Analysis
- geolocation tags
asiadelhiinindia - max time kernel
26s - max time network
27s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/08/2026, 21:46
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://Youareaidiot.cc
Resource
win10v2004-20260513-en
12 signatures
900 seconds
General
- Target http://Youareaidiot.cc
- Sample260831-1m2heafk21
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4652 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326864399625639" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4492 chrome.exe 4492 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe - Suspicious use of AdjustPrivilegeToken 52 IoCs
description pid Process Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4492 wrote to memory of 3120 4492 chrome.exe 85 PID 4492 wrote to memory of 4104 4492 chrome.exe 86 PID 4492 wrote to memory of 4104 4492 chrome.exe 86 PID 4492 wrote to memory of 4652 4492 chrome.exe 87 PID 4492 wrote to memory of 2552 4492 chrome.exe 88 PID 4492 wrote to memory of 2552 4492 chrome.exe 88 PID 4492 wrote to memory of 4380 4492 chrome.exe 89 PID 4492 wrote to memory of 2464 4492 chrome.exe 90 PID 4492 wrote to memory of 4380 4492 chrome.exe 89 PID 4492 wrote to memory of 2464 4492 chrome.exe 90 PID 4492 wrote to memory of 3320 4492 chrome.exe 95 PID 4492 wrote to memory of 3320 4492 chrome.exe 95 PID 4492 wrote to memory of 2004 4492 chrome.exe 96 PID 4492 wrote to memory of 2004 4492 chrome.exe 96 PID 4492 wrote to memory of 3588 4492 chrome.exe 97 PID 4492 wrote to memory of 3588 4492 chrome.exe 97 PID 4492 wrote to memory of 4528 4492 chrome.exe 100
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://Youareaidiot.cc1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa00d4c728,0x7ffa00d4c734,0x7ffa00d4c7402⤵PID:3120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,2115900705527743497,8676192712939828105,262144 --field-trial-handle=1964,i,14062796797459028403,12564632244022489437,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1960 /prefetch:22⤵PID:4104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,12058748133494722977,4872335507497920247,524288 --field-trial-handle=1964,i,14062796797459028403,12564632244022489437,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2296 /prefetch:32⤵
- System Time Discovery
PID:4652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,8846881839030807024,10211595868763651403,524288 --field-trial-handle=1964,i,14062796797459028403,12564632244022489437,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2512 /prefetch:82⤵PID:2552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3124,i,10110231402285036432,13498001176320623498,2097152 --field-trial-handle=1964,i,14062796797459028403,12564632244022489437,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3148 /prefetch:12⤵PID:4380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3144,i,7945928158569084686,1038327323353423646,2097152 --field-trial-handle=1964,i,14062796797459028403,12564632244022489437,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3168 /prefetch:12⤵PID:2464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4524,i,1024811861054187410,5868216639030495373,2097152 --field-trial-handle=1964,i,14062796797459028403,12564632244022489437,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4536 /prefetch:12⤵PID:3320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3908,i,4888882312329877457,16888142366394211148,2097152 --field-trial-handle=1964,i,14062796797459028403,12564632244022489437,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3436 /prefetch:12⤵PID:2004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4972,i,7197829057199491697,8761137757239812942,2097152 --field-trial-handle=1964,i,14062796797459028403,12564632244022489437,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4984 /prefetch:12⤵PID:3588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5684,i,7460613181997344753,1894190910108945088,524288 --field-trial-handle=1964,i,14062796797459028403,12564632244022489437,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5596 /prefetch:82⤵PID:4528
