30ba36de8f9a79b7ae73b548a55f75967c428256d3ad2bde5d96925614e59d04

Analysis

user interaction
yes
max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Eon_EAC.exe
Size 3.7MB
Sample260805-v2aekscg87
SHA256 30ba36de8f9a79b7ae73b548a55f75967c428256d3ad2bde5d96925614e59d04
MD5 1bfc4074cb37bcfb5716303469dd61be
SHA1 56b5da5dbe085b37b83dcf5d06dba745444b1f98
SHA512 afbb7b02d35775d9b1681924db1a089c213efc58a5780fb27980783cd78e4320f807e832335a044cb469d71650e17039aff058c07e1b2bd1fa9df348005f776c
SSDEEP 49152:x+rd4KL5We9frSzlVqc+WTQ72+3x6ncfsjjdMcR8/s+kobXHz/q/xHd/c/fHr/aw:Itd9TSzl01WTQv3xHsvjpgqAVX
TLSH
T1F806AE4AA3A601E9C567907AC686730FD2717C1433905BDB26E45AA91F33BE0DEFB710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2760	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3648	chrome.exe
3648	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3648	chrome.exe
Token: SeCreatePagefilePrivilege	3648	chrome.exe
Token: SeShutdownPrivilege	3648	chrome.exe
Token: SeCreatePagefilePrivilege	3648	chrome.exe
Token: SeShutdownPrivilege	3648	chrome.exe
Token: SeCreatePagefilePrivilege	3648	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 2520	3648	chrome.exe	90
PID 3648 wrote to memory of 2760	3648	chrome.exe	91
PID 3648 wrote to memory of 5092	3648	chrome.exe	92
PID 3648 wrote to memory of 5092	3648	chrome.exe	92
PID 3648 wrote to memory of 5692	3648	chrome.exe	94
PID 3648 wrote to memory of 5692	3648	chrome.exe	94
PID 3648 wrote to memory of 3908	3648	chrome.exe	95
PID 3648 wrote to memory of 3908	3648	chrome.exe	95
PID 3648 wrote to memory of 3932	3648	chrome.exe	96
PID 3648 wrote to memory of 3932	3648	chrome.exe	96
PID 3648 wrote to memory of 3244	3648	chrome.exe	97
PID 3648 wrote to memory of 3244	3648	chrome.exe	97
PID 3648 wrote to memory of 1940	3648	chrome.exe	98
PID 3648 wrote to memory of 1940	3648	chrome.exe	98

C:\Users\Admin\AppData\Local\Temp\Eon_EAC.exe
"C:\Users\Admin\AppData\Local\Temp\Eon_EAC.exe"
1⤵
PID:2776

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc1dbdc728,0x7ffc1dbdc734,0x7ffc1dbdc740
  2⤵
  PID:2520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1864,i,2723230474943862293,3251219812099989602,524288 --field-trial-handle=1920,i,6600978846574963923,10286249946446505817,262144 --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,6294872139244332631,10141873925996709730,262144 --field-trial-handle=1920,i,6600978846574963923,10286249946446505817,262144 --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2304,i,13312656347544531255,14759556196125279282,524288 --field-trial-handle=1920,i,6600978846574963923,10286249946446505817,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:13
  2⤵
  PID:5692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,17291277680681985898,251631381763946766,2097152 --field-trial-handle=1920,i,6600978846574963923,10286249946446505817,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3360,i,12950738413486239071,18282830333907209903,2097152 --field-trial-handle=1920,i,6600978846574963923,10286249946446505817,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4680,i,15692471962189825846,6058230632848508261,2097152 --field-trial-handle=1920,i,6600978846574963923,10286249946446505817,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4852,i,15429038126406868413,1673293925585063804,524288 --field-trial-handle=1920,i,6600978846574963923,10286249946446505817,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:14
  2⤵
  PID:1940

