hxxps://mkgmensajeria[.]com/xsdr-74874-melodiesdrmdmdertx/87954478eyiuguhdjcksuy874reu89y7iuyhrteyuiwreu987tr78uiugtryfhi8rtguefgdy87w/

Analysis

user interaction
yes
max time kernel
16s
max time network
17s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/10/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mkgmensajeria.com/xsdr-74874-melodiesdrmdmdertx/87954478eyiuguhdjcksuy874reu89y7iuyhrteyuiwreu987tr78uiugtryfhi8rtguefgdy87w/
Sample261006-tknefaaw4x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4208	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4852	chrome.exe
4852	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 2324	4852	chrome.exe	82
PID 4852 wrote to memory of 4280	4852	chrome.exe	83
PID 4852 wrote to memory of 4280	4852	chrome.exe	83
PID 4852 wrote to memory of 4208	4852	chrome.exe	84
PID 4852 wrote to memory of 1488	4852	chrome.exe	86
PID 4852 wrote to memory of 2560	4852	chrome.exe	87
PID 4852 wrote to memory of 1488	4852	chrome.exe	86
PID 4852 wrote to memory of 2560	4852	chrome.exe	87
PID 4852 wrote to memory of 2456	4852	chrome.exe	85
PID 4852 wrote to memory of 2456	4852	chrome.exe	85
PID 4852 wrote to memory of 3960	4852	chrome.exe	89
PID 4852 wrote to memory of 3960	4852	chrome.exe	89
PID 4852 wrote to memory of 3392	4852	chrome.exe	92
PID 4852 wrote to memory of 2436	4852	chrome.exe	94
PID 4852 wrote to memory of 2436	4852	chrome.exe	94
PID 4852 wrote to memory of 1988	4852	chrome.exe	95
PID 4852 wrote to memory of 1988	4852	chrome.exe	95

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mkgmensajeria.com/xsdr-74874-melodiesdrmdmdertx/87954478eyiuguhdjcksuy874reu89y7iuyhrteyuiwreu987tr78uiugtryfhi8rtguefgdy87w/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa4a0ac728,0x7ffa4a0ac734,0x7ffa4a0ac740
  2⤵
  PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1648,i,13880490893246255803,8522348621640073240,262144 --field-trial-handle=2036,i,15892349412085397720,14293094093591976764,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2212,i,17813033678722166681,17347512508052327961,524288 --field-trial-handle=2036,i,15892349412085397720,14293094093591976764,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2228 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,9998853075422254253,4653480910940196756,524288 --field-trial-handle=2036,i,15892349412085397720,14293094093591976764,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2796 /prefetch:13
  2⤵
  PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3120,i,11550701429684186659,11275355713665461377,2097152 --field-trial-handle=2036,i,15892349412085397720,14293094093591976764,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3124,i,9093879794760316494,10496578857401430336,2097152 --field-trial-handle=2036,i,15892349412085397720,14293094093591976764,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4296,i,4795624570287380774,1710813215926462109,2097152 --field-trial-handle=2036,i,15892349412085397720,14293094093591976764,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4308 /prefetch:9
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,2561504932622075598,4245636537877612279,524288 --field-trial-handle=2036,i,15892349412085397720,14293094093591976764,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5340 /prefetch:14
  2⤵
  PID:3392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5840,i,11417354025632673296,4130206187356551831,2097152 --field-trial-handle=2036,i,15892349412085397720,14293094093591976764,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5820,i,17488223444992524057,4551574856605324991,2097152 --field-trial-handle=2036,i,15892349412085397720,14293094093591976764,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:1988

