hxxp://gbcu[.]org[.]il

Resubmissions

27/08/2026, 04:30

260827-e5bttazanb3

27/08/2026, 04:28

27/08/2026, 04:27

27/08/2026, 04:26

27/08/2026, 04:25

27/08/2026, 04:23

27/08/2026, 02:10

Analysis

geolocation tags

eueuropefrfrance
max time kernel
20s
max time network
23s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-fr
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-frlocale:fr-fros:windows10-ltsc_2021-x64systemwindows
submitted
27/08/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://gbcu.org.il
Sample260827-e2p72axwgx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4704	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322784211237704"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2136	chrome.exe
2136	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 1432	2136	chrome.exe	83
PID 2136 wrote to memory of 1404	2136	chrome.exe	84
PID 2136 wrote to memory of 4704	2136	chrome.exe	85
PID 2136 wrote to memory of 1404	2136	chrome.exe	84
PID 2136 wrote to memory of 2908	2136	chrome.exe	87
PID 2136 wrote to memory of 2908	2136	chrome.exe	87
PID 2136 wrote to memory of 1200	2136	chrome.exe	88
PID 2136 wrote to memory of 1068	2136	chrome.exe	89
PID 2136 wrote to memory of 1200	2136	chrome.exe	88
PID 2136 wrote to memory of 1068	2136	chrome.exe	89
PID 2136 wrote to memory of 4568	2136	chrome.exe	90
PID 2136 wrote to memory of 4568	2136	chrome.exe	90
PID 2136 wrote to memory of 2600	2136	chrome.exe	92
PID 2136 wrote to memory of 2600	2136	chrome.exe	92
PID 2136 wrote to memory of 2452	2136	chrome.exe	93

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://gbcu.org.il
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffb0a64c728,0x7ffb0a64c734,0x7ffb0a64c740
  2⤵
  PID:1432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,14281656610918888153,2758790251497566176,262144 --field-trial-handle=2044,i,4552069636918025030,8489290255805057347,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:1404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2156,i,15067034985634998888,6650218402115104084,524288 --field-trial-handle=2044,i,4552069636918025030,8489290255805057347,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,12502654570090427123,958470109809766184,524288 --field-trial-handle=2044,i,4552069636918025030,8489290255805057347,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3096,i,930204725540310563,1572934263331030934,2097152 --field-trial-handle=2044,i,4552069636918025030,8489290255805057347,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3108,i,6860134781596538084,4069958795047821302,2097152 --field-trial-handle=2044,i,4552069636918025030,8489290255805057347,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4260,i,3867969208508185570,612391703783531578,2097152 --field-trial-handle=2044,i,4552069636918025030,8489290255805057347,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4220 /prefetch:2
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4552,i,4248467279512931874,1962290465261152707,2097152 --field-trial-handle=2044,i,4552069636918025030,8489290255805057347,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5256,i,13364098501038136226,9356896158593963124,524288 --field-trial-handle=2044,i,4552069636918025030,8489290255805057347,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:2452

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5ee5ef36752fc22f41854ae7840b03cacb558a9a25d645536d51b2f832450acc
MD5 05eea54ddb8d93d985c03f90d64d25e7
SHA1 9630de025d5f5e1ce3a0ed34097da2b6db6f449d
SHA512 bf198e8872152b3108778eab80c3ff960d2fef706b87d4c91e2a301c96a611fb2933994d4f3f571e9f48067960bb0615ae13b61937635c4472a35b13cce41614
TLSH
T194E02B69C8A2EC3714FC071A90184B87DB5413962B40895B7A3CD10C8F7173A455681D
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0ea05c0d28a72a8794677aadcaa728196efb45fcddf9809ddd36a51dd5a5c8b5
MD5 6267cd1b9000f9f8097d75d282e0f903
SHA1 731778e61437e52bb89cf6be3f1aae37176d6a35
SHA512 469c53eb4313e7855fe08b9058e7a61a78712608245a4f1c59114f90a95569959e3a7e1be269e6b87342152928036abfccd16b0246c7a6516211043189b23e44
SSDEEP 192:ERhIvn39OL+5v7PpAPRp21K9YHsb+WNnFsSe12RbzPRVyIsnAUge:ERhIPu+ZjUXTWwiB2hLe
TLSH
T18C42D82EBA54697B5DCBD219FD627B47D7F5203221A02DC4E6FC8A2C15EB9CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 22549b4e0bf5beb1f19b4b9744f126efc008fba31b4fb1c008b181befd53403f
MD5 32f63617fa8299a0ee5b7400f64d3ae6
SHA1 8a6dc1f48595bcab5f3f5931bbb4ff3a643bb4b5
SHA512 ffbbb10132c9309217bf54a0eb5ac3c2c91aa1ba29e285035c55b42a75fa190ed7e6a09bad5df7e37b05b04a5df00de2ea11d056b974ef369cc70caa156355c3
SSDEEP 384:bxj3K7KxkXqKf/pUZNCgVLH2HfgslcP7pLKLc4jlAXOD3u+ErU3KWHoujg2kRR:bR3K7KxkXqKf/pUZNCgVLH2HfgsmP7p7
TLSH
T1C372F9A77C4C9E374F94C6CCD8177B4F9DB5015B65E988A443FA981903D8ACE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 44b5f87cda94cbe11132c4f8ef9306dda241d74c74ecc35d0e173eabe086e7e6
MD5 9cd131c55492569d6718a2fd9da509ae
SHA1 4dcec5944bbfffa6937d62e1a09e80f62b3dd66d
SHA512 8ba2b9fcc23bd75822b9851bf6c821105d7936e554532105e480c1ea78ae82b554d51c7cc9999991816dc5c5993df33f9ea7386b8f34586dde4a6b56a54094f9
SSDEEP 3072:0ptGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:0pkm7Rkm1tYpBeh2BAoa
TLSH
T15BC3123B5DB4A83759B9BB4EB08E0B1F1DF149A6DD20DE52C8D85F0423EABCC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 f888312ab06fb507d9009fa7d2bb7506c7c637d2ba362308c6570c44721c759f
MD5 d40a451d7543d0621ecccaa94a29d1e7
SHA1 bb2293e1249236006d855f2ccae838e58cba3a66
SHA512 6519a31daa2b2ba8b8219f4c310df346c271a53b05b557963cf40255ee26844ec5db3045dbaf322c8d21ada1ba5ba822d1bc3032d9fc68f77431a7d96905a207
SSDEEP 3072:2BGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:2Qm7Rkm1tYpBeh2BAoa
TLSH
T1D8C3123B5D75E9375978AB4EB08E0B1E1EF149A6D930DE92C8D85B0437FA7CC0948934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download