hxxps://764roster[.]vercel[.]app/

Analysis

user interaction
yes
max time kernel
5s
max time network
17s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 20:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://764roster.vercel.app/
Sample260807-zabwjstamd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4736	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4908	chrome.exe
4908	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 2328	4908	chrome.exe	86
PID 4908 wrote to memory of 2316	4908	chrome.exe	87
PID 4908 wrote to memory of 2316	4908	chrome.exe	87
PID 4908 wrote to memory of 4736	4908	chrome.exe	88
PID 4908 wrote to memory of 4496	4908	chrome.exe	89
PID 4908 wrote to memory of 4496	4908	chrome.exe	89
PID 4908 wrote to memory of 4656	4908	chrome.exe	91
PID 4908 wrote to memory of 4656	4908	chrome.exe	91
PID 4908 wrote to memory of 3232	4908	chrome.exe	92
PID 4908 wrote to memory of 3232	4908	chrome.exe	92
PID 4908 wrote to memory of 3088	4908	chrome.exe	93
PID 4908 wrote to memory of 3088	4908	chrome.exe	93

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://764roster.vercel.app/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdc68ec728,0x7ffdc68ec734,0x7ffdc68ec740
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,15600870540617507490,18418787986932818429,262144 --field-trial-handle=1964,i,2596249278672724588,14110266313408371263,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,13933017505686193082,3503823603067692601,524288 --field-trial-handle=1964,i,2596249278672724588,14110266313408371263,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,7059856982486585577,18322853370014261118,524288 --field-trial-handle=1964,i,2596249278672724588,14110266313408371263,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2360 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,14629379807756145932,11952076683923665097,2097152 --field-trial-handle=1964,i,2596249278672724588,14110266313408371263,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,15184199843632872636,12679656668085194392,2097152 --field-trial-handle=1964,i,2596249278672724588,14110266313408371263,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4412,i,12282440816421395290,7580575971577806930,2097152 --field-trial-handle=1964,i,2596249278672724588,14110266313408371263,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4408 /prefetch:2
  2⤵
  PID:3088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5128,i,17692119743560080508,2275865941501416214,524288 --field-trial-handle=1964,i,2596249278672724588,14110266313408371263,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,10963216648222874557,9904068595479822997,524288 --field-trial-handle=1964,i,2596249278672724588,14110266313408371263,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:5016

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f_000004

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
Size 1024KB
SHA256 f3b3d6b293d59e6b4958424f7b70116f64ad39168d3d15b0491a2bd1ac0167fc
MD5 d4335de654a9f167373f7351118d21e4
SHA1 cb60ed9d2cc7da6bd7ef2433cd5aa533f0b58fea
SHA512 3f436be14f33aa83bd879b407c21e86d54da6b0dd3b862c35d8a3c9ebe9c08ffd8111c0a9fe104500f2e40c4ee84ce487afffcbf92fa749a38768d60090e67c7
SSDEEP 24576:j//TLX+gJ/+BDGHsJMrKBamnr9GWcNeQBW2GiSA77BOk/rBLYGrI1vD:7/TLX9JGFGM/nnSeQyiSAPAmY9F
TLSH
T1D525239B6304A1AAC1CD897607E3428362731F673516FF897F08376566333EA7327A64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3a6e929b89b710544bde7b22208831d7537af63b05dac70f73197c53a84ab9ab
MD5 2579f9841466d3a67d11aa82e24b7c3d
SHA1 faab971d5631429980a72dc3ab0aafc10cd4e972
SHA512 fb6f40129ba9a11c5dd75ed79df728e6972c3d85a2c4207381bf8bb4e971460c05e76e7714c173f89c1484777abb8d452b802b3650a3fea187be849a796dac54
SSDEEP 192:IRDsIw6PJ8hsowv7ApAPRp2vt9qHsb+WNnk0mBO2lGPkw6GVyIsnAUge:IRDs6cskUXMkw/Z24Phe
TLSH
T13842A56AEE10697F9CDAC229F9257713E7F5203521942E94EAFC892C24DB6CC321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 ddcaa4a1e8e8a7e653f6c70d87566f46d5a7625814fd3d53a693f887a8f8c4fc
MD5 d6f7cb4f2cf380b9bb466dbe8894406f
SHA1 9e3d18908267bf460ab2208202fd38cad2938275
SHA512 3403861d2f6765a1b895495e5961ee262112254d2b0af2b3aabfdc7294d89eadcd66bf03cf329f2e930efdf4c6a3661bffa5bb881cdc0d2cbee0643378830947
SSDEEP 3072:AnGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Jm7Rkm1tYpBeh2BAog
TLSH
T1E9C3023B5E75ED3B5CB5A74EB08E0B1E2EF149A6C930DE9288D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 b803592415c35aefc770b29c182fac541cf7a794df831b324966326f2f2bd112
MD5 cf99af8ab419b7897678e9b8c33c00da
SHA1 0b550240fb60e5ceb74f8499d6266adf5c7a7453
SHA512 4589f6d15bbcd93724d9739f7c1c6b6d4dc4f059c8ad01d4826dfa9be78120bd52d1d6a34834b5721f7e6d9d8af97d92cb40b8b656b3a939e1b2812c3fee5a10
SSDEEP 3072:fJGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:wm7Rkm1tYpBeh2BAog
TLSH
T1ABC3123B5DB4E8375DB5B71EA08E0A1F1EF149A7C920DE92C8D85B0433E97CD1A45A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download