Analysis
- geolocation tags
nanew-jerseynorth-americaunited-statesususa - user interaction
yes - max time kernel
26s - max time network
28s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
19/09/2026, 04:48
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://marycar.com.br/Adobe/Acrobat_Reader/
Resource
win11-20260911-en
11 signatures
150 seconds
General
- Target https://marycar.com.br/Adobe/Acrobat_Reader/
- Sample260919-ffa2nabd56
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 5560 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134342669157406533" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3220 chrome.exe 3220 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe - Suspicious use of AdjustPrivilegeToken 52 IoCs
description pid Process Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3220 wrote to memory of 6004 3220 chrome.exe 80 PID 3220 wrote to memory of 2960 3220 chrome.exe 81 PID 3220 wrote to memory of 5560 3220 chrome.exe 82 PID 3220 wrote to memory of 2960 3220 chrome.exe 81 PID 3220 wrote to memory of 3944 3220 chrome.exe 83 PID 3220 wrote to memory of 3944 3220 chrome.exe 83 PID 3220 wrote to memory of 904 3220 chrome.exe 84 PID 3220 wrote to memory of 904 3220 chrome.exe 84 PID 3220 wrote to memory of 2884 3220 chrome.exe 85 PID 3220 wrote to memory of 2884 3220 chrome.exe 85 PID 3220 wrote to memory of 572 3220 chrome.exe 87 PID 3220 wrote to memory of 572 3220 chrome.exe 87 PID 3220 wrote to memory of 4960 3220 chrome.exe 89 PID 3220 wrote to memory of 3060 3220 chrome.exe 91 PID 3220 wrote to memory of 3060 3220 chrome.exe 91 PID 3220 wrote to memory of 1532 3220 chrome.exe 92 PID 3220 wrote to memory of 1532 3220 chrome.exe 92
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://marycar.com.br/Adobe/Acrobat_Reader/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc9fa9c728,0x7ffc9fa9c734,0x7ffc9fa9c7402⤵PID:6004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1588,i,3745562369143176602,16715069414710714913,262144 --field-trial-handle=1844,i,594822782128519896,14213826641852533155,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=216 /prefetch:22⤵PID:2960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2128,i,2676034511649605624,15190587616261194080,524288 --field-trial-handle=1844,i,594822782128519896,14213826641852533155,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2160 /prefetch:112⤵
- System Time Discovery
PID:5560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,17077040215917520353,8820421196618175425,524288 --field-trial-handle=1844,i,594822782128519896,14213826641852533155,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2200 /prefetch:132⤵PID:3944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3168,i,15613779657356240139,6758519694058873607,2097152 --field-trial-handle=1844,i,594822782128519896,14213826641852533155,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3164,i,5817158081620320051,7725266880503617438,2097152 --field-trial-handle=1844,i,594822782128519896,14213826641852533155,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:2884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4204,i,9018445878695227125,14016103116835992613,2097152 --field-trial-handle=1844,i,594822782128519896,14213826641852533155,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4208 /prefetch:92⤵PID:572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5240,i,11743551747543552306,12638451347667445886,524288 --field-trial-handle=1844,i,594822782128519896,14213826641852533155,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5244 /prefetch:142⤵PID:4960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5816,i,7883667323733144094,9217744559425155872,2097152 --field-trial-handle=1844,i,594822782128519896,14213826641852533155,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5848 /prefetch:12⤵PID:3060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3220,i,16117154196541122297,7350221462514880936,2097152 --field-trial-handle=1844,i,594822782128519896,14213826641852533155,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3712 /prefetch:12⤵PID:1532
