hxxps://evslacalade[.]fr/wp-content/themes/cyber-security-blocks/parts/parts/labo

Analysis

user interaction
yes
max time kernel
26s
max time network
28s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/08/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://evslacalade.fr/wp-content/themes/cyber-security-blocks/parts/parts/labo
Sample260808-prfwqa1tht

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4052	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
408	chrome.exe
408	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 3104	408	chrome.exe	80
PID 408 wrote to memory of 4052	408	chrome.exe	82
PID 408 wrote to memory of 2572	408	chrome.exe	81
PID 408 wrote to memory of 2572	408	chrome.exe	81
PID 408 wrote to memory of 4020	408	chrome.exe	83
PID 408 wrote to memory of 4020	408	chrome.exe	83
PID 408 wrote to memory of 3344	408	chrome.exe	84
PID 408 wrote to memory of 3344	408	chrome.exe	84
PID 408 wrote to memory of 4380	408	chrome.exe	85
PID 408 wrote to memory of 4380	408	chrome.exe	85
PID 408 wrote to memory of 1672	408	chrome.exe	86
PID 408 wrote to memory of 1672	408	chrome.exe	86
PID 408 wrote to memory of 3252	408	chrome.exe	89
PID 408 wrote to memory of 3252	408	chrome.exe	89
PID 408 wrote to memory of 4032	408	chrome.exe	90
PID 408 wrote to memory of 4032	408	chrome.exe	90
PID 408 wrote to memory of 352	408	chrome.exe	91
PID 408 wrote to memory of 352	408	chrome.exe	91

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://evslacalade.fr/wp-content/themes/cyber-security-blocks/parts/parts/labo
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff4239c728,0x7fff4239c734,0x7fff4239c740
  2⤵
  PID:3104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,11679769930035484274,16364240541632202380,262144 --field-trial-handle=1948,i,10407695152600842590,7776947408885767452,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:2572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,17183407249914183583,5064524125882328258,524288 --field-trial-handle=1948,i,10407695152600842590,7776947408885767452,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2116 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,1381319627269360246,1409248680110737036,524288 --field-trial-handle=1948,i,10407695152600842590,7776947408885767452,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2532 /prefetch:13
  2⤵
  PID:4020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3100,i,14856272952876416001,2709911011791418600,2097152 --field-trial-handle=1948,i,10407695152600842590,7776947408885767452,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3128,i,15471666499725915286,836376640633808105,2097152 --field-trial-handle=1948,i,10407695152600842590,7776947408885767452,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4320,i,11679826681168668548,7475101801540920065,2097152 --field-trial-handle=1948,i,10407695152600842590,7776947408885767452,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4296 /prefetch:9
  2⤵
  PID:1672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4740,i,13948685557260253989,17164434787585365043,2097152 --field-trial-handle=1948,i,10407695152600842590,7776947408885767452,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5188,i,2455691532801960844,18357972036045067539,2097152 --field-trial-handle=1948,i,10407695152600842590,7776947408885767452,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5604,i,583730325470231177,3089196423197278166,524288 --field-trial-handle=1948,i,10407695152600842590,7776947408885767452,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5592 /prefetch:12
  2⤵
  PID:352

