Analysis
- user interaction
yes - max time kernel
28s - max time network
29s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
03/08/2026, 15:12
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.greenweaver.co.uk
Resource
win11-20260513-en
11 signatures
300 seconds
General
- Target http://www.greenweaver.co.uk
- Sample260803-sllfssserd
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3332 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302435856482131" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3624 chrome.exe 3624 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe - Suspicious use of AdjustPrivilegeToken 54 IoCs
description pid Process Token: SeShutdownPrivilege 3624 chrome.exe Token: SeCreatePagefilePrivilege 3624 chrome.exe Token: SeShutdownPrivilege 3624 chrome.exe Token: SeCreatePagefilePrivilege 3624 chrome.exe Token: SeShutdownPrivilege 3624 chrome.exe Token: SeCreatePagefilePrivilege 3624 chrome.exe Token: SeShutdownPrivilege 3624 chrome.exe Token: SeCreatePagefilePrivilege 3624 chrome.exe Token: SeShutdownPrivilege 3624 chrome.exe Token: SeCreatePagefilePrivilege 3624 chrome.exe Token: SeShutdownPrivilege 3624 chrome.exe Token: SeCreatePagefilePrivilege 3624 chrome.exe Token: SeShutdownPrivilege 3624 chrome.exe Token: SeCreatePagefilePrivilege 3624 chrome.exe Token: SeShutdownPrivilege 3624 chrome.exe Token: SeCreatePagefilePrivilege 3624 chrome.exe Token: SeShutdownPrivilege 3624 chrome.exe Token: SeCreatePagefilePrivilege 3624 chrome.exe Token: SeShutdownPrivilege 3624 chrome.exe Token: SeCreatePagefilePrivilege 3624 chrome.exe Token: SeShutdownPrivilege 3624 chrome.exe Token: SeCreatePagefilePrivilege 3624 chrome.exe Token: SeShutdownPrivilege 3624 chrome.exe Token: SeCreatePagefilePrivilege 3624 chrome.exe Token: SeShutdownPrivilege 3624 chrome.exe Token: SeCreatePagefilePrivilege 3624 chrome.exe Token: SeShutdownPrivilege 3624 chrome.exe Token: SeCreatePagefilePrivilege 3624 chrome.exe Token: SeShutdownPrivilege 3624 chrome.exe Token: SeCreatePagefilePrivilege 3624 chrome.exe Token: SeShutdownPrivilege 3624 chrome.exe Token: SeCreatePagefilePrivilege 3624 chrome.exe Token: SeShutdownPrivilege 3624 chrome.exe Token: SeCreatePagefilePrivilege 3624 chrome.exe Token: SeShutdownPrivilege 3624 chrome.exe Token: SeCreatePagefilePrivilege 3624 chrome.exe Token: SeShutdownPrivilege 3624 chrome.exe Token: SeCreatePagefilePrivilege 3624 chrome.exe Token: SeShutdownPrivilege 3624 chrome.exe Token: SeCreatePagefilePrivilege 3624 chrome.exe Token: SeShutdownPrivilege 3624 chrome.exe Token: SeCreatePagefilePrivilege 3624 chrome.exe Token: SeShutdownPrivilege 3624 chrome.exe Token: SeCreatePagefilePrivilege 3624 chrome.exe Token: SeShutdownPrivilege 3624 chrome.exe Token: SeCreatePagefilePrivilege 3624 chrome.exe Token: SeShutdownPrivilege 3624 chrome.exe Token: SeCreatePagefilePrivilege 3624 chrome.exe Token: SeShutdownPrivilege 3624 chrome.exe Token: SeCreatePagefilePrivilege 3624 chrome.exe Token: SeShutdownPrivilege 3624 chrome.exe Token: SeCreatePagefilePrivilege 3624 chrome.exe Token: SeShutdownPrivilege 3624 chrome.exe Token: SeCreatePagefilePrivilege 3624 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3624 wrote to memory of 4576 3624 chrome.exe 81 PID 3624 wrote to memory of 3240 3624 chrome.exe 82 PID 3624 wrote to memory of 3240 3624 chrome.exe 