Analysis
- user interaction
yes - max time kernel
26s - max time network
27s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/04/2026, 16:57
Static task
static1
Behavioral task
behavioral1
Sample
authorize.js
Resource
win10v2004-20260130-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
authorize.js
Resource
win11-20260130-en
1 signatures
150 seconds
General
- Target authorize.js
- Size 24KB
- Sample260420-vghv8aaz3k
- SHA256 50da05f4bbf9b877311a75f3b22180d8356e857c84c370e1e995f5b5a856a080
- MD5 52d6e826a7a3af096712a121e47fb215
- SHA1 27fd86db654c84cabaad6b7b49b33a5044f5a1b8
- SHA512 62e1e01246c57c6249b3b402213cc73e500c6c2362d5b2342e7007d1cba9656c5895451fd20eb7dbda9ff2cb04db09b7356d2e1838a7805d23f161c53a88cc90
- SSDEEP 768:Azo4UxwSrUMNTby8yEk77gPlxLCxpVVvPozvvacz8q:Azo4U1TbRyEk77gx2xpTvPozvCHq
- TLSH T1A4B229E93F81346B87860475D4FF760AE2B925535C48C8A4F18DECC928F9FEA4267907
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Command and Scripting Interpreter: JavaScript 1 TTPs
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 5908 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134211778808548230" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3440 chrome.exe 3440 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe - Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3440 wrote to memory of 3312 3440 chrome.exe 89 PID 3440 wrote to memory of 3852 3440 chrome.exe 90 PID 3440 wrote to memory of 3852 3440 chrome.exe 90 PID 3440 wrote to memory of 5908 3440 chrome.exe 91 PID 3440 wrote to memory of 2324 3440 chrome.exe 92 PID 3440 wrote to memory of 2324 3440 chrome.exe 92 PID 3440 wrote to memory of 1012 3440 chrome.exe 94 PID 3440 wrote to memory of 2296 3440 chrome.exe 95 PID 3440 wrote to memory of 1012 3440 chrome.exe 94 PID 3440 wrote to memory of 2296 3440 chrome.exe 95 PID 3440 wrote to memory of 964 3440 chrome.exe 96 PID 3440 wrote to memory of 964 3440 chrome.exe 96 PID 3440 wrote to memory of 3676 3440 chrome.exe 97 PID 3440 wrote to memory of 3676 3440 chrome.exe 97 PID 3440 wrote to memory of 2988 3440 chrome.exe 98
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\authorize.js1⤵PID:4968
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb863ac728,0x7ffb863ac734,0x7ffb863ac7402⤵PID:3312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,12092572064862992396,10991915801278269418,262144 --field-trial-handle=1940,i,3328804646176632691,3147714277804706457,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1936 /prefetch:22⤵PID:3852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2268,i,952168653301285565,14339534218231018736,524288 --field-trial-handle=1940,i,3328804646176632691,3147714277804706457,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2304 /prefetch:32⤵
- System Time Discovery
PID:5908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,16322480215542826517,3972985687185648090,524288 --field-trial-handle=1940,i,3328804646176632691,3147714277804706457,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2580 /prefetch:82⤵PID:2324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,2174197531442830816,8887115509643253244,2097152 --field-trial-handle=1940,i,3328804646176632691,3147714277804706457,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:1012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3460,i,1724821841881102800,17427421892736182760,2097152 --field-trial-handle=1940,i,3328804646176632691,3147714277804706457,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3480 /prefetch:12⤵PID:2296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4416,i,8301812185959866748,11556183447644570370,2097152 --field-trial-handle=1940,i,3328804646176632691,3147714277804706457,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4432 /prefetch:22⤵PID:964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4720,i,17767681764562298649,13631627845199554196,2097152 --field-trial-handle=1940,i,3328804646176632691,3147714277804706457,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4724 /prefetch:12⤵PID:3676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,2549450366164619951,17361898290260566246,524288 --field-trial-handle=1940,i,3328804646176632691,3147714277804706457,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5540 /prefetch:82⤵PID:2988
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5240