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3772afb0-5d1d-4f51-95c3-01ee9c55a351.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\3772afb0-5d1d-4f51-95c3-01ee9c55a351.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3ee79f1c166da9dd3c099cc199db55951451ff044773269d99f7c6e086ee4d05
MD5 bb5cbfcab99b204a80bf0039aa669e1c
SHA1 d82cb34e4814ba196e2f6499884247c7f4eb2555
SHA512 8d882ba7037c4e51cd697246bfd72f55ed1fa78b11bf25c449052433109323a9301bbf5a0905007cf7f5e0e36f39d45d6d86eb54f25a44893167d8da6f854592
SSDEEP 384:4Rp0nhv2bVF7xy1CyogZUXErwBU2MDMaHe:o0nhv2bVF7xy1CyowPrwts+
TLSH
T11F42942EAE106D3B5CDAC229FA657713D7F6106561902E88E7FC892C18D79CC722741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d0f5f74d6c074632f4c1450df3e7ddb087da976275d3ce249e1923f96ace358a
MD5 48bd223d929c4664e5a6ef9b8801b7bf
SHA1 c834a753f65991ca00cd50bd4c16f8ae98f20a9e
SHA512 adce1c261732cfee72f86dc35e7715977f9912f6e8d1e760b4cc49954b3391cc8df0c27f92cea3921954eb80778efe75be9b2aabe969a90aea2514509d01b2ac
SSDEEP 384:4Rp0Mv2bVF7xy1CyoxZUX6rw5YeADMaHe:o0Mv2bVF7xy1Cyo3hrwtY+
TLSH
T14842B52EAA10693B5CDAC329FA617753D7F9106560902E88E6FCC92C18E79CC722741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 86a708718cf15f4439caa697f6058448e2b7016cb1cef9cd2e54315587d87208
MD5 c23047ed70b8fe98404f2d539506eb71
SHA1 777411f14fab3beefe67a6f475f14f7e6e56c013
SHA512 0a47725dfc0cd3a51a0c13fc01329dccf73a0e6fe775075f027ab629f4c8fde68db8b61d4cd2ce4269a02632bafb0dcbc043ec6377186b9c4b1d39ea91b3d0ec
SSDEEP 384:8mjoj7KxkXqKf/pUZNCgVLH2HfgslTg97pLuLcSjuvXODof+ErU3i4JHGtovIld:8Goj7KxkXqKf/pUZNCgVLH2HfgsZg97V
TLSH
T1C77208676C4C9E370F94CACCD8167B4F9DB5014B65EE886483FA982903D5BDB110A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 cbba2d496014cd070cd40a4acc422b66ccf18b376bbea4999202cf179f991f6a
MD5 573221ed02403e01154d388c129af6ea
SHA1 f4f3eeb17758c674511316fdeed2b59804242629
SHA512 91fded57931e953f7e3a3e228bb9be8f8e230e6e8f8d03b0a96655552f386086f14ca7e946f870b33e38fb6161607e397fa69451e630b1fab00e121b252498e6
TLSH
T13BB012108001A2C1C46206B05143548D71989F10960F1F0143E5ED22C8261A2C014190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586453.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586453.TMP
Size 96B
SHA256 dbb04333323d7847a5cd0989f5dba211ed14da8dca517dea5ed213106893fd91
MD5 422820b567d06cf34a49277c6cba7b7d
SHA1 8f1032cdd9d65ff3287743c3d756556538c74616
SHA512 d877efa1c0944bf3ca87894389ae3458337b4db3c7b1f707c439d2742b2f23381209d552ad2656071da0529df126a0eb25f1080c4dee8b48e0eaa0d049739df5
TLSH
T16FB02280C00E2302E00203F020B0C0CC33A0CF20C20B0202CAF00A23CC382328028020
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 7263f7b6f6c8f7c2440245c6ee4246ba460c9088cbd50c860e9558efe73675e2
MD5 0c26791ad244445c126df0d9f2666c43
SHA1 352c4019191e98ab8ae1bf72ff282b300cb4ee99
SHA512 2e5a73bff385cb219b8cb3bd525979c26b80506e0bfc7d98b8fbfba5bcc39f78b3fde664d5b9b4b40e94f0e22681d8f00ea2dc9983942c5dbd64d39adefa6a10
SSDEEP 3072:EGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:nm7Rkm1tYpBeh2BAoi
TLSH
T124C312375E71E9365979AB0EB48E0B1F2EF149A6C830DE92C8D85A0437E97CC1A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 468e9ed283cfd2df6ab280ab2e22243da9f17f2906fb67a303dcd01e3928a136
MD5 3c2e63e97f88b70306c9f4b7eda56c55
SHA1 7f165a4e2dc7527ac9fd21fea61f0ac8ec6c3c03
SHA512 7d3cb436755b6dcbb738de310ac531b009de342e1c6bf954cb2429f091108e635af81eff6e02190118a1dc5f0420c75f0d020713de76ab24ec13f7d5fa14987d
SSDEEP 3072:8/Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:8um7Rkm1tYpBeh2BAoi
TLSH
T10AC3123B9D75E83659BABB1EB04E0B1F1EF14DA2C920DE52C8D45A0437EA7CC1A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download