5 SHA1 SHA512 TLSH

                              SCT Auditing Pending Reports

                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                              • Size 2B
                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                              • MD5 SHA1 SHA512

                              TransportSecurity

                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                              • Size 523B
                              • SHA256 11106c00942ec9d77de4f55e37f3981596664699176652b6a743cfdaaa37497a
                              • MD5 SHA1 SHA512 TLSH

                              Preferences

                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                              • Size 12KB
                              • SHA256 d72c1cea96d6b651d642bbc4d4561e156170ee004678005f42ad2dd726c18845
                              • MD5 SHA1 SHA512 SSDEEP TLSH

                              Secure Preferences

                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                              • Size 17KB
                              • SHA256 8f0501913421e4f88b89b06aecce594d47e8e8a013686ed46a5fb6ee49c944a8
                              • MD5 SHA1 SHA512 SSDEEP TLSH

                              the-real-index

                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                              • Size 120B
                              • SHA256 2b364a8e24a11c91dfea2ca498bc5aa68af190da2cbb8cd6e32e98063365d510
                              • MD5 SHA1 SHA512 TLSH

                              the-real-index~RFe58314c.TMP

                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58314c.TMP
                              • Size 96B
                              • SHA256 3227d1856842f582da7f6841dd1445204f6de5481ae0c5dc4daa9dac06c5f9b4
                              • MD5 SHA1 SHA512 TLSH

                              Local State

                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                              • Size 89KB
                              • SHA256 c0be2e05c0dd91a11ea9f0c670a0cda694a451241081cc333168f04e96de9389
                              • MD5 SHA1 SHA512 SSDEEP TLSH

                              Local State

                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                              • Size 90KB
                              • SHA256 29f181535c0efe48fdfd1900112d27cdc700360161cb35d66e1bffafdcf191f6
                              • MD5 SHA1 SHA512 SSDEEP TLSH

                              Local State

                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                              • Size 90KB
                              • SHA256 85874a793efc02688847280f6d2ce0d4be5294cab79da756e40f0ea55e392d40
                              • MD5 SHA1 SHA512 SSDEEP TLSH

                              data_1

                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
                              • Size 264KB
                              • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                              • MD5 SHA1 SHA512 SSDEEP