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

00ea3272-9670-4326-99e0-5cf1bbd8d872.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\00ea3272-9670-4326-99e0-5cf1bbd8d872.tmp
Size 130KB
SHA256 bd803f043de835ee98fb9314b1af470adb0fb8c8903bc317e952ffe0129be86d
MD5 a063ab178bcb1a65c6d7b788e6aab78d
SHA1 2b8b000d342c4fe1475a2277136e4a80a066558e
SHA512 948d555d25e6aee001899ca2691f37a16c994138c58536e4a5473923ccb8474288fc303d611adfec2edf9db6803407f778e45053d487bbb2568ab21bcbc35a83
SSDEEP 3072:RbH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJja:R5t4fLJ0L6nGJxi3bzqapJja
TLSH
T12DD302F1D1E06C6ACBB7EE4145756E908E71D5C689C9BE2409FD881816CEA344A13EA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c0ec57f-8adb-4efe-ba6b-e8567ec3af85.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2c0ec57f-8adb-4efe-ba6b-e8567ec3af85.tmp
Size 12KB
SHA256 976ff53fd3b7df3d7acb681df1679484b05eea4382f4e6e6019061b9608ed6e5
MD5 78ad0ec8061a5fbe4d7363efcdc1b66b
SHA1 1cfba9b3a1b07e70827f10ac824a98af7e0a9b4f
SHA512 844c9fa19ee53e6e7db57e829aa6fef3a5ed243ce8916eb0eda0583a139a5cae216353afe85b16b89a20a2b617840282a5a932cafe5357660f0996b4cefb6fe4
SSDEEP 192:kRHsEv3GVNIv7BpAPRp2C92Hsb+WNnCqPs72raPkw1VyIsnAUge:kRHsSyUdUXFwwvP+2r8De
TLSH
T1B942B42EAD24743B9CDBD22AFD263753D7F9102620942E84EAFC897C15E79CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76ad57be-96fd-459e-a4a0-873a6cea6b92.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\76ad57be-96fd-459e-a4a0-873a6cea6b92.tmp
Size 17KB
SHA256 6b7cee8b1a5eb6f1d44c20ace754a545db0a1024ec3af9927adcfd7fb5491934
MD5 6ebf767a844f07086ae64536124c4a52
SHA1 dfdc2ed2621b56af7ab86ee74a08835c5544579a
SHA512 3d3a2843ec32079f785bc015a3dfab1b143f21902675eeccd9fb84c1a22147178feb9f7d146c1c8203d46344ff8432180128aefaab9fd51e9a50a3c74b2f5ee5
SSDEEP 384:Uijon7KxkXqKf/pUZNCgVLH2Hfgsl3i7pLuLceSijXODoL+ErU3pTHGsUXIoi0lA:Uion7KxkXqKf/pUZNCgVLH2HfgsFi7p9
TLSH
T1D1721A677C4C993B0F94C9CCDC2A7E4FADB5024B61E9886483FA5C2A03D5ADB11062F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

826c0b93-7bc2-492c-8c56-5994a074dd27.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\826c0b93-7bc2-492c-8c56-5994a074dd27.tmp
Size 649B
SHA256 7394a6e3a3b753092e7609c4208d72e8972a648c2f6281ed98432c06b441ed8f
MD5 a1c1266b1b2c636f8ee2c2accfc7b810
SHA1 72554fa5fff1725a23056e344d691a259698c2fb
SHA512 659fdea8eee00dbb4e58002b8dad1618ad7c1278d4faff3ba4ecb8592abe076163c156bc2d31f2661fc5f3474bd397f3ec029b41db14c86c25eefe386e159c25
TLSH
T187F02DB5CD21EC3B08FC4B5870654B06E75113673A40859F3B3D960C8FB563B468685C
MD5 SHA1 SHA512 TLSH

Submit Download

4a60a2e7-5186-4c4f-8882-9904965e0925.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4a60a2e7-5186-4c4f-8882-9904965e0925.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

eab56197-c889-4c64-9503-1b241664b0b2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\eab56197-c889-4c64-9503-1b241664b0b2.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

cd0a2486-405b-4b18-9b43-72e6a4b4d4cf.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\cd0a2486-405b-4b18-9b43-72e6a4b4d4cf.tmp
Size 131KB
SHA256 e9fcf24d9edd8a5f207721e5126f7ed42d38d00d363e138e41f52c9265516ba0
MD5 595da01a2895af2f79c61f2dc40cf87a
SHA1 57a7a89316be296d14be1b375c2fd4201045bd30
SHA512 cc0e874354f338917e71f5e27d9c7374deedd46b6d865e925c257ad4aeb76705b7be86b4bf93cd5ce80d8c87b63e913c8515480850a2387196ccfabe1207404a
SSDEEP 3072:RfH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJja:RNt4fLJ0L6nGJxi3bzqapJja
TLSH
T11ED312F1D1A06C6ACBF7EE4145756E908EB1D5C689CDBE2409FD881806CEA345A13EA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download