Analysis
- user interaction
yes - max time kernel
1799s - max time network
1794s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
22/09/2026, 09:09
General
- Target ungoogled-chromium_153.0.8010.47-1.1_installer_x64.exe
- Size 121.6MB
- Sample260922-k4e3qsce23
- SHA256 e93b38da59580cc4ac3179d53944781ab02c987353ef935cd92d891e02856f5e
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 11 IoCs
- Loads dropped DLL 25 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ungoogled-chromium_153.0.8010.47-1.1_installer_x64.exe"C:\Users\Admin\AppData\Local\Temp\ungoogled-chromium_153.0.8010.47-1.1_installer_x64.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CR_C2A14.tmp\setup.exe"C:\Users\Admin\AppData\Local\Temp\CR_C2A14.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\CR_C2A14.tmp\CHROME.PACKED.7Z"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CR_C2A14.tmp\setup.exe"C:\Users\Admin\AppData\Local\Temp\CR_C2A14.tmp\setup.exe" --verbose-logging --create-shortcuts=0 --install-level=03⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe"C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe" --from-installer3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe"C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --metrics-shmem-handle=1836,i,9369154447910731103,14909989013227218133,524288 --field-trial-handle=176,i,3965765928159437712,3948779263926285682,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5151675094378201328,15480059826225702590,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2168 /prefetch:114⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
-
-
C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe"C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1568,i,12618137058630605239,15173100615117584418,262144 --field-trial-handle=176,i,3965765928159437712,3948779263926285682,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5151675094378201328,15480059826225702590,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2132 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe"C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2576,i,14010076527812785745,11871117896500171346,524288 --field-trial-handle=176,i,3965765928159437712,3948779263926285682,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5151675094378201328,15480059826225702590,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2588 /prefetch:134⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe"C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe" --type=renderer --top-chrome-webui --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3368,i,3717878816851931186,3374698314128806064,1572864 --field-trial-handle=176,i,3965765928159437712,3948779263926285682,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5151675094378201328,15480059826225702590,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3372 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe"C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3612,i,13282288416330030213,16826041541409946359,1572864 --field-trial-handle=176,i,3965765928159437712,3948779263926285682,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5151675094378201328,15480059826225702590,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3652 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe"C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3628,i,16707432685576526013,12022184336527876736,1572864 --field-trial-handle=176,i,3965765928159437712,3948779263926285682,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5151675094378201328,15480059826225702590,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3676 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe"C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5492,i,4128062804073943253,14283817278367839504,524288 --field-trial-handle=176,i,3965765928159437712,3948779263926285682,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5151675094378201328,15480059826225702590,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5496 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe"C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=WAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAAAAAAAAAAAADgAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAADAAAAAEAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=d3d11-warp-webgl --metrics-shmem-handle=260,i,3777588736333347003,10426401582231974920,262144 --field-trial-handle=176,i,3965765928159437712,3948779263926285682,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5151675094378201328,15480059826225702590,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5380 /prefetch:104⤵
- Executes dropped EXE
- Loads dropped DLL
- Network Service Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub notifications1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
chrome_100_percent.pak
chrome_200_percent.pak
chrome_elf.dll
d3dcompiler_47.dll
dxcompiler.dll
dxil.dll
icudtl.dat
en-US.pak
resources.pak
v8_context_snapshot.bin
2456_13434541899345448.pma
5036_13434541899410374.pma
chrome.exe
am_MASCULINE.pak
index
MANIFEST-000001
Google Profile.ico7800f8ca-c0bb-4932-8016-67340596653c.tmp
Preferences
Preferences
CURRENT
fc05ba67-faab-4675-86d1-4c563228cf78.tmp
data_0
data_1
data_2
data_3
Local State
Local State
Local State
setup.exe
Chromium.lnk
Chromium.lnk
memory/3820-1690-0x000001B39A780000-0x000001B39C02F000-memory.dmp
memory/3820-1685-0x000001B398740000-0x000001B398741000-memory.dmp
memory/3820-1683-0x000001B398740000-0x000001B398741000-memory.dmp
memory/3820-1684-0x000001B398740000-0x000001B398741000-memory.dmp
memory/3820-1678-0x000001B398740000-0x000001B398741000-memory.dmp
memory/3820-1679-0x000001B398740000-0x000001B398741000-memory.dmp
memory/3820-1677-0x000001B398740000-0x000001B398741000-memory.dmp
memory/3820-1689-0x000001B398740000-0x000001B398741000-memory.dmp
memory/3820-1688-0x000001B398740000-0x000001B398741000-memory.dmp
memory/3820-1687-0x000001B398740000-0x000001B398741000-memory.dmp
memory/3820-1686-0x000001B398740000-0x000001B398741000-memory.dmp
memory/4136-1636-0x0000015E9D070000-0x0000015E9E91F000-memory.dmp
memory/4136-1627-0x0000015E9D070000-0x0000015E9E91F000-memory.dmp
memory/4136-1637-0x0000015E9D070000-0x0000015E9E91F000-memory.dmp
memory/4136-1622-0x0000015E9D070000-0x0000015E9E91F000-memory.dmp
memory/4164-1803-0x0000020EDE450000-0x0000020EDE47C000-memory.dmp
memory/4164-1805-0x0000020EDE9D0000-0x0000020EDE9D8000-memory.dmp
memory/4164-1804-0x0000020EDE9A0000-0x0000020EDE9AA000-memory.dmp
memory/4164-1807-0x0000020EFA000000-0x0000020EFA0A8000-memory.dmp
memory/4164-1808-0x0000020EF8AB0000-0x0000020EF8AD2000-memory.dmp
memory/4164-1809-0x0000020EF8A90000-0x0000020EF8AA4000-memory.dmp