fe9771865d3d1dafc5afb4273c1e125300289edd4e59385b0c2836ce4d754498

Analysis

user interaction
yes
max time kernel
36s
max time network
35s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 20:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Vapeclient.jar
Size 9.0MB
Sample260808-y2axwsfc94
SHA256 fe9771865d3d1dafc5afb4273c1e125300289edd4e59385b0c2836ce4d754498
MD5 342a61cd0625b7708bae1aef4d697c65
SHA1 322e5513356aa10211624020107f2f79d42136cf
SHA512 21552dd2617cd12b275670082ea854b7cc14935d782e1d4301292da4e958af862659ebca4e6f167992eb76ec0dd5aee5781dae43e20dafb618a94643ceee42bc
SSDEEP 196608:54jAx11CULOvhOUFJl/cGU6ashXDm3TyXOFIXEzePVSbr:OU1Ca4OUFlU6FTUYOFMEMV0r
TLSH
T1739633F3D326684F3F6395CB72E33642FD24DA4FAF47682E1851A34E05511893B62AC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4724	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2852	chrome.exe
2852	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 4720	2852	chrome.exe	91
PID 2852 wrote to memory of 4724	2852	chrome.exe	92
PID 2852 wrote to memory of 3848	2852	chrome.exe	93
PID 2852 wrote to memory of 3848	2852	chrome.exe	93
PID 2852 wrote to memory of 3956	2852	chrome.exe	95
PID 2852 wrote to memory of 3956	2852	chrome.exe	95
PID 2852 wrote to memory of 4480	2852	chrome.exe	96
PID 2852 wrote to memory of 4480	2852	chrome.exe	96
PID 2852 wrote to memory of 5524	2852	chrome.exe	97
PID 2852 wrote to memory of 5524	2852	chrome.exe	97
PID 2852 wrote to memory of 4816	2852	chrome.exe	98
PID 2852 wrote to memory of 4816	2852	chrome.exe	98
PID 2852 wrote to memory of 2056	2852	chrome.exe	99
PID 2852 wrote to memory of 2056	2852	chrome.exe	99

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Vapeclient.jar
1⤵
PID:5140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff9bdd5c728,0x7ff9bdd5c734,0x7ff9bdd5c740
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1872,i,7634595509428009388,8503873833091306825,524288 --field-trial-handle=1960,i,11654491760055134301,5581419986825610195,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,14708115715867381866,4321970003508731662,262144 --field-trial-handle=1960,i,11654491760055134301,5581419986825610195,262144 --variations-seed-version --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,14831966530781693301,12950155670396612454,524288 --field-trial-handle=1960,i,11654491760055134301,5581419986825610195,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:13
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,14080549147871245926,5622288769795515290,2097152 --field-trial-handle=1960,i,11654491760055134301,5581419986825610195,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,3848962538966273081,10417872720324797897,2097152 --field-trial-handle=1960,i,11654491760055134301,5581419986825610195,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4756,i,8847159067086288029,4970619655063153528,2097152 --field-trial-handle=1960,i,11654491760055134301,5581419986825610195,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4900,i,10903972983449037219,1728049844096835676,524288 --field-trial-handle=1960,i,11654491760055134301,5581419986825610195,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
  2⤵
  PID:2056

