c04eb3cd713c71bec8c115ffcc40a627cabae8075b87c37d3fb2af565c96eae6

Analysis

geolocation tags

asiadelhiinindia
max time kernel
58s
max time network
58s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 14:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.html
Size 326KB
Sample260919-scvm4sdj4v
SHA256 c04eb3cd713c71bec8c115ffcc40a627cabae8075b87c37d3fb2af565c96eae6
MD5 42bada1da53c5ce0e4b0e89994981c26
SHA1 098345a60fde099bfd8067181426988a2dd3eecf
SHA512 345f2dcd68809202df558aa87789ee696e269456369bfd02a1a53009c74a279c6b7963867e2dc31a10008cf05e789da7e23ce8e90a1b328633890caa18dbbfae
SSDEEP 3072:IYngAkHnjzxQ6KSAiTEHF88aW+LN7uxRLlzglKRf23sqk:DgAkHnjzxQBSA3l88CN78BRf23Vk
TLSH
T13B643C25E5D2607F682B8033F27F3318B73FA483A101C965BA1CC5E5AFD19862177B99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6132	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5292	chrome.exe
5292	chrome.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid
4
4
4
4
4
4
4
4
4
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 5292 wrote to memory of 1300	5292	chrome.exe	90
PID 5292 wrote to memory of 6132	5292	chrome.exe	92
PID 5292 wrote to memory of 1876	5292	chrome.exe	93
PID 5292 wrote to memory of 1876	5292	chrome.exe	93
PID 5292 wrote to memory of 2756	5292	chrome.exe	95
PID 5292 wrote to memory of 2756	5292	chrome.exe	95
PID 5292 wrote to memory of 5548	5292	chrome.exe	97
PID 5292 wrote to memory of 3232	5292	chrome.exe	96
PID 5292 wrote to memory of 5548	5292	chrome.exe	97
PID 5292 wrote to memory of 3232	5292	chrome.exe	96
PID 5292 wrote to memory of 5972	5292	chrome.exe	98
PID 5292 wrote to memory of 5972	5292	chrome.exe	98
PID 5292 wrote to memory of 3080	5292	chrome.exe	99
PID 5292 wrote to memory of 3080	5292	chrome.exe	99
PID 5292 wrote to memory of 3932	5292	chrome.exe	101
PID 5292 wrote to memory of 4964	5292	chrome.exe	102
PID 5292 wrote to memory of 4368	5292	chrome.exe	103

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\file.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd639dc728,0x7ffd639dc734,0x7ffd639dc740
  2⤵
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1984,i,5462216768283809508,11997769927139812419,524288 --field-trial-handle=1896,i,3705784074118352369,14096078150723864342,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1584,i,7435723580832806286,11556732588159526947,262144 --field-trial-handle=1896,i,3705784074118352369,14096078150723864342,262144 --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:1876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,16246117858361150754,4747664252160255115,524288 --field-trial-handle=1896,i,3705784074118352369,14096078150723864342,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:13
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,8788474128678697310,7355471491538359736,2097152 --field-trial-handle=1896,i,3705784074118352369,14096078150723864342,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3140,i,8830328964010540397,17382249635921604012,2097152 --field-trial-handle=1896,i,3705784074118352369,14096078150723864342,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4700,i,7901493319432018429,10354541931745026221,2097152 --field-trial-handle=1896,i,3705784074118352369,14096078150723864342,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4836,i,2181756943391171246,9527013797216956341,2097152 --field-trial-handle=1896,i,3705784074118352369,14096078150723864342,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,9455827713220443837,9560255585200831730,524288 --field-trial-handle=1896,i,3705784074118352369,14096078150723864342,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,5145366571467853189,1563823838672609864,524288 --field-trial-handle=1896,i,3705784074118352369,14096078150723864342,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
  2⤵
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,2172477219063334675,7330793770497141119,524288 --field-trial-handle=1896,i,3705784074118352369,14096078150723864342,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:4368

