Analysis
- user interaction
yes - max time kernel
25s - max time network
25s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
02/10/2026, 15:47
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://easyvotega.com
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
10 signatures
120 seconds
General
- Target http://easyvotega.com
- Sample261002-s8nvfaverf
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 5168 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2728 chrome.exe 2728 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe - Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeShutdownPrivilege 2728 chrome.exe Token: SeCreatePagefilePrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeCreatePagefilePrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeCreatePagefilePrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeCreatePagefilePrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeCreatePagefilePrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeCreatePagefilePrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeCreatePagefilePrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeCreatePagefilePrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeCreatePagefilePrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeCreatePagefilePrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeCreatePagefilePrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeCreatePagefilePrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeCreatePagefilePrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeCreatePagefilePrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeCreatePagefilePrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeCreatePagefilePrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeCreatePagefilePrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeCreatePagefilePrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeCreatePagefilePrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeCreatePagefilePrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeCreatePagefilePrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeCreatePagefilePrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeCreatePagefilePrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeCreatePagefilePrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeCreatePagefilePrivilege 2728 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2728 wrote to memory of 4452 2728 chrome.exe 83 PID 2728 wrote to memory of 3992 2728 chrome.exe 84 PID 2728 wrote to memory of 5168 2728 chrome.exe 85 PID 2728 wrote to memory of 3992 2728 chrome.exe 84 PID 2728 wrote to memory of 1408 2728 chrome.exe 86 PID 2728 wrote to memory of 1408 2728 chrome.exe 86 PID 2728 wrote to memory of 1600 2728 chrome.exe 88 PID 2728 wrote to memory of 1600 2728 chrome.exe 88 PID 2728 wrote to memory of 1768 2728 chrome.exe 89 PID 2728 wrote to memory of 1768 2728 chrome.exe 89 PID 2728 wrote to memory of 1684 2728 chrome.exe 90 PID 2728 wrote to memory of 1684 2728 chrome.exe 90 PID 2728 wrote to memory of 3948 2728 chrome.exe 95
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://easyvotega.com1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x84,0x228,0x7ffe5284c728,0x7ffe5284c734,0x7ffe5284c7402⤵PID:4452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1728,i,1150374020080611195,7713509574377702051,262144 --field-trial-handle=2072,i,5180002047714725537,6065900575360162866,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2056 /prefetch:22⤵PID:3992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=1620,i,15836140432905856687,9166468002334826735,524288 --field-trial-handle=2072,i,5180002047714725537,6065900575360162866,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2224 /prefetch:32⤵
- System Time Discovery
PID:5168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=1956,i,10065216062970389378,11962940272776423566,524288 --field-trial-handle=2072,i,5180002047714725537,6065900575360162866,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2584 /prefetch:82⤵PID:1408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3144,i,11477772549099806829,7099064885225790052,2097152 --field-trial-handle=2072,i,5180002047714725537,6065900575360162866,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:1600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3168,i,12463905439067501732,1277413233149819908,2097152 --field-trial-handle=2072,i,5180002047714725537,6065900575360162866,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:1768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4488,i,16550611812551005464,18261329039915401247,2097152 --field-trial-handle=2072,i,5180002047714725537,6065900575360162866,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4456 /prefetch:22⤵PID:1684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5244,i,4545155334258050932,8091433680929234617,524288 --field-trial-handle=2072,i,5180002047714725537,6065900575360162866,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5164 /prefetch:82⤵PID:3948