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b039a91f9e71909657b01a8b0b7e487857d2a61184ed7912635644ce307c49d4
MD5 5d4fa0c8ca164b5001483395dc0beb36
SHA1 ea562ccba1877a0bd64f8e13127b67a3954ccd0f
SHA512 dbfff6927e58b40dce2db699ba4a617f816d53e46bd99e5e15b686a4fbeffca17a5da7d1b0109dcf9eb1c734063d3508dfc2eae096100f02cf7fa6027c1da1ea
TLSH
T15B319AF7C3E4997D890192F4AB156F1FCE790A64132D3C66C8D4AE5B53E28B2D20028E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 c4aba73446157abaffedca931253c241822ecc9a388a536974fe8eb15af09c1d
MD5 aa87c07a97b9418d52837f5f40d8d211
SHA1 058a16798f4b5a30748de29635cdb1465e8b9dd3
SHA512 1dc03866774f419c45bc947a419778873cb8c04309b57dcfe2d8baa4c74f358196d8b661bd8b76d23a1ff307c30cb4559aaaffbe8de3edd5855e5ae879fca300
TLSH
T159F050F7F6ADB06B0079497E5E05BC0AED719439028178F4CF96429DA0815E70B05443
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 daf317aaca50aca4730116e65ef4784b3e239b42ff50512688bcf785ac558608
MD5 efd769202eff20c1e7ac35a1ff2e9d2e
SHA1 4509349c0196046248cc0601ffc726fbda927d54
SHA512 0ff6f9ffbe4feec63030a3786b9c0b00fe26330673f98384e6982afc4cb16ae9385374fa074e1faa9c1d3df0b2dae02c65d02e5f5d681cde3549b19cc8f6c4dc
SSDEEP 192:IRAEfn5v7zAPRp2Q9NLHsb+WNnHM0XxrPyIsnAUgR:IRAEPZCXD3ws0hfR
TLSH
T18122732EBA14753B6ECAD22AFA267753E7F9102125D02E84E7FC992C15D76CC3227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 671ef27e60254e76bc74b8a59daff4fd387e5df13faaa6fdaccff9cb579baa91
MD5 258bb719888282be9d511059f6651856
SHA1 a35449b5ab811d1a12da4f8a075acb120ae4024c
SHA512 1493f0e7316ce2faaa3a596b590a801b01d2a5e04d46a379cbd82ef5ca5dea941969b40e59b8c4c272ce661d35bc546ad256b2a6113069ce2ad7d6e8e560bbc9
SSDEEP 192:ecP4K63X7KxkXqK4I40pUZNCgVLHrKHfFKslE1rxXzKD/6h+ErUkKN9Yr0XAn57C:ZPjwX7KxkXqKf/pUZNCgVLH2Hfgsl8xG
TLSH
T1AF32F927A48D5A7F0FD8E50DDC126F4B6DB5029377681D2492FB9D0803A87CE214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 486a00cc82989581ad9d0789a9a6c4f40c6924a2d73e4d63d95eb8db42cb77a9
MD5 d09d562dad2794963c8161b7c6cd07b4
SHA1 3e721cc1876dcc957615f167c871990e0446bf8b
SHA512 b1d3b85f525d991dbbb2b177b3dc52bb9ea4f97c3511dfd32e5bd0f6cae07861013e075260081d460c44c59a6ec0102bb561867a57ce79a866adf78d77b63459
SSDEEP 96:BC0d+hDK+UyKovbfaNQYYeteRDotok5eqDNB6WGyvUU+xsbL/Mmv4a:BC0qDHUgvIdaDUDvTCI+xsbL/N
TLSH
T1C2A12A31B46D5D775A76D949F9662E43CEB4602BE931BE44D9DE0E0C11FB0EC1302613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 954648e452ec87bea7bc25a6303306d23a16e78d2d16466e5c4ea8503fc0e3be
MD5 65a9364ed636cec7aeb52eb2e60463b3
SHA1 edfd59bbb8507998772be80e3825518ba99ef0fb
SHA512 7c87dbb9b31030ec5397666af89f03dff74e8dd563648abd7b80c15b08297b49b1afd646d51b1424401d1739a1d861df02be3282d1f9b64868729faf1ca4995e
SSDEEP 96:MC0d+hDK+UyKovbfaNQYetGSl8h4otok5ecDNB6jGyvUgIlG1QzbOQfPfSfr0j9D:MC0qDHUgvIdjiUDtTnsIlTLfPfSfrUD
TLSH
T191C10775B86CAD7319B2D556F5132E43CDB9206BA951AE64C6CB0F0D22D74EC1342923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5140-2-0x000002A6C7140000-0x000002A6C73B0000-memory.dmp

Download

memory/5140-13-0x000002A6C7140000-0x000002A6C73B0000-memory.dmp

Download

memory/5140-12-0x000002A6C5960000-0x000002A6C5961000-memory.dmp

Download