hxxps://www[.]emea01safelinks-protection-documents-clixsign[.]pro/

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
17s
max time network
13s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/07/2026, 04:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.emea01safelinks-protection-documents-clixsign.pro/
Sample260705-epp2hac12q

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
556	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134276980482686061"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3344	chrome.exe
3344	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 4716	3344	chrome.exe	80
PID 3344 wrote to memory of 556	3344	chrome.exe	81
PID 3344 wrote to memory of 4804	3344	chrome.exe	82
PID 3344 wrote to memory of 4804	3344	chrome.exe	82
PID 3344 wrote to memory of 2472	3344	chrome.exe	84
PID 3344 wrote to memory of 2472	3344	chrome.exe	84
PID 3344 wrote to memory of 4076	3344	chrome.exe	85
PID 3344 wrote to memory of 4468	3344	chrome.exe	86
PID 3344 wrote to memory of 4076	3344	chrome.exe	85
PID 3344 wrote to memory of 4468	3344	chrome.exe	86
PID 3344 wrote to memory of 1876	3344	chrome.exe	87
PID 3344 wrote to memory of 1876	3344	chrome.exe	87
PID 3344 wrote to memory of 1080	3344	chrome.exe	89
PID 3344 wrote to memory of 1080	3344	chrome.exe	89
PID 3344 wrote to memory of 2264	3344	chrome.exe	90

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.emea01safelinks-protection-documents-clixsign.pro/
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffffbc6c728,0x7ffffbc6c734,0x7ffffbc6c740
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1988,i,7481880492821443799,12079035414189394672,524288 --field-trial-handle=2056,i,17864313488846052398,10787902337439405198,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2084 /prefetch:11
  2⤵
  - System Time Discovery
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,9597581469439732119,10907693980194498549,262144 --field-trial-handle=2056,i,17864313488846052398,10787902337439405198,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,8357411572057670266,11804019137887973308,524288 --field-trial-handle=2056,i,17864313488846052398,10787902337439405198,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2364 /prefetch:13
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3120,i,8692043174115858911,3436912527978683471,2097152 --field-trial-handle=2056,i,17864313488846052398,10787902337439405198,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3124,i,2063723467197766773,1610939535347034979,2097152 --field-trial-handle=2056,i,17864313488846052398,10787902337439405198,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4284,i,18421653862555991064,17769561072051991649,2097152 --field-trial-handle=2056,i,17864313488846052398,10787902337439405198,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4300 /prefetch:9
  2⤵
  PID:1876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4272,i,520375216979874750,14057581694839447176,2097152 --field-trial-handle=2056,i,17864313488846052398,10787902337439405198,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5604,i,10809658279866385487,15408525936066131297,524288 --field-trial-handle=2056,i,17864313488846052398,10787902337439405198,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5588 /prefetch:14
  2⤵
  PID:2264

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 211951993c78774f220e1b18c017ae079bac0c9cd3463f64e80cf362ccc939b7
MD5 cb6891952420bff33118322a97f52260
SHA1 bddd4db5f4465967345fccf1db60148b87eb049a
SHA512 1872e1338afeeedf740f57d12067ea252ddc59d3941e1fb646058ff29628c4d0ccefdf679d1ea2a7622ab3401d2cdec24f60f2750aa76611899f5d83e2f9a3ba
TLSH
T1EBE02BBAC911DC6B2DFE475894154749D60503473B414D5B373E920CCFB17374591C6C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 019f1e6a38bae07969aa10fa7b8be2884938ce349d6bd85399671804cc87f703
MD5 c8936e9ef357978c21a861a20abd6ab4
SHA1 6b5b5826d84dada5d27e700c433a7cc02e701a67
SHA512 c49f0cdb0c6d76dafd3c78334601e37f7155c475a4d14b04a61cfe7a603e80daecadb7f6bfb56a7a7d6826f1cf134ab051344cb2a43d5c9743d8e08ad9c6facf
SSDEEP 192:qRxB5I2jNoesv7lpAPRp2Nsglwnglz9+Hsb+WNQW5mPy38Y2pJ2G/kwO+VyIsnAC:qRxBO2jp4RUX40wyo2P2G/u2e
TLSH
T15B52C77AFE20697B6CCBC229FA217753D7F5102525912E84EAFCCA2C15E79CC211741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c48ea4851d93573421a1f5e92dfdd9c0cc0bbeca9216e615794ab2013501d5f1
MD5 9365e110646fce4577746230e9396c69
SHA1 43e90a5f0d59e1baf6618dc088b25f7ee4f34390
SHA512 9a5685ed76a706c9438a8141f54d0da5f900ed9164cb7aba717892a4e4661ae16db249ed13fc8eb242bd0321b328b8cf3e2f2ff69067bbe412ad1a880371f8d4
SSDEEP 384:RXjVs7KxkXqKf/pUZNCgVLH2Hfgsl++M9r7pLuLcSjzOXODV0+ErU3O3MDTHGRjs:RzVs7KxkXqKf/pUZNCgVLH2Hfgs8+M9k
TLSH
T1A97209A76C4C8E7B0F94C6CCD8267B4FADB5024B55D9C86483FA582903D5BCB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 44bccefe2fc1b1150635b55c6855b70582042ca9ac9a96bd65b46f4f27c32974
MD5 70f11d9a9d27195c7301733b9f3f9ae4
SHA1 9faa0d75d1301ff9c6328d7113e85f3e95fada24
SHA512 5aa019318dddf6bc269d735cbf46117b42b03817456711882938d5a8308bc1e00b97c1cff73ad21a15de9b20dfb7013a3c4623beeaeec29ec98811061c46d3a7
SSDEEP 3072:MGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:/m7Rkm1tYpBeh2BAoa
TLSH
T1B9C312375E71A97759B9BB4EB08E0B1E1EF14DA2D920DE42C8D85B0437F97CD0A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 5d9a674f7506d890c87eb074b7259bba0cc5bd9777bb55d27897806228fd40bd
MD5 b6098af574084460ab8d65b5f6e32d57
SHA1 44b41e4a91337d926ec02af7c6e95bff692526c5
SHA512 55ac4934ef735de97c25f50796a397a5ee6eaade75c9df6d061aed6573374497f9308d81577b0c6e68bed5f865b99fa65eecdac6a6128858b89195b56876c32c
SSDEEP 3072:kGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:Hm7Rkm1tYpBeh2BAoa
TLSH
T13DC312375D74E97759B9B75EB08E0B1F1EF14AA3D920DE82C8D85B0423EA7CD0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download