Analysis
- max time kernel
30s - max time network
24s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
08/08/2026, 15:22
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://lurowin.com
Resource
win10ltsc2021-20260513-en
11 signatures
300 seconds
General
- Target https://lurowin.com
- Sample260808-sr92cattaw
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2172 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306761923705494" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2244 chrome.exe 2244 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe - Suspicious use of AdjustPrivilegeToken 58 IoCs
description pid Process Token: SeShutdownPrivilege 2244 chrome.exe Token: SeCreatePagefilePrivilege 2244 chrome.exe Token: SeShutdownPrivilege 2244 chrome.exe Token: SeCreatePagefilePrivilege 2244 chrome.exe Token: SeShutdownPrivilege 2244 chrome.exe Token: SeCreatePagefilePrivilege 2244 chrome.exe Token: SeShutdownPrivilege 2244 chrome.exe Token: SeCreatePagefilePrivilege 2244 chrome.exe Token: SeShutdownPrivilege 2244 chrome.exe Token: SeCreatePagefilePrivilege 2244 chrome.exe Token: SeShutdownPrivilege 2244 chrome.exe Token: SeCreatePagefilePrivilege 2244 chrome.exe Token: SeShutdownPrivilege 2244 chrome.exe Token: SeCreatePagefilePrivilege 2244 chrome.exe Token: SeShutdownPrivilege 2244 chrome.exe Token: SeCreatePagefilePrivilege 2244 chrome.exe Token: SeShutdownPrivilege 2244 chrome.exe Token: SeCreatePagefilePrivilege 2244 chrome.exe Token: SeShutdownPrivilege 2244 chrome.exe Token: SeCreatePagefilePrivilege 2244 chrome.exe Token: SeShutdownPrivilege 2244 chrome.exe Token: SeCreatePagefilePrivilege 2244 chrome.exe Token: SeShutdownPrivilege 2244 chrome.exe Token: SeCreatePagefilePrivilege 2244 chrome.exe Token: SeShutdownPrivilege 2244 chrome.exe Token: SeCreatePagefilePrivilege 2244 chrome.exe Token: SeShutdownPrivilege 2244 chrome.exe Token: SeCreatePagefilePrivilege 2244 chrome.exe Token: SeShutdownPrivilege 2244 chrome.exe Token: SeCreatePagefilePrivilege 2244 chrome.exe Token: SeShutdownPrivilege 2244 chrome.exe Token: SeCreatePagefilePrivilege 2244 chrome.exe Token: SeShutdownPrivilege 2244 chrome.exe Token: SeCreatePagefilePrivilege 2244 chrome.exe Token: SeShutdownPrivilege 2244 chrome.exe Token: SeCreatePagefilePrivilege 2244 chrome.exe Token: SeShutdownPrivilege 2244 chrome.exe Token: SeCreatePagefilePrivilege 2244 chrome.exe Token: SeShutdownPrivilege 2244 chrome.exe Token: SeCreatePagefilePrivilege 2244 chrome.exe Token: SeShutdownPrivilege 2244 chrome.exe Token: SeCreatePagefilePrivilege 2244 chrome.exe Token: SeShutdownPrivilege 2244 chrome.exe Token: SeCreatePagefilePrivilege 2244 chrome.exe Token: SeShutdownPrivilege 2244 chrome.exe Token: SeCreatePagefilePrivilege 2244 chrome.exe Token: SeShutdownPrivilege 2244 chrome.exe Token: SeCreatePagefilePrivilege 2244 chrome.exe Token: SeShutdownPrivilege 2244 chrome.exe Token: SeCreatePagefilePrivilege 2244 chrome.exe Token: SeShutdownPrivilege 2244 chrome.exe Token: SeCreatePagefilePrivilege 2244 chrome.exe Token: SeShutdownPrivilege 2244 chrome.exe Token: SeCreatePagefilePrivilege 2244 chrome.exe Token: SeShutdownPrivilege 2244 chrome.exe Token: SeCreatePagefilePrivilege 2244 chrome.exe Token: SeShutdownPrivilege 2244 chrome.exe Token: SeCreatePagefilePrivilege 2244 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe 2244 chrome.