Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/08/2026, 14:04

General

  • Target
    Cracked.exe
  • Size 47KB
  • Sample260802-rdbe7abb26
  • SHA256 d0e1c3a7ece331422feadc135278119dd582b695f21c8d95374b3851eed600e8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Cracked.exe
    "C:\Users\Admin\AppData\Local\Temp\Cracked.exe"
    1⤵
      PID:5500
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4356
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffed6a3c728,0x7ffed6a3c734,0x7ffed6a3c740
        2⤵
          PID:2164
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2064,i,3258652790906258305,15881151736980960051,524288 --field-trial-handle=1996,i,6322107407303971153,13498981291409306698,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2136 /prefetch:11
          2⤵
          • System Time Discovery
          PID:6028
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,8533245114749941205,9500581352943967890,262144 --field-trial-handle=1996,i,6322107407303971153,13498981291409306698,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1992 /prefetch:2
          2⤵
            PID:5512
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,2432723592792609535,12926173331983832226,524288 --field-trial-handle=1996,i,6322107407303971153,13498981291409306698,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2416 /prefetch:13
            2⤵
              PID:6052
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,6745454698778910675,5370060856942319640,2097152 --field-trial-handle=1996,i,6322107407303971153,13498981291409306698,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3488 /prefetch:1
              2⤵
                PID:396
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,5026128068983689007,17986830566168125800,2097152 --field-trial-handle=1996,i,6322107407303971153,13498981291409306698,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3524 /prefetch:1
                2⤵
                  PID:1492
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4368,i,3009917039867467259,12616264273909525919,2097152 --field-trial-handle=1996,i,6322107407303971153,13498981291409306698,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4388 /prefetch:9
                  2⤵
                    PID:2036
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4828,i,4648897723482604858,235077192012971859,2097152 --field-trial-handle=1996,i,6322107407303971153,13498981291409306698,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4844 /prefetch:1
                    2⤵
                      PID:4868
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,6404466654933044780,15951566764156985810,524288 --field-trial-handle=1996,i,6322107407303971153,13498981291409306698,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:14
                      2⤵
                        PID:4140
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5856,i,3180913036330303528,13692615223471337055,524288 --field-trial-handle=1996,i,6322107407303971153,13498981291409306698,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5852 /prefetch:14
                        2⤵
                          PID:1632
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,3123761033067272924,13233659272245494569,524288 --field-trial-handle=1996,i,6322107407303971153,13498981291409306698,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5740 /prefetch:14
                          2⤵
                            PID:5320
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5576,i,7992651259231223506,1840782511149396564,524288 --field-trial-handle=1996,i,6322107407303971153,13498981291409306698,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5768 /prefetch:14
                            2⤵
                              PID:740
                          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                            1⤵
                              PID:432
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                              1⤵
                                PID:2184

                              Network

                                    MITRE ATT&CK Enterprise v16

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    7c1258ec-0818-4dc4-b662-5884c54adb4e.tmp

                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7c1258ec-0818-4dc4-b662-5884c54adb4e.tmp
                                    • Size 414B
                                    • SHA256 d09cfc343456955870ddb4dc320640a039d0b0715082683d332548131dfae6e0
                                    • MD5 SHA1 SHA512 TLSH

                                    BookmarkMergedSurfaceOrdering

                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                    • Size 6B
                                    • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                    • MD5 SHA1 SHA512

                                    SCT Auditing Pending Reports

                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                    • Size 2B
                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                    • MD5 SHA1 SHA512

                                    Preferences

                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                    • Size 12KB
                                    • SHA256 f5c05d9c0d1d3a388f94a558ba0b6c01ceb76456b62614fc3683ef158dad78d1
                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                    Preferences

                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                    • Size 12KB
                                    • SHA256 965e7517370e4a942e09a7ff973c1bec66b366f237e8e546cefdcf73d33a1727
                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                    Preferences

                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                    • Size 12KB
                                    • SHA256 b7316ca0fe49d706d6c773854575c87757dfd37850603d68643b775fc866ac22
                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                    Secure Preferences

                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                    • Size 17KB
                                    • SHA256 31a5ce04ae67b5403f3453ceb77ece590798531384f472283d145995727d92f5
                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                    the-real-index

                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                    • Size 120B
                                    • SHA256 ef7f540cfe421b5fb5d1d760b0eb36353cf35651604827bc051e1efec5a50f21
                                    • MD5 SHA1 SHA512 TLSH

                                    the-real-index~RFe59aaec.TMP

                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59aaec.TMP
                                    • Size 96B
                                    • SHA256 2e3bf58473a528a356558df9c7cabc5f13358e3b71896da214052c34dba00dcf
                                    • MD5 SHA1 SHA512 TLSH

                                    Local State

                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                    • Size 236KB
                                    • SHA256 5edcde537175182ba38725eda454b5e35111538f75fcb26e53d679040ad681db
                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                    Local State

                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                    • Size 235KB
                                    • SHA256 e3737222d91083d966e9dc59fd8f1eb28332dda1b6886d7dbd13a3581124035b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                    Local State

                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                    • Size 236KB
                                    • SHA256 b3f8efa97df984bfdd5cfcebaf7981b823cdd2e9fa848ffc28f128c36d5845de
                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                    Local State

                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                    • Size 115KB
                                    • SHA256 2f6fd05694f9f6ec92f857123721c2ce80e7659ceb567526bdfeb5424f764e2c
                                    • MD5 SHA1 SHA512 SSDEEP TLSH