hxxps://chartagency[.]com/planner/?token=dGhvbWFzLnNvbnRpZUBjZXZhbG9naXN0aWNzLmNvbQ==

Resubmissions

11/05/2026, 16:23

260511-tv528sev6x7

11/05/2026, 16:22

11/05/2026, 16:21

11/05/2026, 16:20

11/05/2026, 16:19

Analysis

user interaction
yes
max time kernel
35s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://chartagency.com/planner/?token=dGhvbWFzLnNvbnRpZUBjZXZhbG9naXN0aWNzLmNvbQ==
Sample260511-tsxm3set9v

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229900039776854"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2764	chrome.exe
2764	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe
Token: SeShutdownPrivilege	2764	chrome.exe
Token: SeCreatePagefilePrivilege	2764	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe
2764	chrome.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2760	2764	chrome.exe	84
PID 2764 wrote to memory of 4124	2764	chrome.exe	85
PID 2764 wrote to memory of 4556	2764	chrome.exe	86
PID 2764 wrote to memory of 4556	2764	chrome.exe	86
PID 2764 wrote to memory of 5488	2764	chrome.exe	88
PID 2764 wrote to memory of 5488	2764	chrome.exe	88
PID 2764 wrote to memory of 3388	2764	chrome.exe	89
PID 2764 wrote to memory of 5284	2764	chrome.exe	90
PID 2764 wrote to memory of 3388	2764	chrome.exe	89
PID 2764 wrote to memory of 5284	2764	chrome.exe	90
PID 2764 wrote to memory of 4464	2764	chrome.exe	91
PID 2764 wrote to memory of 4464	2764	chrome.exe	91
PID 2764 wrote to memory of 3384	2764	chrome.exe	92
PID 2764 wrote to memory of 5624	2764	chrome.exe	103
PID 2764 wrote to memory of 2668	2764	chrome.exe	104
PID 2764 wrote to memory of 2208	2764	chrome.exe	105

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://chartagency.com/planner/?token=dGhvbWFzLnNvbnRpZUBjZXZhbG9naXN0aWNzLmNvbQ==
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbcc44dcf8,0x7ffbcc44dd04,0x7ffbcc44dd10
  2⤵
  PID:2760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1548,i,16420403435107080872,13477134170327890882,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2076 /prefetch:3
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1988,i,16420403435107080872,13477134170327890882,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2364,i,16420403435107080872,13477134170327890882,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:5488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,16420403435107080872,13477134170327890882,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3160,i,16420403435107080872,13477134170327890882,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4344,i,16420403435107080872,13477134170327890882,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=5184,i,16420403435107080872,13477134170327890882,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=208,i,16420403435107080872,13477134170327890882,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:5624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=5504,i,16420403435107080872,13477134170327890882,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=5208,i,16420403435107080872,13477134170327890882,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:2208