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3236
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1140
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4f1e781e-e9aa-4fca-be76-134be212c0c4.tmp
- Size 131KB
- SHA256 836b6b1b9408daff4598460cf87f4680908b55a9c2f6d35be5247cf1c99d5236
- MD5 fcec1a75989ae62b0646f26ef94abc4e
- SHA1 2fba54db7f5446eb84fd3174b6fe812bf1d44bf8
- SHA512 ee917f34d32d41c58d88c9dae95ab4cf1e82a8461fc2c7d1eb5b51322d351d444062c96c6772a6732552ad9f34fd2755adb652936b5d62f590ad03600da439ee
- SSDEEP 3072:ACIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzS:AiPtbmf1K49XLWbEPi4NTKlLzS
- TLSH T161D312613D01BCB8E9EEDB61B1901A15EAF8D90B96393BE61CDE3F4805A36D9C304C53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\342a6610-01ba-4d4e-aba4-669307d090d2.tmp
- Size 12KB
- SHA256 a7083b7b924c08d0ca5049d130592a6345a16dfd4fc02138b6fbbc4657cfc416
- MD5 c9cee6544db9e1b392c8afe6bbbf10b6
- SHA1 6cc46f84ab7ada240d8f5825164e33862a23938f
- SHA512 6881e1caaa55c5721ec01dee25323e106ad07adbeff533fcbdbbdcc7f5934c70c12d4c19decbce78ba3c38a3bde5a22d54f4c791f0da64e699ba8c2d795ecccb
- SSDEEP 192:RRBWuoh8pDJv7mHpAPRp2O9FHDaEb+WNnG4oPRm8ml2FicDYkw9VyIsnAUge:RRBWuNJKHUXJnm4wPnml2Ficsre
- TLSH T1B442B52EED10357B5CDBD22AF9657B97D7FA102231942E84E6FC892C21EB5CC2227117
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5864adcd-603e-4c05-b311-3a65ee721e28.tmp
- Size 649B
- SHA256 1a73a661fa74e7387e5b9781931d678e11d33bc615f0af5b45db295618c7425d
- MD5 75089526f013113c45a9a0456c43bc73
- SHA1 c3f6c81af1c4b988bc91461d25b468661cb9ee6a
- SHA512 5c3f78dba03b607b329a5f2865454a59597c20d6fc429bfa021c1d3b7fb26582823e4545c916cdadf285db221b382a72bb9d095fcf836ef6cca672f1d5a6e843
- TLSH T1D2F0F9B9DD21BC3B08FD0B6960941B86EB5013272751885B363C810C4FB557F459582C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8a009786-6151-4b69-9bdb-9f8b34b5fbaf.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8ae24bfb-418e-4235-933d-86b869be0e45.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
- Size 120B
- SHA256 cf57384d80e0bd891083da15916415343f8b253eb9c01cd87d93896203c01c61
- MD5 74c86cddff0fe85f7b4c174943ab9edf
- SHA1 bed46db9eca637317b636a768ac0056632b1d85f
- SHA512 55445699cc951879c269ac213dd08674059a0f57257d1fe55c3912faf626a72848fd21637a0760056746338aec42e1c042526c89e3da50835544f6f4aa98d99a
- TLSH T1FAB012498041D301C00A03F4115524CC3154FF10A605230141F00D11EC35650C01B194
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 96B
- SHA256 3448b1f94bc5ad689738ffbcc2753b7cc68db58e84eb9f91ecd31ae4e5d84311
- MD5 146d20cff4891a95a20e87f270c9e4cb
- SHA1 2140a72aa040e7f0e399505d22217d0b88081cb5
- SHA512 d3b7196c32119c74dfada59650c63946d8f4f38581e5c2fe07984312af328c5ed353c87aafaae64d4d87fb4c535dc2ae0aa69036f072434930b17302b87bf804
- TLSH T1CEB02220C202E202C00383B02A80A8CC30A0CF30CB03220283E00F2AEC302208020220
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d602aa80-48c2-4bab-a182-8b33b41b9bfc.tmp
- Size 12KB
- SHA256 33068760a17b183ce65edbefa6388522c50ebfe64f8647187bf953cd9ecf18de
- MD5 08ffff9f1cb1e67e3479b085caf07852
- SHA1 6eed52afac22d0334a96aba0463a2a69a4db0fdf
- SHA512 32b67508d96f8c18f6342e01d2ed457c7f9006bbb51cd399e2bb7ccda35a7f9fdd5d0a571f63a7e82eac5422d1b74db4a987f10210939e671893def5af6c18da
- SSDEEP 192:RRBWuoh8pDGv7mHpAPRp22l9FHDaEb+WNnG4orpH2k8ml2FicDYkw9VyIsnAUge:RRBWuNyKHUXhnm4w52/ml2Ficsre
- TLSH T1CD42B62EED20357B5CDBD22AF9657B97D7FA102131942E84E6FC892C21DB6CC2227117
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f995ce47-a858-4b3b-a9db-946aee5779d5.tmp
- Size 17KB
- SHA256 a01f3ad6b8f1a4a29c3e78d8a2edc9504a0b3bf6cd1cc2b244c3c3f9919648a4
- MD5 056ef735e9510bf6287c81ff7e9587c7
- SHA1 935b7a802760b8857034b2973104408d2d39ee56
- SHA512 c3ebabe8c58d2375438e11fae62c6c0991de3bbbf03ab286a9941745971d41660ca5eb566f24445fb92be1add72d801602414f043279d8141e6ec642ceb7455b
- SSDEEP 384:ywjmJ7KxkXqKf/pUZNCgVLH2HfgslmW7pLuLceSwxXODmh+ErU31qHGIyPjXlKGd:y0mJ7KxkXqKf/pUZNCgVLH2HfgsIW7p3
- TLSH T18772096778489A7B4F94C6CCDC267E4FACB5024B65E9886483FA5C2903D1BCF014A2F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d945beb7-eb43-4d90-a37d-d05d5b19fee1.tmp
- Size 132KB
- SHA256 b4b8d01fb69b98e770eb5549eb47b36d45c2f9760b3f797822718f48ebdb41dd
- MD5 bf9e42c7c7b426d5cc4b8405faf551a7
- SHA1 0ced0cd56e363faeb30f0c021d0f250d8c3569fa
- SHA512 780da9514a49fea3c58c69077f9614a9c7f1f2f92a3586b030d4d6b931931047d17523289b9b887987b1752888521822e98c925c0aaf0ca7d210551bfe950015
- SSDEEP 3072:AlIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzS:ABPtbmf1K49XLWbEPi4NTKlLzS
- TLSH T150D302213D01BCB8E9EEDA21A1901A16EAF4D94F96397BE61CDE3F4805E36D8C304C53
- MD5 SHA1 SHA512 SSDEEP TLSH