Analysis
- user interaction
yes - max time kernel
9s - max time network
19s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 11:57
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://gamingfun.me/TDMD1L
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
General
- Target https://gamingfun.me/TDMD1L
- Sample260804-n417radr21
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4532 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303182897213711" chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5048 chrome.exe 5048 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe - Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 5048 wrote to memory of 3316 5048 chrome.exe 88 PID 5048 wrote to memory of 4796 5048 chrome.exe 90 PID 5048 wrote to memory of 4796 5048 chrome.exe 90 PID 5048 wrote to memory of 4532 5048 chrome.exe 91 PID 5048 wrote to memory of 4236 5048 chrome.exe 92 PID 5048 wrote to memory of 4236 5048 chrome.exe 92 PID 5048 wrote to memory of 2716 5048 chrome.exe 95 PID 5048 wrote to memory of 3468 5048 chrome.exe 94 PID 5048 wrote to memory of 2716 5048 chrome.exe 95 PID 5048 wrote to memory of 3468 5048 chrome.exe 94 PID 5048 wrote to memory of 4316 5048 chrome.exe 96 PID 5048 wrote to memory of 4316 5048 chrome.exe 96 PID 5048 wrote to memory of 2908 5048 chrome.exe 97 PID 5048 wrote to memory of 3180 5048 chrome.exe 98 PID 5048 wrote to memory of 3180 5048 chrome.exe 98 PID 5048 wrote to memory of 1688 5048 chrome.exe 99 PID 5048 wrote to memory of 1688 5048 chrome.exe 99
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gamingfun.me/TDMD1L1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc76f7c728,0x7ffc76f7c734,0x7ffc76f7c7402⤵PID:3316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,11687663005380109995,4508283896099084979,262144 --field-trial-handle=1908,i,603961765509213360,17715732322909675972,262144 --variations-seed-version --mojo-platform-channel-handle=1876 /prefetch:22⤵PID:4796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,1140313022752858350,2919422291432000582,524288 --field-trial-handle=1908,i,603961765509213360,17715732322909675972,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:112⤵
- System Time Discovery
PID:4532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2304,i,16821501651133444145,14669931563457214829,524288 --field-trial-handle=1908,i,603961765509213360,17715732322909675972,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:132⤵PID:4236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,6606929763386541305,12777832561554531961,2097152 --field-trial-handle=1908,i,603961765509213360,17715732322909675972,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:3468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,15462417263752374465,16110841560018855858,2097152 --field-trial-handle=1908,i,603961765509213360,17715732322909675972,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:2716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4652,i,5948398888769971002,9795821352350152663,2097152 --field-trial-handle=1908,i,603961765509213360,17715732322909675972,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:12⤵PID:4316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5312,i,6076500980554485130,9436663482402403249,524288 --field-trial-handle=1908,i,603961765509213360,17715732322909675972,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:142⤵PID:2908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5400,i,4726032277241202711,16405621408757277192,2097152 --field-trial-handle=1908,i,603961765509213360,17715732322909675972,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:12⤵PID:3180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5448,i,8180571029795321194,1554397134079786999,2097152 --field-trial-handle=1908,i,603961765509213360,17715732322909675972,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:12⤵PID:1688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5764,i,101539922392418607,792652382802023679,2097152 --field-trial-handle=1908,i,603961765509213360,17715732322909675972,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:12⤵PID:3044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5992,i,5486456144624612533,6080852795351678204,2097152 --field-trial-handle=1908,i,603961765509213360,17715732322909675972,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:12⤵PID:1568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5588,i,2566226284636698364,17797953006319255810,2097152 --field-trial-handle=1908,i,603961765509213360,17715732322909675972,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:12⤵PID:5372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5780,i,5131457812421980708,8936358120315371728,2097152 --field-trial-handle=1908,i,603961765509213360,17715732322909675972,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:12⤵PID:800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5564,i,6826866986755403442,10436252896572190509,2097152 --field-trial-handle=1908,i,603961765509213360,17715732322909675972,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:12⤵PID:3668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3376,i,10329117289227656529,17414326434138048310,2097152 --field-trial-handle=1908,i,603961765509213360,17715732322909675972,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:12⤵PID:2880
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:936
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5548
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:4764
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\57f54ea7-1b93-46ef-86bf-71daa28402a9.tmp
- Size 11KB
- SHA256 c7b46bca7f47d5f22d4e71c534dcfeb0ca3918c9269d7c8fc593e4fff82b7c47
- MD5 3d9504633eeb43e0d2fc2d2d3c2c7750
- SHA1 498e3e98173eb0a0af7efaa0115ca6b9100e57bd
- SHA512 7ffca98af906160bb0a732cd54409523adff585832e536efa134f3ccaf963dce471cfb47b351605039af3149f4c34399b78922956f383999222e5ea33d025e08
- SSDEEP 192:pR9vPV2v76vAPRp2qky9ZHsb+WNnIHIjo21Wa/kwAOVyIsnAUge:pR9vdCG6XVbwEb2rgGe
- TLSH T1D832942EAD19693B5DCBD21AFA257653D7FA107231942E84E6FC992C10E76CC3227017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 11KB
- SHA256 9cadfe649db211251961abd5aa98a6e627e971039fc67e690052e383f7885981
- MD5 13f4de481965b71b545277fb18fcaff3
- SHA1 4f7743199235a69e2e1a78458995bafc90ce9f1e
- SHA512 5818e0b0c2d52aaf9e64a335b94a1c3ed1cbdc11c67a3d0e54cfbeea668983fd0842e771d4efdef8e4e602a9fffe01a096cf227397e4f5684e17a109181ed1bc
- SSDEEP 192:ecv4K6WE7KxkXqK4I40pUZNCgVLHrKHfFKslEYUWXzKD/ls+ErUkKN9iBWepdsrq:ZvjNE7KxkXqKf/pUZNCgVLH2HfgslGWZ
- TLSH T1DA32C727A88E9A3B4FD8D50CDC166F8BADA542937678092493FF9D0403A57CE114A1F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 5KB
- SHA256 50a4668fd6053555395c180b223e1d424097ee53083bf577cd3534da7cbd3aa8
- MD5 2be8433e6a154bf0499e6f0aff1ca56e
- SHA1 1591ed9857ca11907cee70dc90965b92daf2be7d
- SHA512 82437ebf7a2bf28232315919b061994eb1f23e01245401ad0136173eeed85ac786bc37afa55ca5d73734be5ba45e061feac6ff8d3705f69fb340f73d7e5aa050
- SSDEEP 96:mC0d+x7oIU1fXfBVtLXSl8h4otop5d8D7B6hGyvLXwqxwz/648Rfx0j9IKLIrbf7:mC0G7/qff3iU20FVu5xK8RfxUi
- TLSH T197C11A70E86D6C375AE3E559F5022957CFA961E75A10AF54EADB0F0801EB1EC1383923
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 4KB
- SHA256 07889648e937898c2c95b3b9fc11d59830e64bb82e00132373ae2944ecac9f94
- MD5 b62a485e4098025ce6bb2c0d7e335f9c
- SHA1 3835014f86c2337ebb2f3021491864a8d0c7b3ad
- SHA512 3f5d423cd944c34dcbbbe4a1afa510bdae7e55928aabc219c91c4975e08fef79a2c9a1c5a40209be0eb39a55772bca6ee52dd3a44d7a8a7e37fbf2b3224d5398
- SSDEEP 96:0C0d+x7oIU1fXfBVMLHRDotok5ddD7B6nGyvLlAfZbdOv4a:0C0G7/qffEDUDDFvcAfZbe
- TLSH T158A10931A42D8C3759B6D489FA466A53DFB970E76920AF84E9DE1F0801BB1EC1343923
- MD5 SHA1 SHA512 SSDEEP TLSH