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2244 wrote to memory of 1892 2244 chrome.exe 83 PID 2244 wrote to memory of 3932 2244 chrome.exe 84 PID 2244 wrote to memory of 3932 2244 chrome.exe 84 PID 2244 wrote to memory of 2172 2244 chrome.exe 85 PID 2244 wrote to memory of 4796 2244 chrome.exe 86 PID 2244 wrote to memory of 4796 2244 chrome.exe 86 PID 2244 wrote to memory of 3760 2244 chrome.exe 88 PID 2244 wrote to memory of 3324 2244 chrome.exe 89 PID 2244 wrote to memory of 3760 2244 chrome.exe 88 PID 2244 wrote to memory of 3324 2244 chrome.exe 89 PID 2244 wrote to memory of 4420 2244 chrome.exe 90 PID 2244 wrote to memory of 4420 2244 chrome.exe 90 PID 2244 wrote to memory of 5008 2244 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://lurowin.com1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffaec2dc728,0x7ffaec2dc734,0x7ffaec2dc7402⤵PID:1892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,8370235862181698247,10195025849814889935,262144 --field-trial-handle=2008,i,18394833237734220210,17218159759735528367,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2032 /prefetch:22⤵PID:3932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2260,i,13753960976707531568,14355905550461817846,524288 --field-trial-handle=2008,i,18394833237734220210,17218159759735528367,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2288 /prefetch:32⤵
- System Time Discovery
PID:2172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,17638468199156397117,16771569263153173013,524288 --field-trial-handle=2008,i,18394833237734220210,17218159759735528367,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2560 /prefetch:82⤵PID:4796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,3667722835158042446,11568185832505422047,2097152 --field-trial-handle=2008,i,18394833237734220210,17218159759735528367,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:3760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,14204246676339019116,10898366017278266373,2097152 --field-trial-handle=2008,i,18394833237734220210,17218159759735528367,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:3324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4416,i,664945651238981749,7251965736430787040,2097152 --field-trial-handle=2008,i,18394833237734220210,17218159759735528367,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4432 /prefetch:22⤵PID:4420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,8360401655034883068,969910483618702228,524288 --field-trial-handle=2008,i,18394833237734220210,17218159759735528367,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5660 /prefetch:82⤵PID:5008
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3288
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:556
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 fc215a5b86985fc0002ac43083429cbd8821581013c80e167830b65dff7129e6
- MD5 71ef6ef4b8d3d951d8dc38fbec888f26
- SHA1 717354390a9085da3a59b5c9f7e9a96a95166138
- SHA512 d066280727cec95d10a42a9ccffa909a1222701331f843cfbde1a16e127b999f04262e17d152dde632234f02d03ff2e9cbfe82c75c92d03b211b0263f9e2850e
- TLSH T11AE022AACD22EC2B09FE172954486646E754135F2F41991F7A3CA20D8FB0B7A498681C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 816B