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a3a8e64dc583f684f60f6a65a570a634a248a4b643e7dfc85f244a3660432ee8
MD5 7f11bd5ea25f705dce16cf4728edbd1b
SHA1 ee8e099240111881a5ee446394bdaa0ef1274663
SHA512 087d1125e1579364eb3f3ef67298571dd886571419407386993757058113434f5de1a2384b787ca38722b44e9be8cbe491d8b63f3d149bb1d1372bc487218e16
SSDEEP 192:SRjb3oHiv7E/vAPRp2Ra97Hsb+WNna84PavskwHVyIsnAUgR:SRjbauq6XPVwaPPzBR
TLSH
T1C332942EAE10757B5CDAD229FA657B63D3F6102121992E84E6FC8A3C20E79DC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 8ecec3486058d289197fbeb84d0c1ca1eb76d36f8a5c15dbdca36446173499c8
MD5 1112b8b6b24653073bb47f28ff80cdb5
SHA1 cc1d6533379aa8cfeefe7049b02cb11f5401a0f3
SHA512 a973fcd153230d12f42cdae4fa8e5f984c00c7f30787b691c7077a38032d9c12d1f98439454f02d931adc956778ed5698f41c2f7ef5cdedeffe784fed491dd77
SSDEEP 192:eqB4K6uU7KxkXqK4I40pUZNCgVLHrKHfFKslEEEmXzKD/lc+ErUkKN98+LIsG/hA:vBjNU7KxkXqKf/pUZNCgVLH2HfgslGmQ
TLSH
T1F632D91B988D6A7F4FD8D54DCC53AB8B6DF4019672680D2452FB9C0803A578A124E6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 bc7249522bd55303d2e8cf3dc709943130fe22b37f06975eaa6d96a597700c11
MD5 8e75990c0f44c411ef9a8ec5a9dae6ce
SHA1 c5844864980754ddc60af26d0140275151d1120e
SHA512 31a4765d6066a16f88d907f973bfbfe9e884eebb0d58c773a6f7685950ff9d15c3e55fa33cd62e23fb4386ef1b28b2942f39c359becffa723e901d9396344f43
SSDEEP 96:eIlC0d+pK242KafJf1O35HSl8h4otop5lzDVB6rGyv+msQxwzmReXYQoe0j9I60L:ZlC0bt8OLiU29rz0HxboXYQoeUJ0L
TLSH
T14EC10875B8AC58B659F2E5A0B1033E83DEF532975164AF94DEDA0E2910E70F80382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 2848ccdc812259add76bb7ae5ae69ee0d8a7dd6f72542ace659f368c88dd03fa
MD5 aa1b3700e3fd533b019b9f30c405599c
SHA1 32b1dc579638c94fedf6dfc3c72888d900562474
SHA512 df1bdd18a5b9da52d3b4f5a5bc324d0a771c780f8bc176f9557be6ffd888fdde17a895610aaa6ce4d5a80d04166d445090c48937275cdb4b91bef28a3621f4e6
SSDEEP 96:eIlbJ0d+pK242KafJf1O35HSl8h4otop5lzDVB6rGyv+msQxwzmReXYQoe0j9I6W:Zlt0bt8OLiU29rz0HxboXYQoeUJ0L
TLSH
T111C11874B86C58B659F2E5A0B1033E93DEF532975164AF90DEDA4E2910E70FC0382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 c5ff974f6d01b47f0edbc749049f3fcd2db1087bcd7e71954b389435c5f71cb8
MD5 e46842c25df768e3cabd0cfd25965077
SHA1 7c93615825e39d5f902aacf1f0659bcf07fff160
SHA512 58a7234bc28bb530128c15b95a7788d0c429c87a5131f8351f3ff3e6f36830ea8a97202251535049e3356e40dc2a434348064370b7b1a75038cfe758416b7dc7
SSDEEP 96:eIlC0d+pK242KafJf1OIu5fksRDotok5lsDVB6qpGyv+7kho0bZV4a:ZlC0bt8OI8lDUDcrPUhkho0b3
TLSH
T129A11974E96C99B728B6D584B6422F43DFB932676162DFC4DCDD1A2D20EB1F80382613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download