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4248
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1608
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 9ed253cbd42d947bd0536b9c822dbe45b96b8e64ff32f30544096cd973a05629
- MD5 63163696e6a3f67a1566bed77758f529
- SHA1 8cfe9e9621ef43b34eb1456bb78a5ddf2ac72169
- SHA512 3933bc770ffb7a3981be207753db88fb8b7b2ea5c20b7220c798688cc8eba19181cca098daf79e050c150114d38363322a8a047d02f4262fbb4d5b325f6b40f3
- TLSH T15FE02BB9CDA1FC2B19FE1718A0518786E610239B2A80494B763C850C8FF0B3B5649C5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 cd69494d5c7a9e4623c814549b674b33c1402bf028346e1be822f8c534637af2
- MD5 c86f3703b02540eeb38133b701599198
- SHA1 a4f34d8846e37b6e59490ad5207319f3f1c6f993
- SHA512 2c7ee1fad001ba5d384bc5c4f34a133d9411fca1337d6e6ffdc6c476be498185892cd8622bd4a2dd0716896be378ebe1457180f1e3ecf1c61e8f33c8d9a5269b
- TLSH T1593168B7C7D8857D890156F5BB156E1FCE290D14532C3C5AC8D4EE0B53E18B1D24068F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 fa6f7f4f441a51ba467c396d63b99d7b09c25f0ac0a9b081a56f860fb5aec0c5
- MD5 ef369af7eed6cf386c2926f60c5c7bdd
- SHA1 9b53ac3f48fcade50ceaab02add55a4ea78290e9
- SHA512 7febc821afa172a75e276abd0dcb0c361a98dbb5b65f55e94de0bd1d74fa55bec3e2b5d710f81a8f0d067c0899d90b6eb396de43d81f7f32342a5490b6fddd74
- SSDEEP 192:6RNyHIgIv72vAPRp2nqvN9THhrb+WNKUmIpCtQ/2IZqTkw7VyIsnAUge:6RNyoPC6Xh1FfQ+2RTde
- TLSH T1E742B62EAD10397B5DDBC219FA21B757E7F5103125D42E84EAFC892C18E75CC222741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 11KB
- SHA256 df3f3d7e8eb52eb11376e73179228426d3d2d5efef9c19d4d305887505e18b02
- MD5 cf7fedf8f7d2c16e2ee32aeccb0d6abd
- SHA1 c0965f169b36b690aaf700b8f80359944a908774
- SHA512 0f7e0c7f513e4fbb8754c44a17604a17a368e18bf06088e8c92d246667c4707e4e019b978bfef2975410552144093cebfb7ef11074676b8e4908dde7b23f6a1f
- SSDEEP 192:ee14K6IW7KxkXqK4I40pUZNCgVLHrKHfFKslEK2cXzKD/Ty+ErUkKN9H9IB3Wh/+:/1jbW7KxkXqKf/pUZNCgVLH2Hfgslqcx
- TLSH T16F32C727948D9A3F4FECD55CDC526F4F6DB1029272780C2896FB9C0403A97CE115A1AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 6585d4dc004f3b21816c0fe14d8e37213b49c8733ed741db04a93b764b4891e3
- MD5 b609b3540f1f4c269470acb2add8929e
- SHA1 cae4242edbcc582b373d5f70925495d8a0137406
- SHA512 6e72ecbc3078d69e8a9231d4a5ceda94247ff175761d4d50e2a5e4275cce74ee267bfc5a7ef7dcb43eff96ec4ba19de8a41ab8ead75d3536feb83fda20d9c999
- SSDEEP 3072:5tGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:5km7Rkm1tYpBeh2BAom
- TLSH T10AC3123B5D74A83759B9B71EB08E0B1F1EF14AA6C830DE52C8E85A0437EA7CC1A45D34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 de1883e47d17f3608f6c6474562c7df4d516feb6c5bfce78a3f231574e620e5b
- MD5 eb4510e14a26f475984dc2541c29072f
- SHA1 0ede5b1acad1d044205525189ca166737faf4474
- SHA512 bdeb7edd0f96b2450589b9d2f5d22256a54b87ca53cb7a8982e0c260e381ad1520512f9409d50b16d9b2b58f29bf7de6145fcff76d5a72fcf724a1fa3e25198d
- SSDEEP 3072:BGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:Qm7Rkm1tYpBeh2BAom
- TLSH T123C3123B5E70E9775979A74EB08E0B1F1EF14AA2D930DA42C8D85A0437FA7CC1A45D34
- MD5 SHA1 SHA512 SSDEEP TLSH