- SHA256 29148c02d75da3cab83e7eca6307d22059dae79bd6ed3f15d37fbac6de40cc08
- MD5 efc5ca25a8f2562340487ddc20f46e2f
- SHA1 68cffbd2f6df32e35909f54f6df0603cdaed83f5
- SHA512 e3d9cb9887a971f2f4d557a52af4d9ce851f669092ac6b9680680fb718019ef11aeeb2c7ff10baf8cdbf2347d199941f2f86df1fb3f029ed558b2e4bf4e43ccb
- TLSH T13501247117C1538CDF0984F10BC61D94B538349A4D23BF67B73E2EB09463BD09853285
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 3c1544601dd0d70d615aee67dcf8643ca5e32dd15e87998b17d7289483d26119
- MD5 0e3d964949e127e4fb26eb1625d547ce
- SHA1 78a715d23eb4c2276f9d7a9d473c7acbe4692c85
- SHA512 0cc15944cb8d2caacf55e5887b95d0895563379f9d0ecdd0bf256278386570c940017b673a5aac274d4d0c988beaf93e16325fc20a1455deeba27c72dd721b44
- SSDEEP 192:ERferV9OZPAOv7TpAPRp2M+499Hsb+WNnT6r+mT2Rpe/iPeY3a8VyIsnAUge:ERfe3OKq3UXtjwmX2joijaYe
- TLSH T1C742B42EAD207A3B8CDAC22AFA657B53D3F5102135D46E84EBFC892C25D75CC2227417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 347d73ba7d38af83ac3d460ce8c2dd97cabdd4c55b65412cd8b887fb45b65b38
- MD5 871109c95d991c94717364d65631baf0
- SHA1 fc56f3d2f1b22d07cb19c827684bb9fb264712aa
- SHA512 3ade27ac0b79ef313d66bfd054d6fd2751cb9827493acd598ed9e782f0d4fcd111331893c5c70bec25cf3d8785027f9de5a781447cdf6e3bd8e08cdce6002844
- SSDEEP 384:IijUn7KxkXqKf/pUZNCgVLH2Hfgslk+n7pLuLcSjijXODUL+ErU3gRnHGmvcrBv0:IiUn7KxkXqKf/pUZNCgVLH2HfgsK+n7D
- TLSH T1A27219776C4C9E370F94C68CD8277B4FADB5025B65E9886843FA982903D5ADF010A1EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 d1f51e93c97f0f6117b14e896e899909bee8939458f9d1e69c359128e62a06a6
- MD5 d457a5b6fbd82c88b2be5b1c611f6573
- SHA1 12127d37184ca52b093e4959578a3ac613f2b0ee
- SHA512 0066e8d71fd9cca0cff3ca9c66806c2c291be5651ab254a86ca3ce5f651e6efb2f57fbe8ff17906f60a0118cdba1c2bd757cd86d4d28ff78f155ff865ad456fb
- TLSH T187B0125084819501C41202F8134354887158AF11AA0A2F0143F46D228829254801515C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587692.TMP
- Size 96B
- SHA256 b33f4109e5ba82c4bc55b40dfd41b465e101f5f1bf2b7529396c160cbdca0eab
- MD5 e9fd5d11436e862d735e28af94bcfb47
- SHA1 b5d10be70f23e3108f7cb3085f165a52cae5694d
- SHA512 be085796d19087d9397e87b145e5b616c54fbedaa79fb7ec320008844926d5b3172bf04015b8d19427e0324d8133ba8c3fbabd028d1f05ec9116f9af7cf20fe5
- TLSH T1F0B02220C203320BC00203B02A80E0C83020EF20C2032203A2F82EEACC28A200028022
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 cccb9c469c9d39e60f98e4cc86c5bfc2827145a086b02d9a120f273757ed1b0f
- MD5 6fe3b5ac22456c08db42490847998f09
- SHA1 ad475a4d0da4f31775fdbc867c610d540014c28c
- SHA512 dda93fbabfe9650ea4ac9b13e289a463e41256b47b7f15f17e5efc3a5513bf44b6ea93a6cac367f104f0268034a6124758dcec32da293084e2183e55d7066cd1
- SSDEEP 3072:IxLw3LffUnBKU/F8enCW3iyVEXGey0cB12:IxE3LfqBZqenbyyVEd1cB12
- TLSH T1FCB31221E5A6FF6B9275472AB50F93295CD148BF54E1E788443C2F19E0CA388EFA8D44
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 4707a17414268066c17da85a74facb5f0c1e133cac7917eee6545354a53f528b
- MD5 d065834acad4c21d36737a5d49a96326
- SHA1 eba170c3a34c4555674c7b6deb64cddad6017927
- SHA512 d99681ed57668d22e74bb733610bfe12595ac990211c5f6059a0f1804a3eedbf813da1861eb7763d031e2e770009a3a2d2e07dcfa4d056c7079ad3f805f23f02
- SSDEEP 3072:gxSw3LffUnBKU/F8enCW3iyVEXGey0cB12:gxx3LfqBZqenbyyVEd1cB12
- TLSH T177C31231E89AFE77A2A55736750F931A5CD148FF54E1B788443C2F19A0CA388EFA9C44
- MD5 SHA1 SHA512 SSDEEP TLSH