hxxps://eb2[.]3lift[.]com/sync?ld=1

Analysis

user interaction
yes
max time kernel
58s
max time network
43s
platform
windows10-2004_x64
resource
win10v2004-20260911-es
resource tags

arch:x64arch:x86image:win10v2004-20260911-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
30/09/2026, 15:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://eb2.3lift.com/sync?ld=1
Sample260930-sw191abe94

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4996	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3608	chrome.exe
3608	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3608	chrome.exe
3608	chrome.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 1660	3608	chrome.exe	89
PID 3608 wrote to memory of 4556	3608	chrome.exe	90
PID 3608 wrote to memory of 4556	3608	chrome.exe	90
PID 3608 wrote to memory of 4996	3608	chrome.exe	91
PID 3608 wrote to memory of 1208	3608	chrome.exe	92
PID 3608 wrote to memory of 1208	3608	chrome.exe	92
PID 3608 wrote to memory of 1808	3608	chrome.exe	94
PID 3608 wrote to memory of 3888	3608	chrome.exe	95
PID 3608 wrote to memory of 1808	3608	chrome.exe	94
PID 3608 wrote to memory of 3888	3608	chrome.exe	95
PID 3608 wrote to memory of 4688	3608	chrome.exe	99

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://eb2.3lift.com/sync?ld=1
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9ad01c728,0x7ff9ad01c734,0x7ff9ad01c740
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,7980238783496383033,13820942961211047528,262144 --field-trial-handle=2016,i,2508213220810766512,18352567467873859829,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2104,i,2275555674202920698,16958433273069952854,524288 --field-trial-handle=2016,i,2508213220810766512,18352567467873859829,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,6534579251842644253,848644282881488496,524288 --field-trial-handle=2016,i,2508213220810766512,18352567467873859829,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,17296318454794497042,16120985077321073261,2097152 --field-trial-handle=2016,i,2508213220810766512,18352567467873859829,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,13318635772155506468,16819249806497106225,2097152 --field-trial-handle=2016,i,2508213220810766512,18352567467873859829,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5132,i,5633796286041337572,14861294863901074200,524288 --field-trial-handle=2016,i,2508213220810766512,18352567467873859829,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:4688

