Analysis
- user interaction
yes - max time kernel
26s - max time network
27s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 07:34
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://click.mail.tnt.com/?qs=ABB7InYiOjEsImQiOjQ5MzN9AAcAAAAAA8iYZkkNE5sPV5y5NoquBIPiCfNMZI7Tl9CICE_mB7OHIexqDSXaQSN0xys1bkSDn8p3wA5lO1lGraghObhH9bDgTuGMM7LdW9e7hFgxcA
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target http://click.mail.tnt.com/?qs=ABB7InYiOjEsImQiOjQ5MzN9AAcAAAAAA8iYZkkNE5sPV5y5NoquBIPiCfNMZI7Tl9CICE_mB7OHIexqDSXaQSN0xys1bkSDn8p3wA5lO1lGraghObhH9bDgTuGMM7LdW9e7hFgxcA
- Sample260802-jebtcaep9x
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2204 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301297020547318" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3676 chrome.exe 3676 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe - Suspicious use of AdjustPrivilegeToken 52 IoCs
description pid Process Token: SeShutdownPrivilege 3676 chrome.exe Token: SeCreatePagefilePrivilege 3676 chrome.exe Token: SeShutdownPrivilege 3676 chrome.exe Token: SeCreatePagefilePrivilege 3676 chrome.exe Token: SeShutdownPrivilege 3676 chrome.exe Token: SeCreatePagefilePrivilege 3676 chrome.exe Token: SeShutdownPrivilege 3676 chrome.exe Token: SeCreatePagefilePrivilege 3676 chrome.exe Token: SeShutdownPrivilege 3676 chrome.exe Token: SeCreatePagefilePrivilege 3676 chrome.exe Token: SeShutdownPrivilege 3676 chrome.exe Token: SeCreatePagefilePrivilege 3676 chrome.exe Token: SeShutdownPrivilege 3676 chrome.exe Token: SeCreatePagefilePrivilege 3676 chrome.exe Token: SeShutdownPrivilege 3676 chrome.exe Token: SeCreatePagefilePrivilege 3676 chrome.exe Token: SeShutdownPrivilege 3676 chrome.exe Token: SeCreatePagefilePrivilege 3676 chrome.exe Token: SeShutdownPrivilege 3676 chrome.exe Token: SeCreatePagefilePrivilege 3676 chrome.exe Token: SeShutdownPrivilege 3676 chrome.exe Token: SeCreatePagefilePrivilege 3676 chrome.exe Token: SeShutdownPrivilege 3676 chrome.exe Token: SeCreatePagefilePrivilege 3676 chrome.exe Token: SeShutdownPrivilege 3676 chrome.exe Token: SeCreatePagefilePrivilege 3676 chrome.exe Token: SeShutdownPrivilege 3676 chrome.exe Token: SeCreatePagefilePrivilege 3676 chrome.exe Token: SeShutdownPrivilege 3676 chrome.exe Token: SeCreatePagefilePrivilege 3676 chrome.exe Token: SeShutdownPrivilege 3676 chrome.exe Token: SeCreatePagefilePrivilege 3676 chrome.exe Token: SeShutdownPrivilege 3676 chrome.exe Token: SeCreatePagefilePrivilege 3676 chrome.exe Token: SeShutdownPrivilege 3676 chrome.exe Token: SeCreatePagefilePrivilege 3676 chrome.exe Token: SeShutdownPrivilege 3676 chrome.exe Token: SeCreatePagefilePrivilege 3676 chrome.exe Token: SeShutdownPrivilege 3676 chrome.exe Token: SeCreatePagefilePrivilege 3676 chrome.exe Token: SeShutdownPrivilege 3676 chrome.exe Token: SeCreatePagefilePrivilege 3676 chrome.exe Token: SeShutdownPrivilege 3676 chrome.exe Token: SeCreatePagefilePrivilege 3676 chrome.exe Token: SeShutdownPrivilege 3676 chrome.exe Token: SeCreatePagefilePrivilege 3676 chrome.exe Token: SeShutdownPrivilege 3676 chrome.exe Token: SeCreatePagefilePrivilege 3676 chrome.exe Token: SeShutdownPrivilege 3676 chrome.exe Token: SeCreatePagefilePrivilege 3676 chrome.exe Token: SeShutdownPrivilege 3676 chrome.exe Token: SeCreatePagefilePrivilege 3676 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe 3676 chrome.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3676 wrote to memory of 2668 3676 chrome.exe 87 PID 3676 wrote to memory of 4804 3676 chrome.exe 88 PID 3676 wrote to memory of 4804 3676 chrome.exe 88 PID 3676 wrote to memory of 2204 3676 chrome.exe 89 PID 3676 wrote to memory of 1368 3676 chrome.exe 90 PID 3676 wrote to memory of 1368 3676 chrome.exe 90 PID 3676 wrote to memory of 3232 3676 chrome.exe 92 PID 3676 wrote to memory of 596 3676 chrome.exe 93 PID 3676 wrote to memory of 3232 3676 chrome.exe 92 PID 3676 wrote to memory of 596 3676 chrome.exe 93 PID 3676 wrote to memory of 3692 3676 chrome.exe 94 PID 3676 wrote to memory of 3692 3676 chrome.exe 94 PID 3676 wrote to memory of 1756 3676 chrome.exe 95 PID 3676 wrote to memory of 1756 3676 chrome.exe 95 PID 3676 wrote to memory of 4636 3676 chrome.exe 104
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://click.mail.tnt.com/?qs=ABB7InYiOjEsImQiOjQ5MzN9AAcAAAAAA8iYZkkNE5sPV5y5NoquBIPiCfNMZI7Tl9CICE_mB7OHIexqDSXaQSN0xys1bkSDn8p3wA5lO1lGraghObhH9bDgTuGMM7LdW9e7hFgxcA1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0x7c,0x104,0x7ff92d24c728,0x7ff92d24c734,0x7ff92d24c7402⤵PID:2668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,17785559325259063948,10259139785441701880,262144 --field-trial-handle=1988,i,1828878833255129017,16329954831824833859,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1984 /prefetch:22⤵PID:4804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1572,i,14620991361466364699,15886842273521438440,524288 --field-trial-handle=1988,i,1828878833255129017,16329954831824833859,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2196 /prefetch:32⤵