82 PID 3624 wrote to memory of 3332 3624 chrome.exe 83 PID 3624 wrote to memory of 2156 3624 chrome.exe 85 PID 3624 wrote to memory of 2156 3624 chrome.exe 85 PID 3624 wrote to memory of 4992 3624 chrome.exe 86 PID 3624 wrote to memory of 4992 3624 chrome.exe 86 PID 3624 wrote to memory of 1720 3624 chrome.exe 87 PID 3624 wrote to memory of 1720 3624 chrome.exe 87 PID 3624 wrote to memory of 3980 3624 chrome.exe 88 PID 3624 wrote to memory of 3980 3624 chrome.exe 88 PID 3624 wrote to memory of 1928 3624 chrome.exe 90 PID 3624 wrote to memory of 1928 3624 chrome.exe 90 PID 3624 wrote to memory of 2472 3624 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.greenweaver.co.uk1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1d42c728,0x7ffa1d42c734,0x7ffa1d42c7402⤵PID:4576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1580,i,883032657530163752,8870183934922820141,262144 --field-trial-handle=1940,i,1815106714151063056,10795123139699273238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1928 /prefetch:22⤵PID:3240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2244,i,7477739456980343094,5021659044060742076,524288 --field-trial-handle=1940,i,1815106714151063056,10795123139699273238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2236 /prefetch:112⤵
- System Time Discovery
PID:3332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,3725829504020611256,10102909398471206397,524288 --field-trial-handle=1940,i,1815106714151063056,10795123139699273238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2764 /prefetch:132⤵PID:2156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,8281776286097024614,4239109993745534379,2097152 --field-trial-handle=1940,i,1815106714151063056,10795123139699273238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3144,i,13072527265645702929,14534841431329940180,2097152 --field-trial-handle=1940,i,1815106714151063056,10795123139699273238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:1720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4284,i,78894291438909303,16088424632067092040,2097152 --field-trial-handle=1940,i,1815106714151063056,10795123139699273238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4304 /prefetch:92⤵PID:3980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,16892735010999068149,13795970589385966857,2097152 --field-trial-handle=1940,i,1815106714151063056,10795123139699273238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4708 /prefetch:12⤵PID:1928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5380,i,7983906388468502591,14121403402263613696,524288 --field-trial-handle=1940,i,1815106714151063056,10795123139699273238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5388 /prefetch:142⤵PID:2472
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4032
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1404
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 532746fb099352d67c2492e3fee2bce53c44c14d04884076018528ba45b474e7
- MD5 85ced6cf7cfa50f71b40971892bc56c9
- SHA1 9068fe3168cc27cbed1fa818f6b377d9fd95cbf3
- SHA512 21eab7b63f80855f344380628a0aadeee5520de55f5a68faab129c2f86a528d5fba6e0c64598ed0db4588e2f68576af9af9e81457e866bf095757121061bc38a
- TLSH T180E022BAD831EC3708FD4B58A0544786EB14039B2B85858F3A3C91098FB063A42A6E2C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 120B
