Analysis

  • geolocation tags

    asiadelhiinindia
  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    14/10/2026, 10:15

General

  • Target
    http://hide01.ir
  • Sample261014-mab54aszhy
Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://hide01.ir
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:6076
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffadd55c728,0x7ffadd55c734,0x7ffadd55c740
      2⤵
        PID:5128
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2008,i,17812190831199672758,8174289807186942835,524288 --field-trial-handle=2004,i,17366140838782775569,3455793867082495467,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2040 /prefetch:11
        2⤵
        • System Time Discovery
        PID:1340
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1584,i,8868787200066595239,497222953082186790,262144 --field-trial-handle=2004,i,17366140838782775569,3455793867082495467,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2000 /prefetch:2
        2⤵
          PID:1536
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2268,i,12182619814981281263,373453036928627947,524288 --field-trial-handle=2004,i,17366140838782775569,3455793867082495467,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2440 /prefetch:13
          2⤵
            PID:3784
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,8385950159455274090,13154601789489371584,2097152 --field-trial-handle=2004,i,17366140838782775569,3455793867082495467,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3152 /prefetch:1
            2⤵
              PID:6056
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3144,i,12228346921520946072,2021295549823318542,2097152 --field-trial-handle=2004,i,17366140838782775569,3455793867082495467,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3192 /prefetch:1
              2⤵
                PID:1252
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5160,i,4954726772562301632,3743690275538855952,524288 --field-trial-handle=2004,i,17366140838782775569,3455793867082495467,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5164 /prefetch:14
                2⤵
                  PID:3468
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5256,i,6475061876176062772,15737488188035990561,524288 --field-trial-handle=2004,i,17366140838782775569,3455793867082495467,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5488 /prefetch:14
                  2⤵
                    PID:984
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,3182584111831885973,12321579396144581737,524288 --field-trial-handle=2004,i,17366140838782775569,3455793867082495467,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5416 /prefetch:14
                    2⤵
                      PID:880
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,7585647083680869622,12970896222670077151,524288 --field-trial-handle=2004,i,17366140838782775569,3455793867082495467,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5408 /prefetch:14
                      2⤵
                        PID:4808
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5500,i,8367390782147521082,11577630002613881904,2097152 --field-trial-handle=2004,i,17366140838782775569,3455793867082495467,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5496 /prefetch:1
                        2⤵
                          PID:636
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5700,i,10662456278351890590,14778087953277569224,2097152 --field-trial-handle=2004,i,17366140838782775569,3455793867082495467,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5696 /prefetch:1
                          2⤵
                            PID:5552
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5200,i,6462719904334927209,17107131912544855456,262144 --field-trial-handle=2004,i,17366140838782775569,3455793867082495467,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3376 /prefetch:10
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5588
                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                          1⤵
                            PID:1572
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                            1⤵
                              PID:1428

                            Network

                                  MITRE ATT&CK Enterprise v16

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  2410d1e5-6943-47d8-8493-7e6fb5cff93a.tmp

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2410d1e5-6943-47d8-8493-7e6fb5cff93a.tmp
                                  • Size 131KB
                                  • SHA256 e8ac5facef2bf2c83206965d86a16fa91b883aaf24fdf45849444004873c229d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  2bec67c1-0b79-4f8f-bf93-8aa09aaf448a.tmp

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2bec67c1-0b79-4f8f-bf93-8aa09aaf448a.tmp
                                  • Size 131KB
                                  • SHA256 b565d47e5729d6596d16b0ef0b295f5594f07faf097c3112648e396a001ab04f
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  88779096-11a4-461a-91f8-c2e660150beb.tmp

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\88779096-11a4-461a-91f8-c2e660150beb.tmp
                                  • Size 130KB
                                  • SHA256 5952ae3062d1118b8bfb3859809af960d5b0ea2bdbe85f8395cb5cebee2a81f6
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  1f61c3cf-5d85-4487-9a61-b117c18390d1.tmp

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1f61c3cf-5d85-4487-9a61-b117c18390d1.tmp
                                  • Size 12KB
                                  • SHA256 60ed3416454c19fcaa0344fac3c5efc3484203ff5d775fda33761716f19ec7bd
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  3e46c275-f187-4558-bda7-30bc52b0d16e.tmp

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3e46c275-f187-4558-bda7-30bc52b0d16e.tmp
                                  • Size 6B
                                  • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                  • MD5 SHA1 SHA512