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:784
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 649B
- SHA256 ee57394e30325f14957663181cd4d9189a91d9e1f3f0248c326868ded460443c
- MD5 9a5f62fcfdac93131dac3179932fc6e1
- SHA1 1c09f63dfc86879f6d4a5590a851bc45480dfcb2
- SHA512 8b3f7e78115e9a0b5ddcd9bbb5670ec2730f51ba6008183fd90503ccc8a30579291e3df8cd0217d3f62443486d1b6d81dbfc744fce6f6ace0fa49917eb9e9886
- TLSH T1C2F02DBADD21AC7B18FC0B2860B54B4FE755136B2B81994B3B3D420D4FB163B458681C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0acb0881-7372-41ce-a9e3-a9d99cd8208c.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 053a8546eed8ca2906d865d769ea1bf1865e713b8a0a8e8bd7374e720c9c38fa
- MD5 50c9cfe33cba3fca653aae7a645eee6a
- SHA1 b46fda903a5de7bb2e35bb10ff9b04b814ca24a5
- SHA512 e25f5bde924d8dfe73f59b925c60c71ff046c933ba68111379d261dd6681cb5371695d553e1b5c2310c662dbd708ddfbdd14f57c0b2f57cb7969aa18c259949e
- SSDEEP 192:qRCugXIQGiRA9pT9L8nkMay7F/v79fGpAPRp2TQ9+Hsb+WNnlwkr52bCeQpwcVyz:qRC14pg7FXNGUXRow2u2GVe
- TLSH T14242C72DAD14757B6CEAC62AF9657B67D7F5102260D43E80EAFC8A2C20D76CC321741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 52faa1c0a2c145f24cb6bf0e4a48b0237ba969495c82d742d374c6759b4dc290
- MD5 10219fe671f251c5a102a95887dac447
- SHA1 7f90b76134fd16f85ae158bfb5c71425e83ed0ae
- SHA512 caee2e22a50a8965d0fb94b1a22f1071e58b061efd33cb3d9eeb5e5a6d58e48d84366477559486942f9c5103a8a77cad8186aef0b09c97ec8427f2be08e3f9cc
- SSDEEP 384:SEjml7KxkXqKf/pUZNCgVLH2HfgsluN7pLuLceSMtXODml+ErU3I6HGCX2v41q:SIml7KxkXqKf/pUZNCgVLH2HfgsAN7pe
- TLSH T18A720A677C4C9E7B4FA4CA8DD8277E4FACB5024B55D9886442FA5C2603D4ACF11062FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 5513cc6001153c145c47660e0d0bca8e1f103180b21635d9ded32e0e4110e7d6
- MD5 9938f142c80efa6f69dcf7aa2566aef3
- SHA1 8c4a2f53bb28181089e961785a69b2a005e19c56
- SHA512 342137cce9c60b871be9b146328ae43b0823a89822b40b0eb4413ae53804147929476a21dbd676833729abe0f7c0cd0d4f06609e8dd925ecfe3dea3cc40c6d90
- TLSH T1A5B01284C041D311C04203F8215254D83254DF14AA06170151F00D018835151A02F358
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ef4d.TMP
- Size 96B
- SHA256 e76784731e13472ddce6272108f75071658f2f142097686bb064d50c7312f69a
- MD5 cecd09b3e2aa03a603c0a7e58df2e629
- SHA1 38a0a681c3756c283fa391d2a0b379c6fb23829f
- SHA512 b8e6383e5c87b9152f200df216026c4e6d9f3f3a35ec6ebeeb97de527ca1462f10b9af0f3714b38e141e873e3f2d3633c9acd6433426f0f4afbb8227e02a7e3c
- TLSH T14AB02200C0022232C08203B02AC280C83A20CF2AC303230382E00B22CC322300228038
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 131KB
- SHA256 c579d229b76c281e65a5756c30bd972ce94f63a482f1d57a88787b42b2d77770
- MD5 d4216e63fc0d495db0f8d1bdbb7fe156
- SHA1 c6ad766bd6810e230b93969d7fcd50d5b14095b3
- SHA512 2a5c748d1c56f7b90289007d1991e92dd6bfb79ad3973a429138e04df09a6ec220da1a10f6a11c1dd02fc77349927a760918a98cfcacf517ca0870f910d4cec6
- SSDEEP 3072:JGT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXE:JNThDxWhaj5mjie/JYFobx
- TLSH T1AAD31223ACEE01FB14BCC508907D3F0096F985B39640FFA39ADC6A4F61D7EA4A366155
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 132KB
- SHA256 3a5649e99671fe5cb70d21f3e75daf7945f774f3d7c8fe38f7473363b8a7645e
- MD5 80ef489590c15caca6961c377d01af82
- SHA1 2fa4597e7b3b75131ce294751f913e240b3ac816
- SHA512 9490721abdccc3a520d2d808fc74286e248e991c7e04688ce53fb290e35477e47b1a5af1e017b255a29a5efc14eed1ffbd3367aa45377cb4bd426ec5614c219f
- SSDEEP 3072:JRhT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXE:JR6ThDxWhaj5mjie/JYFobx
- TLSH T193D31223ACFE41FB15BCC50890793F0086F985B3D640FF639AE86A4F61C7EA4A35A155
- MD5 SHA1 SHA512 SSDEEP TLSH