Analysis
- geolocation tags
asiadelhiinindia - max time kernel
30s - max time network
26s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/05/2026, 18:10
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://lagmachine.vercel.app
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
30 seconds
Behavioral task
behavioral2
Sample
http://lagmachine.vercel.app
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
12 signatures
30 seconds
Behavioral task
behavioral3
Sample
http://lagmachine.vercel.app
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
30 seconds
General
- Target http://lagmachine.vercel.app
- Sample260515-wsetdadx3z
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4728 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237090984887578" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4976 chrome.exe 4976 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe - Suspicious use of AdjustPrivilegeToken 58 IoCs
description pid Process Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 4976 wrote to memory of 924 4976 chrome.exe 85 PID 4976 wrote to memory of 3504 4976 chrome.exe 86 PID 4976 wrote to memory of 3504 4976 chrome.exe 86 PID 4976 wrote to memory of 4728 4976 chrome.exe 87 PID 4976 wrote to memory of 2540 4976 chrome.exe 88 PID 4976 wrote to memory of 2540 4976 chrome.exe 88 PID 4976 wrote to memory of 3460 4976 chrome.exe 90 PID 4976 wrote to memory of 3516 4976 chrome.exe 91 PID 4976 wrote to memory of 3460 4976 chrome.exe 90 PID 4976 wrote to memory of 3516 4976 chrome.exe 91 PID 4976 wrote to memory of 1668 4976 chrome.exe 92 PID 4976 wrote to memory of 1668 4976 chrome.exe 92 PID 4976 wrote to memory of 4700 4976 chrome.exe 98
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://lagmachine.vercel.app1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff967a8c728,0x7ff967a8c734,0x7ff967a8c7402⤵PID:924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,8536870777791546321,2688168838369251497,262144 --field-trial-handle=1968,i,17564560238577408058,5064648344268664465,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1964 /prefetch:22⤵PID:3504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,1746832502587847583,11634267517475618352,524288 --field-trial-handle=1968,i,17564560238577408058,5064648344268664465,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2280 /prefetch:32⤵
- System Time Discovery
PID:4728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,14975939899078773407,7677944257030566499,524288 --field-trial-handle=1968,i,17564560238577408058,5064648344268664465,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2536 /prefetch:82⤵PID:2540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3124,i,12449483696501089577,6979039982534720325,2097152 --field-trial-handle=1968,i,17564560238577408058,5064648344268664465,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3036 /prefetch:12⤵PID:3460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3104,i,5663220705938010919,18331809227266684345,2097152 --field-trial-handle=1968,i,17564560238577408058,5064648344268664465,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:3516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4536,i,7090806325066561362,6687134833754482428,2097152 --field-trial-handle=1968,i,17564560238577408058,5064648344268664465,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4544 /prefetch:12⤵PID:1668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5292,i,16659967352178536304,5886377490616011940,524288 --field-trial-handle=1968,i,17564560238577408058,5064648344268664465,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5288 /prefetch:82⤵PID:4700
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4384
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4424
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 f0fd478ce0fe8337d27ff920c9d23d60ee5c44faafdba1506b170e163474a159
- MD5 8dadf5f83b134977bb32134979292f72
- SHA1 c41cae94a9c70d1c7811e3aefcfdc11927b20506
- SHA512 c712699d7d98c68184b6b5c6b64e769ac0c35e94a0ab8ece49e2299719be95fa2b2592b2db8ddfcfec2a79216fe06b8ffa5170ca1756b3f002b05add94a7ed8c
- TLSH T119E02BAAE9399C3B2CF9572C60540B86D74013573B50A98F363C810ACFB5B370546C1C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 96B
- SHA256 71b3975772f220340453f51c04215ea55c021e3d1f8a9bb07b8b378ad56c7fd9
- MD5 335d79bbb6ced963dcc040db76d3fd73
- SHA1 2b8ab470f37d3277237515c370f1063618a13f02
- SHA512 96f48a76b085c17c0b5fa7a3f58537adaf73b3d2bde7d50b960028a372abdd99337faf6c5b47b1239cd4affd3ff439fe503330953eaab583bd768add72767f5f
- TLSH T100B0121425804053EB0013709DD513807035096C02060517C0D601DC40323A19181001
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 308267d7c04e95a4630bb6b4a9f3694a7b17be24b9799237ae748b9c2cab9bae
- MD5 b7f3776e3d689feb24f1385801cf54a7
- SHA1 69526cb8be9ea03ee8a491f0f5f3815e96601ac8
- SHA512 1cbe325705c9734b2d39c6acf8efd4fa3f398b849351fa53f34d08c5b803c422aaed8e62ba3d3487ec2a282d132e914207473ca0d677eaa3f991ad8ec21e7e25
- SSDEEP 192:/REzxw1v78pAPRp27K9DHsb+WNnoKBQO2PULeHVyIsnAUge:/REzCF4UXF5wRH2Ppe
- TLSH T1E632A52EAD14693B5CDBD229FE657763E7F6102261D12E90EAFC8A2C10D75CC322741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 13KB
- SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
- MD5 be6f9d6a2cbcb56c02708e735863c266
- SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
- SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
- SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
- TLSH T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 1a1ce5cc549f0008c9d3213ee2306f8156093f140c5fbc6ec646d30afa433f64
- MD5 0a3101ffcf28db7420bb6de79c47f3c7
- SHA1 5536b792808df46d04b8ec2a238fda5927e8fb18
- SHA512 cca7575ab1ea680e2465ced1a0f0ce8036bbaa13a6cd0e266455be774364d3efa55ef2aa44182c47c42b80e8d5fd01337808ec2b5a1b8d9284dddb48290ea0ec
- SSDEEP 3072:5nGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:5Gm7Rkm1tYpBeh2BAoO
- TLSH T142C3123B6D75A9365DB9B71EB04E0A1F1EF14DA6C920DE92C8D85B0433E97CC1A09934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 3499db64c71ee97ca468c4b8787540089b984eb389e103cbfacb97425b867fe6
- MD5 5024b121ccd95109882a2218c72ae2b6
- SHA1 79d92901faa0483c78f5df65817d0e07f790c4ca
- SHA512 3456c64c4458c7b8795717d77bf06d6a83756be4491e69c5fcfef5f101a46767ceb1708be5f1f41f2b02dcd40357e349f33b7ff9ab4dfd7ef08e3c257522daee
- SSDEEP 3072:oGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:Dm7Rkm1tYpBeh2BAoO
- TLSH T150C3123B5D75E9375D79A70EB48E0B1E1EF24AA6C920DE4288D46B0473FA7CC1905A34
- MD5 SHA1 SHA512 SSDEEP TLSH