- System Time Discovery
PID:2204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,15696672642633897197,4230569042159419391,524288 --field-trial-handle=1988,i,1828878833255129017,16329954831824833859,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2568 /prefetch:82⤵PID:1368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3112,i,16805637262402604831,12313162375917348725,2097152 --field-trial-handle=1988,i,1828878833255129017,16329954831824833859,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3140 /prefetch:12⤵PID:3232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3136,i,12526205376828204562,10420285308386476017,2097152 --field-trial-handle=1988,i,1828878833255129017,16329954831824833859,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4416,i,10164372683750253640,12352737609463717093,2097152 --field-trial-handle=1988,i,1828878833255129017,16329954831824833859,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4428 /prefetch:22⤵PID:3692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4644,i,6527571375294471510,15913728885016539254,2097152 --field-trial-handle=1988,i,1828878833255129017,16329954831824833859,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4684 /prefetch:12⤵PID:1756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,3711707189878270319,520971619364158609,524288 --field-trial-handle=1988,i,1828878833255129017,16329954831824833859,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5624 /prefetch:82⤵PID:4636
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1704
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1704
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\06ae9075-90b9-4999-81ec-abb704dc92e3.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 9c17737b9e70e897d43509b66175edc58ae9f5bbf1a3fe212a247115838dc91e
- MD5 06ae09b440d3b38565c51550cb40673b
- SHA1 79cb4a23242166b83d252a1437e2f30143020997
- SHA512 d2ed6ddd0c21f8fe9e657c34905fc4df0bec1d612a5c534d3d53996b693de67e6738acda08cdc58f665a6df6cbcb275586ab774f8f9f3faff898767e5fc1e3b9
- SSDEEP 192:4RGvbDF/4senvIv7cpAPRp2q1G9BHsb+WNnks6MV23yK0kwX0VyIsnAUge:4RUVQsKUwUXl8rwJ32iZ3we
- TLSH T1C642D62EAD10297B8CDAD229F9657B53E7F5102225942EC4EAFC893C19E76DC321701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
- MD5 248039e3512518ae98cef47428956f17
- SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
- SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
- SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
- TLSH T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 d422bc68cf5ad19bed421037bf763f89aacd002f22866515e820cb4c629d6294
- MD5 020ae46521dbed1d04663fc24b7a441a
- SHA1 aa488522feda309220f3d665761bb6944749d116
- SHA512 bd29a72cd01ff212d1d0b241575773c31d1daf8fc09520d3926b47b861e3e2095282c099b5a2f4a0972ccc6d2cf5d0a225b71cff8552759b5374bde69a878e05
- TLSH T157B0128480015102CC1602F4125B148C7114DF35DA0A5B0643E069628C371519424570
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58870d.TMP
- Size 96B
- SHA256 aa762e809e62556367aae336bca05cd85e3b17668e7b16a162fa8c5cef13912f
- MD5 9648a5eaf306e0c034794641aed76b38
- SHA1 369459afcf6fbe07b4a0d53bae4301213fa3b472
- SHA512 4ba02c041009054c3c7007778aa723b3937a2dff2d317572129c9a190dc81fd26af8f9be6d7fa1c7812c5e4efe56c3d0516dfa2f046d9626f0c18a6b429840ce
- TLSH T1ADB002E5C102A232D08703B42996E6D97368DF3ED7032216A6E21BE6DC26660452E970
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 7201aea4fe78562e5559920622b039cf391eb0dac9ae783ff0715a50a17f408a
- MD5 ed03bb2bf1cb1626661f4dead9aa1ecf
- SHA1 a8212d5016b5a8b9ad6bd470aaccad2b3a3e3f88
- SHA512 06da2374085cc053506c24a664e1ff58944f26e93708037b0f7628090d606b7e6e4b6998fcd2239883dfeb3e3bd6b752c2ded7b28482058601ce54410a741a2a
- SSDEEP 3072:SGFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:7FmUi21rSm8uUVNSlzY/
- TLSH T1FCC3130076E3F8F2EE5930447BEE2A145D6C0D818191C6415673AD419DEF3C71FAAB39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 b2fa7c30bb1608086adaa38b4d41615363c976fad9dc4c6bb2885a9a9c041a60
- MD5 854e38222f997fe597bc8efa43e70c89
- SHA1 0bfbdb3041c6079e8239bb5d9f150ac15ce7886e
- SHA512 9455e69f02f21768e78abdd1308782dc7cf2946ce7bf2ebdf44aae0c00eab05191717f12f73fadadbebc770ded25590eccf2b77882401b9c40d52e4e3ad7ef00
- SSDEEP 3072:SRFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:8FmUi21rSm8uUVNSlzY/
- TLSH T1D1C313107AA7F8B2EE9930447AEE2A158D6C0D818191C64157739D419DEF3C62FABB38
- MD5 SHA1 SHA512 SSDEEP TLSH