Analysis
- geolocation tags
nanew-jerseynorth-americaunited-statesususa - user interaction
yes - max time kernel
28s - max time network
26s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/10/2026, 04:20
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.blackprimehouse.com.br/works39330/adoreader.html
Resource
win11-20260911-en
9 signatures
150 seconds
General
- Target https://www.blackprimehouse.com.br/works39330/adoreader.html
- Sample261002-eye8naxtc1
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3780 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3876 chrome.exe 3876 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe - Suspicious use of AdjustPrivilegeToken 56 IoCs
description pid Process Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3876 wrote to memory of 588 3876 chrome.exe 79 PID 3876 wrote to memory of 3780 3876 chrome.exe 80 PID 3876 wrote to memory of 628 3876 chrome.exe 81 PID 3876 wrote to memory of 628 3876 chrome.exe 81 PID 3876 wrote to memory of 2620 3876 chrome.exe 82 PID 3876 wrote to memory of 2620 3876 chrome.exe 82 PID 3876 wrote to memory of 3000 3876 chrome.exe 85 PID 3876 wrote to memory of 3000 3876 chrome.exe 85 PID 3876 wrote to memory of 4960 3876 chrome.exe 86 PID 3876 wrote to memory of 4960 3876 chrome.exe 86 PID 3876 wrote to memory of 4236 3876 chrome.exe 87 PID 3876 wrote to memory of 4236 3876 chrome.exe 87 PID 3876 wrote to memory of 1888 3876 chrome.exe 88 PID 3876 wrote to memory of 804 3876 chrome.exe 90 PID 3876 wrote to memory of 804 3876 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.blackprimehouse.com.br/works39330/adoreader.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff842fbc728,0x7ff842fbc734,0x7ff842fbc7402⤵PID:588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1920,i,5071497918102819198,409973176874976923,524288 --field-trial-handle=1960,i,14922776860268205017,9214857034975733547,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2028 /prefetch:112⤵
- System Time Discovery
PID:3780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,8409983919535351710,15028394894030983278,262144 --field-trial-handle=1960,i,14922776860268205017,9214857034975733547,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1956 /prefetch:22⤵PID:628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,13163996044672701060,13671842188567268787,524288 --field-trial-handle=1960,i,14922776860268205017,9214857034975733547,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2384 /prefetch:132⤵PID:2620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,1418703420144421593,5091492272152418290,2097152 --field-trial-handle=1960,i,14922776860268205017,9214857034975733547,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:3000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,2694388771253440762,17020759932589956177,2097152 --field-trial-handle=1960,i,14922776860268205017,9214857034975733547,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:4960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4368,i,2532734759911435846,928537075968573015,2097152 --field-trial-handle=1960,i,14922776860268205017,9214857034975733547,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3968 /prefetch:92⤵PID:4236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,6619616163972089509,16830610212538366565,524288 --field-trial-handle=1960,i,14922776860268205017,9214857034975733547,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5488 /prefetch:142⤵PID:1888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5696,i,16789086492835373336,1684299387513593241,2097152 --field-trial-handle=1960,i,14922776860268205017,9214857034975733547,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5712 /prefetch:12⤵PID:804
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3136
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3372
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\41f7ad0f-9bf9-47c6-9907-2a590ab0aef3.tmp
- Size 130KB
- SHA256 9c789fa55e442416fa371d1a12d85a3e0df50aee09f5a000fa744f6e4903a4bc
- MD5 06683cc4558ac0018f96a242de3f078b
- SHA1 4283f9f320cd28f796601441f81d7ee1c47dc058