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 cad0b70fe0e6e5abb5d19dc78b57e7d15f8ab609b923494d3bff7778f12bf96e
MD5 43885ccd3da807308a3d9de0b6b16fe1
SHA1 89c78eae3dcc27e7b4500aa0fc7d9bdf9e5c1fac
SHA512 deb433aba7baa01a5714905cbf3e8a53e3ecb1bb39eeeafcc0ba020bc51a8b2ded2471c923e956d1b3a69b330aad4711881d29f032d72cc304d1d93aa1b75ec7
TLSH
T1EE319DF7C3E89A7D890556F8AB156F1BCE2D0E14531C3D16C8E8AE2F57E2876D20064E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 a6de480c647eea62d679692bc8b05a840e8d79dc16eca7115a070646632962e4
MD5 7e03f39f1ec57c1ccbe6107d4db8181c
SHA1 e769987e599bc069bd75765039ae80fb00589b74
SHA512 8741e554929a744e1c517492cde619b3956f988d6abc004a498494803f2451825dbb63e4c5dd86c21ff21a742cfb7b0efcb2ac66be786ac84c78b7854c9f5b15
TLSH
T10EF050A7AA6A7567147985AE5D04B805ACB1A435015069F4CFA6426CE0475F70B02443
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 6da034a6eeb02b62f799d32051bf5b4cc5f28f5c81cc74801df45e9746de8806
MD5 7f01343d629d1000778d7e61a54c65ca
SHA1 ed1a7dc398786d64a8ad40a0cb8783f2854fe893
SHA512 95050b5238df0700d347e95139c911b57ed31fb379544ad619b1b785d94ab3a43df5cc4c55a02316fda1017f646b0492481fb61e96f2e5d0f6235c1fc333323a
SSDEEP 192:WRlhb4LMv7sAPRp2X964Hsb+WNn9a0GcGrPyIsnAUgR:WRlZsYBXUbww0FGfR
TLSH
T1CC22632EB965697B6DCBC219F9217B93E3F9102235903E84E6FC992C11E7ACC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 2ce4b4dc5aa178b550b3488253c6d6a14868fa3627c83ce1a35bac87ff7ecd38
MD5 415cca8b3eccee60ba473abdb84c8d14
SHA1 1959828415e82782e9c2c01dadc4d8cb0fd339ac
SHA512 5783f470f1f3161199bf38eacc4182d513cfdc7fc6218842db28aee060eff2efc3263ff08091c2a972cdebfd38009c4ca09dd99af9e751b73b8d57e360d7ee96
SSDEEP 192:esz4K6mQ7KxkXqK4I40pUZNCgVLHrKHfFKslEZESXzKD/pQ+ErUkKN9HjCxBRqih:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzST
TLSH
T13732E827A48E9E3F0FD8D91CDC136F4BADB5025272680D2496FBAD0803E97CA115A5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 0396dfebca0d1a19beab706f6dc94443a26929778d371400393151db4acdb787
MD5 4f8f20276e3118a3ac77148a1b29282e
SHA1 7b7df9460aff06cddf472f9d4bb64442757d8204
SHA512 04a42660292595b1ed53706985a4e1a8231cd76d593af396d961ec41ac1e1c51a711e4274f79969139feae38f064606d1ad8d4110eb637556afc4b50ccbe7751
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5aCDWB6/dGyv95SLhbb2Jv4a:gC0LA/TE57cDUDtGUweSLhbKl
TLSH
T169A10971B8695EB75D75C544F5827E83DF68A117A9217F84D8EC1F0C10E71EC1382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 522df7b337e6ed8171b5c5f9451ebd07dd9126258fd94c4e76ad951cbaaa906a
MD5 65b8ecc0a31a612f7484e8f9732011c4
SHA1 7e109613973cf651a6f4acd41c9f11c2fa292b1a
SHA512 61adf58bd88bfca33d7e566caac7739bfbf5efadbcf116e23bf82f7a3be8e6bf3f02d0a0b5c64cb6e6566c55f5144613829cfa833d5387074fdb5a3822ce482e
SSDEEP 96:gC6Wd+cAOIt5aDVmufj7qcmSl8h4otok5arDWB63JGyv9JtFiO0AuSw4jtDmh0jh:gClLA/TE574iUDeGB+tFGSw4jtDmhUZp
TLSH
T16BC12970787D2EB35DF69590F1427A43CDE4A167A8126E9489ED0F0C01C74DC2383A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download