Overview

overview

3

Static

static

1

MedalEncoder.exe

windows10-2004-x64

3

MedalEncoder.exe

windows11-ltsc_2024-x64

1

Analysis

  • user interaction
    yes
  • max time kernel
    46s
  • max time network
    47s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    17/08/2026, 04:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MedalEncoder.exe
  • Size 6.3MB
  • Sample260817-e8n9batvfs
  • SHA256 11515c10607930afb3243567474f8d81d23735351b38dc07047033feb4bd1e5a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
discovery

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MedalEncoder.exe
    "C:\Users\Admin\AppData\Local\Temp\MedalEncoder.exe"
    1⤵
      PID:3632
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3432
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa097dc728,0x7ffa097dc734,0x7ffa097dc740
        2⤵
          PID:3856
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,9224975095401410718,10911194899792975322,262144 --field-trial-handle=1880,i,7103977516870537420,9017551511372577108,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1876 /prefetch:2
          2⤵
            PID:1800
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2228,i,4182841157982489841,8390064551595808409,524288 --field-trial-handle=1880,i,7103977516870537420,9017551511372577108,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:3
            2⤵
            • System Time Discovery
            PID:4696
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,16229397124022857155,3533238953362055247,524288 --field-trial-handle=1880,i,7103977516870537420,9017551511372577108,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2528 /prefetch:8
            2⤵
              PID:1544
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,5942866173465733052,17612031082787188047,2097152 --field-trial-handle=1880,i,7103977516870537420,9017551511372577108,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
              2⤵
                PID:3304
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3404,i,15738011107899679743,2233486803477891315,2097152 --field-trial-handle=1880,i,7103977516870537420,9017551511372577108,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3432 /prefetch:1
                2⤵
                  PID:2916
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4532,i,5478541601554895117,3124187487674689421,2097152 --field-trial-handle=1880,i,7103977516870537420,9017551511372577108,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4568 /prefetch:1
                  2⤵
                    PID:4296
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4740,i,3445244063545835445,4498713564255976859,524288 --field-trial-handle=1880,i,7103977516870537420,9017551511372577108,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4756 /prefetch:8
                    2⤵
                      PID:1584
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4828,i,18317500375415328964,1477466409670435595,2097152 --field-trial-handle=1880,i,7103977516870537420,9017551511372577108,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4868 /prefetch:1
                      2⤵
                        PID:4876
                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                      1⤵
                        PID:1252

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            BookmarkMergedSurfaceOrdering
                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                            • Size 6B
                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                            • MD5 SHA1 SHA512
                            Submit Download

                            f_000007
                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
                            • Size 335KB
                            • SHA256 510937c81cb1a502119ab143419709b78c971a487406b87287e5d0e818995e9a
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            the-real-index
                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                            • Size 144B
                            • SHA256 865f3e46d8f95ef3781970705e103688a4226ebf7e70a02d505ddce990197e34
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            data_1
                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
                            • Size 264KB
                            • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            Network Persistent State
                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                            • Size 2KB
                            • SHA256 74a8958a6add314e53f5445dd6c6f6dacd065959edd920ee03179c95d96fff36
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            SCT Auditing Pending Reports
                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                            • Size 2B
                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                            • MD5 SHA1 SHA512
                            Submit Download

                            TransportSecurity
                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                            • Size 523B
                            • SHA256 1a6ada68bdb003c4d83fc0a52775af481aaceae4c0eecf063ee1894955f38c50
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            Preferences
                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                            • Size 12KB
                            • SHA256 61c0329736335517a64f42687f1b295ed333a818c9a90119f14c72c173d5fd84
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Secure Preferences
                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                            • Size 11KB
                            • SHA256 df3f3d7e8eb52eb11376e73179228426d3d2d5efef9c19d4d305887505e18b02
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Local State
                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                            • Size 115KB
                            • SHA256 d092c782c44bce39ce289de0d97bce56d31cad6a5944247ff2e548814d8856cc
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Local State
                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                            • Size 116KB
                            • SHA256 52c194b4bace9e3e75e9b4a9a714a5f4525c1fea11c28a33cc2f4dcd32b818b3
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            memory/1252-12-0x00000184AAC50000-0x00000184AAE34000-memory.dmp
                            Download

                            memory/3632-0-0x0000025895AF0000-0x0000025896138000-memory.dmp
                            Download