                                  3ea893fe-ee44-4593-9173-c0dc00111183.tmp

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3ea893fe-ee44-4593-9173-c0dc00111183.tmp
                                  • Size 11KB
                                  • SHA256 570370b72ba0ada930209c9bc771014eecca1954004f266db03ad4763626ca39
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  6ff5df64-0807-48a5-a252-888f7b05107f.tmp

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6ff5df64-0807-48a5-a252-888f7b05107f.tmp
                                  • Size 12KB
                                  • SHA256 66291c697454280ca63d4e7247b5c3458437dacb37fa7616abd0d748cca0b533
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  93ea0c17-8625-4400-b788-44f0f7eba8e8.tmp

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\93ea0c17-8625-4400-b788-44f0f7eba8e8.tmp
                                  • Size 12KB
                                  • SHA256 aca784168df9d4c9723b810e6fefaf910a86649018fd0ac8003e0490eb8e3bc9
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  temp-index

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
                                  • Size 576B
                                  • SHA256 1b27cb905d5026aeb727fc21fd9ba4510b2ca18ff771ec54c15a19c40b03d67d
                                  • MD5 SHA1 SHA512 TLSH

                                  temp-index

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
                                  • Size 456B
                                  • SHA256 0251ba6c5e921ba662bf6045f49b300e09267fb787a0c1c502194d3c5c39913c
                                  • MD5 SHA1 SHA512 TLSH

                                  0ec1f527-e37f-40b0-994f-6fca8d3ca351.tmp

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0ec1f527-e37f-40b0-994f-6fca8d3ca351.tmp
                                  • Size 1KB
                                  • SHA256 afa0ed1fc16df3dbdf3be4f73464228f54c0200f1aaed899842d2efb8edb4cd3
                                  • MD5 SHA1 SHA512 TLSH

                                  9af42653-2e70-4a2b-a074-e3bcf2b517fd.tmp

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9af42653-2e70-4a2b-a074-e3bcf2b517fd.tmp
                                  • Size 2KB
                                  • SHA256 b4496e0ccef81957d75a1bcc3c55f16a576006c5c7bc1155f89d9ed423d4b9eb
                                  • MD5 SHA1 SHA512 TLSH

                                  b7d9322e-09f2-45c7-83c6-e838ef203169.tmp

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b7d9322e-09f2-45c7-83c6-e838ef203169.tmp
                                  • Size 1KB
                                  • SHA256 71a2365c09d40d84c4d3cc5816346af986119921f9cf04edc8de375117af4a18
                                  • MD5 SHA1 SHA512 TLSH

                                  ef6dc4e6-a5ab-4876-bdba-7e22cbd0916a.tmp

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ef6dc4e6-a5ab-4876-bdba-7e22cbd0916a.tmp
                                  • Size 2B
                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                  • MD5 SHA1 SHA512

                                  ae1860ec-b941-4479-aa63-ec1d59aeed20.tmp

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ae1860ec-b941-4479-aa63-ec1d59aeed20.tmp
                                  • Size 11KB
                                  • SHA256 f397659dc7ecd2e25c9611e2e9240259bb64418f5395d38ab3dd42f941da7a12
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  bc0befeb-cbb2-4d69-aab6-d6cdde03866e.tmp

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bc0befeb-cbb2-4d69-aab6-d6cdde03866e.tmp
                                  • Size 12KB
                                  • SHA256 af5c82b038342a677cd219666807cdd1c3908e8e9104c0a31e38770e293056a7
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  bda62135-a00b-4c3f-a7cc-d35384085a5d.tmp

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bda62135-a00b-4c3f-a7cc-d35384085a5d.tmp
                                  • Size 414B
                                  • SHA256 b741dfeb5b30b9c66035c2be6193d9ac7cbd5687430630c1a9ac11a30aedbf47
                                  • MD5 SHA1 SHA512 TLSH

                                  fdc8c8d6-a992-444e-b8fb-b197d58488a0.tmp

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fdc8c8d6-a992-444e-b8fb-b197d58488a0.tmp
                                  • Size 12KB
                                  • SHA256 e7796dab006f5b2bf1e86eb220a71734310b44b90f63310568a79055c84a1d80
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  ef949f70-bc97-4875-8dc9-33aebfa97e73.tmp

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ef949f70-bc97-4875-8dc9-33aebfa97e73.tmp
                                  • Size 183KB
                                  • SHA256 e65eac527574795a99c28f2169308a4b0a1ac7725883333febcc1afde3f86f82
                                  • MD5 SHA1 SHA512 SSDEEP TLSH