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:3560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 30ebaf429820dcc8b5bff6ac06998ca784d6e20abefecb1e6984926d10145ff9
MD5 1fc829b8f1714e1da8be5080e6de9490
SHA1 ac1064d91f6ee83c3aa1d86984c09b198dd25fd3
SHA512 0692ca6653a6f50c2e90ab410254e972f33aeda74394c8fa9637393be60d7d72685971cf9ca8e5f723d8fd264160c03f03e90f3f7c512ee8a8a0cdbe5420fb4f
TLSH
T185E02BAACC71982709FD475960250745E74023572BC0890F377C820D4FB4A3A5586C5D
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 a775ef1cfd0f48678e5fc60c2a3817d38ed1c9546eedadb47c2c6668c1ea362e
MD5 79448e122dfef5e864b5516943adf10d
SHA1 13a353cca9a3fb4348c83ac84cc4098fb7d64088
SHA512 807d28faf185a1d6d7a57104ba33b482447c9a86b341355e2d5407dcd2b9927fc007b2fab50bce51707687aebb334f3393a802e3d69c28b8878a53e715163416
SSDEEP 192:JYi6hbZRUhuZ8PRpsHnNHS+WN4meeHp2+if0e84jtpQyIsnA/g4:JYi6VrEX89cYV+aZ4
TLSH
T15032E72AAD146A7B0CD7C31AFA667B52D7F5202271942E44FAFCCA1C14DB6EC113781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 2c4a07439c3cdbd0d1610339724883cba3e1d9f6f7a2ff784e847f73a32029e9
MD5 24a692ae74a54b32a180a3375100a683
SHA1 6e76e1b5d9e1a607f525b11bf9050c6ac178dfbd
SHA512 470c1f0e1be35bb396ccf5d9494f7312c383179ccd7574b4e68ed582e6cf56a66fd996687c53b9e064c16868a4f5a5beafe786b53b8da914a7b052e8efd286cc
SSDEEP 384:J5zA7pLuLceiBYXWnPkXqKf/pUZNCgVLH2Hf1NwrUo7HGGctDAnqwVHL:JRA7pLuL7siWnPkXqKf/pUZNCgVLH2HK
TLSH
T19472E8677C4C9A770F94D9CCD9267F4FACF6024B65ED886443FA982503D4EDA010A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 c103114e021789e12794a6779d8b29d6ff259d53db4b24ba628cf3e5c4dd7a86
MD5 4395b90fe42cbe916286bf2da18c5975
SHA1 f30f9b1a1b94da1df54e1250016fc0418b50fdfe
SHA512 3e01d13fd26cc21bec754269ae48f9ff1599158c0f4b7ce8386905aed4dc4c84aaa619c6838814e524684d16976e1a29a8106b2d3479bc64c82839d9016a73fe
TLSH
T19BA002185E495331C8001670158F1150E361AC512201070995A1D4988CA91E09283149
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe57ffeb.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57ffeb.TMP
Size 48B
SHA256 2764b64b6d8235d8b015ec11c1e00fb7a196f98e26c83ff002c893719b947b8e
MD5 9fcb0e199df20377393421ff3ddc55af
SHA1 72984a6acca5c7865896805f42e78b5a9b1134ad
SHA512 cd0c3b9538061dc6d3729d0540f484ddb2a3c26e31381a6d1858c9b66850f89960ec95ccb6d1c3dbe853c903aaab548ab30484ab4097886080d622154aeb8f71
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 83KB
SHA256 87cae5d1cb866810a27548dc7ae88013527381873dbca381f8c5297c986fed19
MD5 80beb7ba703195180b4985e5c890f897
SHA1 7752924bfdab33d0e1580af5f124932abbaf37d3
SHA512 371e457e143130e238b88876a7718f654685c74407459bda22b4e29cc8301da9a0808e25f7c0d1df07ccaa7bad8b23590911e2eba5e2e05d8932ef9e3c8abc68
SSDEEP 1536:bSyCXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwM1:VCXjM4rTmN5eWvStRNoV8cWK7XF+TwM1
TLSH
T19C830233A4DE2BD713645164841B3F934ED505F725C30AE09A793EE6279B8DC0B72A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 84KB
SHA256 14f285840df3c23daeca97e2bcf9537919d1d53664315dbac55995956a869f2d
MD5 8420beb7a1163a920ef668d707150b32
SHA1 9e9d220e92463f9d8b58e794ae378982208deb8c
SHA512 16f65e59b0dc2c6229065e989c12b187beb1567b1376e2c4aca1909f9ca22d3e155be6aca50c533ded5376b7194e77c3f9af91aebe3eacbaff9ea6580f05715f
SSDEEP 1536:DScwFXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwM1:lwFXjM4rTmN5eWvStRNoV8cWK7XF+TwU
TLSH
T1A2830233A8DE3BD713655168901B3F930D9401F725C70AE09A793EE6279B8AC177262B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download