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 3a24863be5ea11855f14cd27d83c7371e984276c40711edb9ed434ffb6bd883d
MD5 5e0cffcd49463323d4b767307f43cdc9
SHA1 e543c17601c45d361515e6f869249c937c210598
SHA512 8b5279d1854c128367a3a0506c20041c84357ac3f84e37a0cae2e36b06240363156d91798523542ca681b16f4aaddd89e7415b80071ad2c0d9c178d5eb7635fd
TLSH
T16CF0F9B5CC21FC7B28FC5B1D20A5574BEB9013572780455F3A3C811D8FB567B468685C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e1e25862ee95bfb940a69d7df613252698250627ebabff6c0a38bd86ac87c3bc
MD5 b79b12f0866817972b7755825ad914f9
SHA1 721b7ed5f9f537db6c185a353df3d85d221107d2
SHA512 d029ca68500ad410c1195ef9b7c13690f6cd1658a153897e41df3a261210f0fe0dd2269ca6ce91ce3d6daf27933156bc912e8d01f17d15e2f2d6ded800648261
TLSH
T15F5169F7C7E8967D891156F4AB156E1ACE7E0A14532C3C26C8D4AE1B53E29B1E20068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 dc36888c3143d72761bac9d4f12341367058877e347552052dec6fbf3c97aed6
MD5 f45cfd43bea35dc585c3d36d468adbd4
SHA1 d933643beda3e053204950fe7af68b3aa5c3cfdf
SHA512 e902dd9ba9cfea3d4c4e43ae5a851394e31d840572cf0a2280454361748888ee75776bdf092c3bacac5af633ce272bcf9927b4970a319bc78e2cf1db21d233be
TLSH
T16CF059A7E37F7827507A85E72D08B84515B6AC3402826CE8DEAB422CB0D90E71B52083
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 4c915a9601690e6ae52ff4dd94bfbbf367a0dd309bf3c81a51e7bb68b2152dae
MD5 84a089f6bbc52ab5724301d74f07812b
SHA1 d7b605619c96f1e74afe6dfae3331d219651229e
SHA512 78fabd85c7295055a5623ce386774d2255ec5b7c083a0ec41932224a9508950d1440d91602656e71a90bbedc5bd568f6c7cd37c51068ce50eebeeffaef3c7628
SSDEEP 192:XRXSDOvv71vAPRp2sY9IHsb+WNnlmxZ8Go2VA2s4kw1Dy+VyIsnAUge:XRXSyn56Xy2wAm262tVu2e
TLSH
T13532812DAD10797B9CDBC32AF965B75BE7F5002231982E84E6F9893C25DB5CC2217807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 69de6dc15114076d475e4d2dcbd4f54f468751981803dff78752531ab5ac90ad
MD5 c653853b21659f0f1a17088bce964c32
SHA1 c9af26cd4f271345652cef22d3ee94263e07c6fb
SHA512 17294d3e2da7c128a1afbab2436f67089293d2f455551945ced92cf318cec61acb969153487bfbefa7e45c0fc427f6d759842991c793ab38adf722dd3735d291
SSDEEP 192:el64K67/7KxkXqK4I40pUZNCgVLHrKHfFKslEz9LXzKD/Qj+ErUkKN9pVS27SS0+:c6jY/7KxkXqKf/pUZNCgVLH2HfgslcLm
TLSH
T13D32D827A44DAA3F4FD8D50DCC12AF4BADF502527368092497FB9D14039A7CA214E6BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 4f2571d0a3207829b030d96bb7ea33437027bcae40c4da2e448482d4bd5f161b
MD5 20209c6a707db4e1ae2ccb80b28ee56a
SHA1 820f134c8bd132b32ca14952a74e4809cc7bbe4c
SHA512 96917800b68bf1e692f6f7cf7b9b0674c57c88fca3432a3f73523e8a28ebb21e465b2cd3340f26d143b0a378c242fa7930db3ab9475ba0e5e242c094c343c034
SSDEEP 3072:dix+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:dix+hFD+7t56OD9ZfSApprr
TLSH
T192D31232AA91D8BBC9FC6541B157A304DE666CED41DE7A09444A5F8EE09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 36cced1bd9b187ea5249932b3b33e7d697173ebe57ded5e8dcce3081cc054128
MD5 35766d4d7d59372bba7792a4548cabd4
SHA1 de0a64214c6a92996a827bcd25263d986940413a
SHA512 52e5eb0bbc7a75ff045878076e0d4b858fe469b1193bccb86c7a10ee4086deef162b4a404aba58e42c67d035cdaf56c0807e70aa052c471acea98efd9eea3dbd
SSDEEP 3072:daj+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:daj+hFD+7t56OD9ZfSApprr
TLSH
T1AED31232AA95D8BBC9FD6541F157A304CE66A8ED41DE3A09444A5F8ED09FC4C07A3E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 83614acd33c4073d29e2e5243e99ea54aff77ec24bf8201b5b95c2ad1769864f
MD5 237ac95ad2f6b3b57425c6673952995b
SHA1 f53de4cc5e9cba52f71927a7379be82a0493341d
SHA512 2212239b0b94383f159d64071b16733d478f062fb1bdca22b2bd479211f0eff86d7ffc7716e2a407a780cf33d9c6f9bdd219ba6f12f38a57f752b24a6ebc2738
SSDEEP 3072:dOq+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:dOq+hFD+7t56OD9ZfSApprr
TLSH
T1DBD31232AA95D8BBC9FD6541F157A304CE66A8ED41DE3A09444A5F8ED09FC4C07A3E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download