- SHA256 c3c640e178171085a114b2f9f434c3e1297aee06986ba49061b76237475f041a
- MD5 71e46cc71c1d29ade0edc08f1bc70759
- SHA1 de84c14a6a45044234d4cc0185aa61b0ed9d327f
- SHA512 31f5c7b782e14b839bed62f33740ca7bf0b7fd20e84eb7828943f19d88ee7b71deec2de75dde73c0b3568dfad88776aefb773eadcfb3ab5eeb6c8bf23a4116af
- TLSH T1FAB012300CC1C000EF440B331B031C5452641BBBCE21F31350EE80845C3B1F451828A1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 f39b7aad4080a29707fb2a8548bde1b766aec05f76074e66e19eb19f0d7b8405
- MD5 becc595db8cdb63dee5e5d9587cdb8b0
- SHA1 df8c7339bcfc791d2736d93abe4d76c9c624bfd6
- SHA512 8f5291a24eb715cd495f2fff5c90b2d102900d9e1b71af023824f76dd09d422d684220cad78754d2a14df1e547641181bc37c60f152c04e32ec66f14cb02453e
- SSDEEP 192:RRFxv7X4N/Yv7H+pAPRp2e1U9WHsb+WNn3WiSA29T2+/EeQ4NVyIsnAUge:RRFJeEiUX/KUwmg2l2+/C4be
- TLSH T12F42C63AB950657B9CDFD329FA61BB63E7F6106220951E80E6FC892C11E75CC221742F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 a487a90aa586ffb722bc45a76d1e954f5a6f5ff4286551d2445a524e0f1cc25d
- MD5 a6b03dd39d632b77a2b691136935ce1e
- SHA1 660afa8fb43d4f28bf93dfee7ad6659850a1dd80
- SHA512 fd42fd771a90c2ac5460f1c04885199c7f6c1ae3796cb236a749714522d06dac63689becd9a9f638977639774ddf2dbbc07689355940492b636644edffad801d
- SSDEEP 384:6kj+F7KxkXqKf/pUZNCgVLH2HfgslzO7pLuLcSjsNXOD+F+ErU3JbHGvYKD0S:6o+F7KxkXqKf/pUZNCgVLH2HfgsJO7pT
- TLSH T15F72F867684C9E370FD4CACCED167A4FADB5024B65E9886443FA582503D5ACF110A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 3dc12d59cb453a31cab357e39af9f3ae2bdc3408cbac678d61ce1ab0d829a6e4
- MD5 afd06cd01671b461712e6b3c010b1902
- SHA1 55d3c4a666fc10d78ad20bc6bfc635de778d84a3
- SHA512 a010e5a96ac71c317a8aca31d7642124eabfeb791896b158e388612220ed1a08c6594a844390bc2e066fed920d1709336505b123649d3bb2d6946a07ffc4197c
- TLSH T139B01220C001D107C88602B0114714C8B1145F10A70B270543E07D22DC3916284141D3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589073.TMP
- Size 96B
- SHA256 06c996c733047a4cf5b1d45c754fb9950adec2d58eceb3da12e922ababc0e554
- MD5 1e9201c951be3684737180581e67967f
- SHA1 7d66a4a4ea5eb3e3a0cabd6f68f4b9e99829e1f4
- SHA512 b85760855593fdc5693dbf089f03e9fc2532e8c8540cf2b633cc1998f1a0080439585423f619c4df0b41c5d5b9b76fe84d6d3ea225a678361b2429bd3ae879ee
- TLSH T143B00279C216A216C0528BF025DFA5D87160FF35CA43322693E01AF6DD2D6724535161
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 d0bc9abfeb4ad8c11a4abb8a3c21efaa110fb6baeafd1bcdb27357549463ec1e
- MD5 0822f2589a745c5fbf49fe9ee2eccdcd
- SHA1 ba476a3310a9af5180c098644fa426b83d4d846f
- SHA512 c268bce4ca71630c0e75e7979759a415dfed998b987e46ad7d4a4567956df36f65a28694cbf1bf7620d86af3d9012427b1a47007a2614a2ffd26d73f3ce8afe0
- SSDEEP 3072:gdzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:mWDfxA3OnjrYQ9EU0/hEV
- TLSH T1CFC302A11C3ABD760DF8EE98640D3A60BFF4AC9A91875DD392ED2F4C14FA5C81179930
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 1ba738f8e0f2648a2fa9cc84c5af8de8f1334d3acd9cbe6ef3943ee05666a2da
- MD5 fef0e274d0da562d9eee42fd75f9163d
- SHA1 f93d631d666b62382a77e7c32a1e79154b79d612
- SHA512 65727728ab1b8943af6f905513bda64e31edeeb5fed42d22bdff2a24196056d80e3ec943a5f4416abb005a9d9cfa4d14e51e6c82d9c211620183ebd8297e9fe4
- SSDEEP 3072:TzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:XWDfxA3OnjrYQ9EU0/hEV
- TLSH T13AC302A11C3ABD660DF8EE98B40D3A60BFF4AC9A91835DC361EC2F0C14FA5C81139970
- MD5 SHA1 SHA512 SSDEEP TLSH