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4196
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 3f82135ad155769802e3f3aa64e5ba978c478a765c8af9c4476d152ac0930a78
- MD5 9b44464cfc9763ae74de33611fdf1f59
- SHA1 8ee0bcda8be0e229d205c208a5dfa11d16ba7f48
- SHA512 e04dfaaec8077e8d39a2e4f6cf1a481b5d8194b8058a638bb6590b576cfe8f9baab6e94c005b31d63bf39c8cfdbbfcbd1f0b4b500131078019eaedb808499dc3
- TLSH T1F2E02B9ACA61EC6724FD176970550B46EA8413472F40496F3E3E810C8FB9A3F458681C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 a137448dcc30cf3279ab4b7d79a31fb0fd027568d28ad6f6097b3b3b58bb516e
- MD5 3a8c729b91c9f616d7c99543f73d376f
- SHA1 c7065411df38c32b2e4134281837fc83ba312298
- SHA512 c2d1639e4ee6e36e5d8a8613eee8ed4670836b831753363e65a0b0ebf66986293a27ff6af4b0629825e1e85da0fd383c4b56e39a7a4522db38e085ee249cb712
- TLSH T191418EF793E89A7D8911A6E4EB256F2FCE6D0925131C7C52C9D4AE0B43F2872D20174E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 523B
- SHA256 68af2c83867edd8dd1841efc495f2021893454ebe19889b54824bd8fa5870a69
- MD5 fd1425b7171ea78007b9f859fbf4b5cd
- SHA1 8cee3acf570e0f4601c9904af3930142980a9c5a
- SHA512 ddc30fd797dd78cdc2cdd1d0c2a0da93d19dad96d4294aa740eaac9648f21d03a81bc8ee6fd687eb72798651efc7137e8526bac03969441b4c5153b6d85f288b
- TLSH T1C2F059ABE67DB85B20F895AB6D04B8092576A83002C164E0CEBA812CA0856FB0F53063
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 de1517c572fc9e4cc7717ae8b593fbcba461684fa526de0497f96534b2ca527d
- MD5 902d9cb2997468af89402aef5b17bd06
- SHA1 b22256ac6dd663dfe75a435be47c16f52bd84ab6
- SHA512 e5ef4885f419ec5d2887670ec5622ca53dae2bcdf080227a8fe9c5a505f516c5631d7822ef8f272e120be428d9d398d9a7222f6b1869996cdd1b3c1e79d2d82f
- SSDEEP 192:eR4dfjDdMflqv7tYpAPRp2hm9CHsb+WNnhO0sj4/PyIsnAUgtaJ:eR4dLetmhYUXem4ws0Y4b8
- TLSH T19C32C42EA914653B8CCBC26AF9253757D7F1102131D42E98EAFC8A2C04DBACD232701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 e3e85507733b74e650902d1645f4c8e2a47131f5f4d003efbf580d80d51d1e18
- MD5 d25832a19ff9c1c57c95ef5ecf3d457d
- SHA1 30d5ae73ddd9dfab1127bd841aef79ad540016fb
- SHA512 680876039281bd13201af5a0d12b9eed3257e3547eb60a743076a4ef44ddf64d39464fedf9d363ec15f80fae0d8dd3610e3a09d4d4a9512ce92d01878e2ab95f
- SSDEEP 384:S0jWV7KxkXqKf/pUZNCgVLH2Hfgslvy7pLuLcifcdXODW1+ErU3IQHGtHkr0:SYWV7KxkXqKf/pUZNCgVLH2Hfgshy7pd
- TLSH T15372D8676C4C99370F94C6CCDC167E4FADB6024B65DD886893FA582A03D5ACF120A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 d1e965c50302d8751f2e192cb0b0ad89e7ccb28683c911291308186550ffe671
- MD5 3039174df8bce4aba8f56f7d0fe1e849
- SHA1 c3834059c62fec06ab950e20c7cdcc83f5e4108c
- SHA512 178cece8f38be3895aa533020a84b8371ad2000fe7843eeb3420bd12bf2528bed4138cc0f5865ed68075adaf62603a950006b077986cb93be19c18fbf041edbd
- TLSH T101B0121280019510C44303B4219204C83114AF20D604130163F46BB2A8262A24015151
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe583d04.TMP
- Size 96B
- SHA256 c09edc4e423b66cced25794e0a6962de5b09a0fb024c53942c8e12361bb2406e
- MD5 5f5c4cee4b1d11a6c9dbd252cb95fdce
- SHA1 82630510ffac9516f01eb19756986b58d05db9b7
- SHA512 4d427fb29b74ca993326d92c6533fe9c6fe1e34420590b176898a5201065007976551727e6aa5f68de746ae4e65354594e73458a5d0275d976011de22ffac883
- TLSH T11BB0228AC003B202C20203F03888A2C8B020CF22CA030203A3E02A23EC23220022C020
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 89KB
- SHA256 c95110edf7cc6813a10378472c24dc92d1a9c04660e0255bce60937652579797
- MD5 e02e2530cea77d9fac13813340e1bea7
- SHA1 214332205899cb9bdbefa4a21dfea09f2223ca47
- SHA512 7fcdae10aa092abff715cf6638abf19077993419399eaadf1bd8a2a4a63f17c5abf927bbc8f755cf36f53ee865f3eba414ff125573aa2221d420807a6ce0bb31
- SSDEEP 1536:0NzcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEB:Iz3Qw/xLANk0mUW5GmRntSFCjEEN3
- TLSH T19C9312BA4E1A46E7997E46C176AD7808CE12130D70AFA9CC316C639D61D41C92B73F73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 193KB
- SHA256 6581def84a8b318ec133187629e59d3c6fa157a65be9dd24b917921355517643
- MD5 b9bebdde32e920b0d19c0d4311b108c0
- SHA1 3558c5141593275b6c483aded45a729886ca45e1
- SHA512 a1536fc28fe83ca41192b93a2d359a5fe740d17ad73c5dfab6038b41b0718ce90651fc4afbaee80cc1f6b8e064a6cad538a15d7a82c5dc3a12acdac5e1b3e484
- SSDEEP 6144:2ezIqEzsSZhAAd6hUsMrOk0HOGm/SFyEE9:PzuzsCprOjuGdF29
- TLSH T1E414126BEF1206C7ACBD87A5B28FB50BCC125345B1AAFD9DB5497388705829417B3F20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP