Analysis
- user interaction
yes - max time kernel
20s - max time network
19s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/06/2026, 16:48
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://go.lumel.com/e/1105351/automation-utm-medium-campaign/6kkvqz/1110372350/h/fvuVBnKJs0CFp2gZjl7O6wvCwGmkoOlqW1_LiUwoXtY
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
300 seconds
General
- Target https://go.lumel.com/e/1105351/automation-utm-medium-campaign/6kkvqz/1110372350/h/fvuVBnKJs0CFp2gZjl7O6wvCwGmkoOlqW1_LiUwoXtY
- Sample260623-va698set2m
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2292 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267069122504559" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2472 chrome.exe 2472 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe - Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeShutdownPrivilege 2472 chrome.exe Token: SeCreatePagefilePrivilege 2472 chrome.exe Token: SeShutdownPrivilege 2472 chrome.exe Token: SeCreatePagefilePrivilege 2472 chrome.exe Token: SeShutdownPrivilege 2472 chrome.exe Token: SeCreatePagefilePrivilege 2472 chrome.exe Token: SeShutdownPrivilege 2472 chrome.exe Token: SeCreatePagefilePrivilege 2472 chrome.exe Token: SeShutdownPrivilege 2472 chrome.exe Token: SeCreatePagefilePrivilege 2472 chrome.exe Token: SeShutdownPrivilege 2472 chrome.exe Token: SeCreatePagefilePrivilege 2472 chrome.exe Token: SeShutdownPrivilege 2472 chrome.exe Token: SeCreatePagefilePrivilege 2472 chrome.exe Token: SeShutdownPrivilege 2472 chrome.exe Token: SeCreatePagefilePrivilege 2472 chrome.exe Token: SeShutdownPrivilege 2472 chrome.exe Token: SeCreatePagefilePrivilege 2472 chrome.exe Token: SeShutdownPrivilege 2472 chrome.exe Token: SeCreatePagefilePrivilege 2472 chrome.exe Token: SeShutdownPrivilege 2472 chrome.exe Token: SeCreatePagefilePrivilege 2472 chrome.exe Token: SeShutdownPrivilege 2472 chrome.exe Token: SeCreatePagefilePrivilege 2472 chrome.exe Token: SeShutdownPrivilege 2472 chrome.exe Token: SeCreatePagefilePrivilege 2472 chrome.exe Token: SeShutdownPrivilege 2472 chrome.exe Token: SeCreatePagefilePrivilege 2472 chrome.exe Token: SeShutdownPrivilege 2472 chrome.exe Token: SeCreatePagefilePrivilege 2472 chrome.exe Token: SeShutdownPrivilege 2472 chrome.exe Token: SeCreatePagefilePrivilege 2472 chrome.exe Token: SeShutdownPrivilege 2472 chrome.exe Token: SeCreatePagefilePrivilege 2472 chrome.exe Token: SeShutdownPrivilege 2472 chrome.exe Token: SeCreatePagefilePrivilege 2472 chrome.exe Token: SeShutdownPrivilege 2472 chrome.exe Token: SeCreatePagefilePrivilege 2472 chrome.exe Token: SeShutdownPrivilege 2472 chrome.exe Token: SeCreatePagefilePrivilege 2472 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2472 wrote to memory of 824 2472 chrome.exe 88 PID 2472 wrote to memory of 1632 2472 chrome.exe 89 PID 2472 wrote to memory of 1632 2472 chrome.exe 89 PID 2472 wrote to memory of 2292 2472 chrome.exe 90 PID 2472 wrote to memory of 2776 2472 chrome.exe 91 PID 2472 wrote to memory of 2776 2472 chrome.exe 91 PID 2472 wrote to memory of 5056 2472 chrome.exe 92 PID 2472 wrote to memory of 1596 2472 chrome.exe 93 PID 2472 wrote to memory of 5056 2472 chrome.exe 92 PID 2472 wrote to memory of 1596 2472 chrome.exe 93 PID 2472 wrote to memory of 3192 2472 chrome.exe 95 PID 2472 wrote to memory of 3192 2472 chrome.exe 95 PID 2472 wrote to memory of 4856 2472 chrome.exe 101
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://go.lumel.com/e/1105351/automation-utm-medium-campaign/6kkvqz/1110372350/h/fvuVBnKJs0CFp2gZjl7O6wvCwGmkoOlqW1_LiUwoXtY1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffe591c728,0x7fffe591c734,0x7fffe591c7402⤵PID:824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,8354095407689707275,3723725259681159866,262144 --field-trial-handle=2004,i,16394224397321087701,16722080384401322088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2000 /prefetch:22⤵PID:1632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,9561671261914678562,15270611195985136615,524288 --field-trial-handle=2004,i,16394224397321087701,16722080384401322088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2240 /prefetch:32⤵