- SHA512 dc83701db527a7848b9ccda0e4774e612299d0e980e4e2299beb519cf175105f0cdfc1aece7ddeddad56a1132aab3e3b3d2f532eb2c0fb803f3be069ecafc4a5
- SSDEEP 3072:H+H2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjP:Hut4fLJ0L6nGJxi3bzqapJjP
- TLSH T152D312F1D1A0AC7ACBB7EE4145755E948E71D5C289CDBE2408ED8C1816CEA354E13EA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\30e8cae3-e6f8-4f03-a09b-afa77bfbf5d7.tmp
- Size 649B
- SHA256 c4e1e3c8a92ddb2ca651a1fd302112a7e4ab49601bea3f14da9e7ed598c5da1d
- MD5 9b10ccd354abe356cc1e037d25296938
- SHA1 d9242ef289a07aa262f7aba07de10311045892fc
- SHA512 8f8d80b4bf3ba6ca195e5d8f2dd2bef1843088c278b50600bc6bd66189f75b3a90deb860257f43f2aeb3fdb39b6963533e1d294540b6d890da59080344d918b3
- TLSH T1E6F028B6D821BC2B18FD0F1960950B8AF751236B2B40899F3B3D911E8FB5B3B459985C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\69d4a100-3cc5-495f-aa18-0822ee1e0fcb.tmp
- Size 17KB
- SHA256 00b1f5e3f2ee15e41635cc5776beecab26489b83cc8da1b01e578cec0f125545
- MD5 4c845b2618eefdd47280df258df1e5fa
- SHA1 90d6142c1453e2f700bea476669cfb9e36befbb6
- SHA512 4f4b1bf9d6b776e477d3ad3578fd52d3bab53a83694fa9eecdba8eabeff22ee1e9679f0c42ddd6998d0b7c0b64c1dbe2a8235c40f3d2f87323a4df5053bd2ddf
- SSDEEP 384:wGjUD7KxkXqKf/pUZNCgVLH2HfgslMl7pLuLceSOPXODU/+ErU36GHGiGTE9t:wmUD7KxkXqKf/pUZNCgVLH2Hfgsml7pT
- TLSH T11872FA67AC4C9E3B0F94CACDDC167A4FACB5024B65E9886443FA5C2903D5ADF110A2F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\806781dd-248a-48f4-b63c-8eec161aba7c.tmp
- Size 12KB
- SHA256 1f9b50d7ebdf60170ae94ba22c57b8d7792c6947eed48ff8bd42910b2823081d
- MD5 98a0b53c1de86d52fcb3124fae47e53b
- SHA1 5534800acdb455507adad68527380cbd580544b2
- SHA512 8439eb28dd1bd41a43474fe83d50686d3ef4123f992effd9cb299942ffbf263c0828b794ea137acaf3d34fccee7f79202d4230c9319cf5cf3ca2d4ab2abb0e0e
- SSDEEP 192:xRnKLyX0J/nv7fpAPRp2Bv9UHsb+WNnTlA+me8r28EkwlVyIsnAUge:xRnKI6vjUXAWwJMey2Jze
- TLSH T17342A42EED10797F9CEBD22AF9227667E7F5102160A42EC4E6F8893C15EB5CC2213417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\95bcfb55-6217-47c3-a201-05e5acfcc395.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
- Size 120B
- SHA256 3be9c2402bfd440b1d6aa3fa102e90796d65c001697126ddfb6a80c06e2c257a
- MD5 ea98bf7446865a10085f8db294418196
- SHA1 b1f412be732c2a48fa1414285805f9c68d1a1ae0
- SHA512 1292161996195982633d15ac360ade5565e656931d1b700644b6cc3ba6a816fa5cf09f1bab0c57facb631de0c83f23741a83262e91f70182f200c523785bba96
- TLSH T107B01219804B2322C00103F0215090683360DF3DD112178581E00D03A8311608057108
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 96B
- SHA256 936e3a85f5c9efbce7c47bc523f19a740ee17fbc8cfb029b88ebc32cf2e6b526
- MD5 e4741dc047c37f283c69d97aa6b04550
- SHA1 bf280b1fa224d0354a831bef2f0bac0a6a651033
- SHA512 47be5e1566fb3e21bff35ab9709ea1f3de64735c882457ad8be7c7373d1c67afc7297f50609b69761622c6c2dd5cd5049d74c445978e8d8e2b9b3f26a8b1ac93
- TLSH T19AB00275C123A327C04213F0699997D87174FF6EC71316A696F81F66EC35660452A560
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bd9a72a7-3363-49bc-be8f-c7ca9ea2831d.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d6d6f85e-fe15-4adc-8020-724dd438cb7c.tmp
- Size 12KB
- SHA256 ca766deeab8179bc534142801b20fe5209a14cc9acaac69fb8b4ccf2b53bc288
- MD5 ab62bc4d8673271c5b0ea828c42336ac
- SHA1 9cd1b4f12f76f83ca496b380cc1f87c0a655e692
- SHA512 be3d37e3b885ff3817ceac2c68730555d6cba4fd89f5d8bc99cccf5bd68fd6862796d37752eb725964b0d26d52aa9715799e6705ecbbe09f8e58436232e0d845
- SSDEEP 192:xRnKLyX0J/Cv7fpAPRp2Bv9UHsb+WNnTlALL2Lr28EkwlVyIsnAUge:xRnKI6OjUXAWwJQ232Jze
- TLSH T19942A52EED20793F9CDBD22AF9227667E7F5102160A42EC4E6F8893C15DB5CC2213417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a0921ff8-d62e-4910-ae8b-86103f530df9.tmp
- Size 131KB
- SHA256 f46d6fe7c5a1183e92fc5ac3f36c7e416cef0dfa29f0f182bb7d35091a576443
- MD5 2fffe8c4e282de2bcfebd8b1c37c80f8
- SHA1 96159c59297606c8249205e56f7777182896aedd
- SHA512 07e7737665cfdae609867d00eefdf1fd817db33246579b177983759ecf115b613ac1f9b64d068424c78a133e11f642a9558a682bae64fc644256412de4963c0f
- SSDEEP 3072:DkVH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjP:Dk7t4fLJ0L6nGJxi3bzqapJjP
- TLSH T141D312F1D1A06C7ACBF7EE5145756E948EB1D5C289CDBE2409E98D1802CEA344E13EB3
- MD5 SHA1 SHA512 SSDEEP TLSH