Analysis
- max time kernel
32s - max time network
32s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/10/2026, 17:46
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
sample.html
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target sample.html
- Size 148KB
- Sample261017-wcbf1sav9m
- SHA256 23ba2a58c677684f041e010a626460372608794af7bb1c81fb0928075750eba6
- MD5 3b6423cd3228d4b79b59cf8f6beaa4b2
- SHA1 0088cda1d748620769fd4e6c315741b36e260927
- SHA512 08eda1a24cb62f266e9ece57a00d1367ca5586e0ad93f654bc823df102320751b4ba167733f1d004e53ff5f45534be33e4eaf7f5f297f05bb98c35f2345c0179
- SSDEEP 3072:1QcUkMBw7xCkB9/xK5xgOoZTjOcR3aUtwAQCeTf:tMMxKjf
- TLSH T161E34B72F194253E21AB51ADB1AAF30C6A53E003C605A594B6FC532CDFC6FB464B368D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4992 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3212 chrome.exe 3212 chrome.exe - Suspicious behavior: LoadsDriver 8 IoCs
pid 4 4 4 4 4 4 4 4 - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3212 chrome.exe 3212 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 3212 wrote to memory of 2872 3212 chrome.exe 90 PID 3212 wrote to memory of 4992 3212 chrome.exe 92 PID 3212 wrote to memory of 5512 3212 chrome.exe 93 PID 3212 wrote to memory of 5512 3212 chrome.exe 93 PID 3212 wrote to memory of 1052 3212 chrome.exe 94 PID 3212 wrote to memory of 5500 3212 chrome.exe 95 PID 3212 wrote to memory of 1888 3212 chrome.exe 96 PID 3212 wrote to memory of 1052 3212 chrome.exe 94 PID 3212 wrote to memory of 5500 3212 chrome.exe 95 PID 3212 wrote to memory of 1888 3212 chrome.exe 96 PID 3212 wrote to memory of 4364 3212 chrome.exe 99 PID 3212 wrote to memory of 2164 3212 chrome.exe 100 PID 3212 wrote to memory of 992 3212 chrome.exe 101
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb2491c728,0x7ffb2491c734,0x7ffb2491c7402⤵PID:2872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,13609390795893870942,8805420425561390061,524288 --field-trial-handle=2752,i,8664980338681245948,11424990904275794248,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:112⤵
- System Time Discovery
PID:4992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2032,i,747923906305120556,10681676353637462575,524288 --field-trial-handle=2752,i,8664980338681245948,11424990904275794248,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:132⤵PID:5512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,11682295340150744516,6050520989116734796,262144 --field-trial-handle=2752,i,8664980338681245948,11424990904275794248,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:22⤵PID:1052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3028,i,10920977293409236606,11442482211493339800,2097152 --field-trial-handle=2752,i,8664980338681245948,11424990904275794248,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:12⤵PID:5500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3032,i,11192903812678688741,14062271632272025003,2097152 --field-trial-handle=2752,i,8664980338681245948,11424990904275794248,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:12⤵PID:1888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4968,i,14885497961376267292,17199567337825686909,524288 --field-trial-handle=2752,i,8664980338681245948,11424990904275794248,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:142⤵PID:4364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4976,i,8076119035458881963,10552351397594559728,524288 --field-trial-handle=2752,i,8664980338681245948,11424990904275794248,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:142⤵PID:2164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4980,i,14429646698626335878,17091906259223478220,524288 --field-trial-handle=2752,i,8664980338681245948,11424990904275794248,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:142⤵PID:992
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4980
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1856
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9b327d32-d576-4fdb-97b4-668f3c312d32.tmp
- Size 4KB
- SHA256 90cdd3dbfc6a8e3ffb0e1916a87ef8e0991af74ce09db2d02506c9190ccedc22
- MD5 af222b391ec3783c7090560085426968
- SHA1 95a9890aadb9e48e3029986c8d1dc3b2622936c1
- SHA512 e3aafff46fdc7c048d1eae220a5a19e3b28ffed595a742657940a7eaac8b85ecfffa366b48914d1ad7cf659152439303cc5e9435d464fe5b30a0f722f682e303
- SSDEEP 96:E3C0d+OBIsu/Fl3fIUKsI8EnZIJRDotok5TiDvB6m8dGyvELkzAurbuj1v4a:kC0pB+fTbnvDUDoZ4w/gAurbu1
- TLSH T1B6A12B31E4B88C7754B5C1C5B5873E43CFB462EBA8109E80C9DE1E0D11A71F82381A6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9f123cbb-9bb1-4f19-bb09-85a5d9ff25f1.tmp
- Size 5KB
- SHA256 cec24f4dc11a045381a170998f6a7c2585c66e4246a2c1515667e3845e683fc4
- MD5 387b1f5b93d080b9d1549a8936cd1b5b
- SHA1 12656887b08f10e78b5a110f0ad47970ad47ff96
- SHA512 bf6bf07f90235f97f74c8134ad39f19840a745c79c9334ec40973635afeb6cd3758cdbdab38171bce5e8a95cac1314b050c704c86149160315cd6de886927068
- SSDEEP 96:bC0d+OBIsu/Fl3fIUKsI8GOIZSl8h4otop5TbDvB6UGyvELc6w2v6+RuJ0j9ISt0:bC0pB+fTbnGfiU2LZ0/cFd+RuJULu
- TLSH T111C12B31B47C5CB745F29489B5432E43CEB462AB69119E55DBEA0F0C02E72FC3382A67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\651de381-09d5-48fb-b5cb-9ac6dc389b44.tmp
- Size 11KB
- SHA256 b77377e4860af8f8e6e014113edfa8c1c3289fee0712fddb9ba19b1ba92e9658
- MD5 25870f956a3593cdd54af66ae9235678
- SHA1 fea3c9af7c8ca1d25690d43c12b203c64665ce93
- SHA512 316650730451ffabc89684ac117ab7b9764c53ff7037e4bfb11ce957ad3433a8b01cdd70bb571d13f10af8e341245b8baae225f31ce3b7a188816959bfeb192a
- SSDEEP 192:eNG4K6cC7KxkXqK4I40pUZNCgVLHrKHfFKslEIJLXzKD/4j+ErUkKN9loGRfSsVk:QGjDC7KxkXqKf/pUZNCgVLH2HfgslDL3
- TLSH T16F32D827958D9A3F4FD8D51CCC576F8FBCF502926668092456FB9C0803A9BCE114A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\96048306-59e7-4346-9be9-2f5485e5df41.tmp
- Size 11KB
- SHA256 c41eec0f795b80f3ea26d65e7c60f42779455dd92cd7d49fcaf3ea03210c6fae
- MD5 bc4714bf90cdb43e80b7325efbf9cb22
- SHA1 60478d10fdb1a1f1c8217856fb71fbd542f879b0
- SHA512 926836f3c0722044f0c72aa4b8fd52b88538c6dffeb66f11745a669371941b5c84a76d5681427aa76794b12f3db2da23f1e97873c856d0e1aa5a80c165812c4f
- SSDEEP 192:wRvOXcpBv7H8vAPRp2Xx9OHsb+WNnrNPnWEXfVyIsnAUgR:wRvOXKRb86XykwhPWuR
- TLSH T11532A529AA54793B9CDBC22AF961BB87E6F9102630941EC4E6FC8C3C15E79CC2217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a3859151-4ce7-4606-a01a-04d3e8b09a03.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512