- System Time Discovery
PID:2292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,18303523008252594408,15441089419573736655,524288 --field-trial-handle=2004,i,16394224397321087701,16722080384401322088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2500 /prefetch:82⤵PID:2776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,70826459546743673,4713965238018879800,2097152 --field-trial-handle=2004,i,16394224397321087701,16722080384401322088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:5056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,8871687993737976385,11516857934704560678,2097152 --field-trial-handle=2004,i,16394224397321087701,16722080384401322088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:1596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4392,i,11228014530752887721,18306060700653694932,2097152 --field-trial-handle=2004,i,16394224397321087701,16722080384401322088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3824 /prefetch:22⤵PID:3192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,15370544940293076882,12691252561988159513,524288 --field-trial-handle=2004,i,16394224397321087701,16722080384401322088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5436 /prefetch:82⤵PID:4856
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4728
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2888
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 6f790603b18f87014cba7465ef85e6bd8538b381aed7c594835b670f65c65506
- MD5 9e3c1599c53f019ba7208f4d76433d26
- SHA1 1fee21c18ccce1ec4bbf62f5135d64b66b5464f9
- SHA512 e7d1edb91cab3025916c6d244b0a176667b71b51a8a05c65dd9c7eb0c51ff758c89f8608ac95ec655b7d03d2f4cb40b43e0f492a6470d48c727e5a1f3af85716
- TLSH T1D8E02BBAC920DD2B08FE472D38580647E65423173B52855B3A3DC20D8FB9636199BC2C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\7014adf0-4d29-4cf0-aac1-a261311d1a55.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 ef88c32c8bc7407faf1076bcf75e6efc58d3e6ebb7bc42fd4845e5a28837a2aa
- MD5 f880f732f796ac26caf40c20b8cb0c57
- SHA1 1c3ec3fbacef72176f1a712af961c6128bbcc81d
- SHA512 fef2a5a79fd602960a75175bd62088bbeb753529ddbe029d3740b5f56417d0c8d794ca22d522c61b044082e04504ce04ba9c44e452f6cde73a338e741cad75f8
- SSDEEP 384:wR1Pg4E0b5DQUXv27wnFXj/2oBJ2Uface:UPg4E0b5sy27wpjuob2V1
- TLSH T1EF42C82FAA14357BADD7D319F9217713D7F5106625942E84EAFC8A2C14E79CC322702B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
- MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
- SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
- SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
- SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
- TLSH T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 c1e662007b2714e2d820383524b194b5f8faa8f51e14b044b7abf49e24c68b0f
- MD5 a3341efd99f2d12eb778d03180e6a062
- SHA1 9966f985ceaaab61d17b01c73e2c4e3677a25463
- SHA512 7001caeec365a39f452e7510b7ebecdb1e49e09ad0f5279d8686d65b11d9019235de25daa397063e4921b8201160e63f2280e9d794c42361b7a6a5a9d403ceee
- SSDEEP 1536:TvQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:uqfd7NtZL8cHQRZEQ6Spsk
- TLSH T19FC30237DBC21F339D96CB60B9530FD697B644A59034D301EA6D77AF6C8389174428AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 2fb45e8b258119d298353c3c95ed91bfeb20a348b782a1f97f35bce66a3cece6
- MD5 0ef01087aaadd41b0175f7408a935a6a
- SHA1 a40edbb85472877c2a5966894a2f79d466556371
- SHA512 bde26b942ea8556d58309af3a19f5eb02067aed7e3d242c8d8374982d63b48f74d86425f24861e92d8618b1e0b86f2069bdcf6703799747021bc64da16af4091
- SSDEEP 1536:zAHx+yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICP:IEqfd7NtZL8cHQRZEQ6Spsk
- TLSH T1C9C30237ABC61E335ED2CB70B9230ED797B544A99034D301EA6D3BEB688389175424AC
- MD5 SHA1 SHA512 SSDEEP TLSH