Analysis
- user interaction
yes - max time kernel
28s - max time network
16s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/10/2026, 22:29
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://ink-global.my.salesforce-sites.com/checkout
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target http://ink-global.my.salesforce-sites.com/checkout
- Sample261018-2efreawtbs
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 712 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5968 chrome.exe 5968 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe - Suspicious use of AdjustPrivilegeToken 56 IoCs
description pid Process Token: SeShutdownPrivilege 5968 chrome.exe Token: SeCreatePagefilePrivilege 5968 chrome.exe Token: SeShutdownPrivilege 5968 chrome.exe Token: SeCreatePagefilePrivilege 5968 chrome.exe Token: SeShutdownPrivilege 5968 chrome.exe Token: SeCreatePagefilePrivilege 5968 chrome.exe Token: SeShutdownPrivilege 5968 chrome.exe Token: SeCreatePagefilePrivilege 5968 chrome.exe Token: SeShutdownPrivilege 5968 chrome.exe Token: SeCreatePagefilePrivilege 5968 chrome.exe Token: SeShutdownPrivilege 5968 chrome.exe Token: SeCreatePagefilePrivilege 5968 chrome.exe Token: SeShutdownPrivilege 5968 chrome.exe Token: SeCreatePagefilePrivilege 5968 chrome.exe Token: SeShutdownPrivilege 5968 chrome.exe Token: SeCreatePagefilePrivilege 5968 chrome.exe Token: SeShutdownPrivilege 5968 chrome.exe Token: SeCreatePagefilePrivilege 5968 chrome.exe Token: SeShutdownPrivilege 5968 chrome.exe Token: SeCreatePagefilePrivilege 5968 chrome.exe Token: SeShutdownPrivilege 5968 chrome.exe Token: SeCreatePagefilePrivilege 5968 chrome.exe Token: SeShutdownPrivilege 5968 chrome.exe Token: SeCreatePagefilePrivilege 5968 chrome.exe Token: SeShutdownPrivilege 5968 chrome.exe Token: SeCreatePagefilePrivilege 5968 chrome.exe Token: SeShutdownPrivilege 5968 chrome.exe Token: SeCreatePagefilePrivilege 5968 chrome.exe Token: SeShutdownPrivilege 5968 chrome.exe Token: SeCreatePagefilePrivilege 5968 chrome.exe Token: SeShutdownPrivilege 5968 chrome.exe Token: SeCreatePagefilePrivilege 5968 chrome.exe Token: SeShutdownPrivilege 5968 chrome.exe Token: SeCreatePagefilePrivilege 5968 chrome.exe Token: SeShutdownPrivilege 5968 chrome.exe Token: SeCreatePagefilePrivilege 5968 chrome.exe Token: SeShutdownPrivilege 5968 chrome.exe Token: SeCreatePagefilePrivilege 5968 chrome.exe Token: SeShutdownPrivilege 5968 chrome.exe Token: SeCreatePagefilePrivilege 5968 chrome.exe Token: SeShutdownPrivilege 5968 chrome.exe Token: SeCreatePagefilePrivilege 5968 chrome.exe Token: SeShutdownPrivilege 5968 chrome.exe Token: SeCreatePagefilePrivilege 5968 chrome.exe Token: SeShutdownPrivilege 5968 chrome.exe Token: SeCreatePagefilePrivilege 5968 chrome.exe Token: SeShutdownPrivilege 5968 chrome.exe Token: SeCreatePagefilePrivilege 5968 chrome.exe Token: SeShutdownPrivilege 5968 chrome.exe Token: SeCreatePagefilePrivilege 5968 chrome.exe Token: SeShutdownPrivilege 5968 chrome.exe Token: SeCreatePagefilePrivilege 5968 chrome.exe Token: SeShutdownPrivilege 5968 chrome.exe Token: SeCreatePagefilePrivilege 5968 chrome.exe Token: SeShutdownPrivilege 5968 chrome.exe Token: SeCreatePagefilePrivilege 5968 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe 5968 chrome.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 5968 wrote to memory of 5988 5968 chrome.exe 85 PID 5968 wrote to memory of 6128 5968 chrome.exe 86 PID 5968 wrote to memory of 6128 5968 chrome.exe 86 PID 5968 wrote to memory of 712 5968 chrome.exe 87 PID 5968 wrote to memory of 1084 5968 chrome.exe 88 PID 5968 wrote to memory of 1084 5968 chrome.exe 88 PID 5968 wrote to memory of 456 5968 chrome.exe 90 PID 5968 wrote to memory of 1020 5968 chrome.exe 91 PID 5968 wrote to memory of 456 5968 chrome.exe 90 PID 5968 wrote to memory of 1020 5968 chrome.exe 91 PID 5968 wrote to memory of 1584 5968 chrome.exe 92 PID 5968 wrote to memory of 1584 5968 chrome.exe 92 PID 5968 wrote to memory of 2892 5968 chrome.exe 93 PID 5968 wrote to memory of 2892 5968 chrome.exe 93 PID 5968 wrote to memory of 4204 5968 chrome.exe 99
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ink-global.my.salesforce-sites.com/checkout1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc380ac728,0x7ffc380ac734,0x7ffc380ac7402⤵PID:5988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,3804470071437440093,18074656841650142237,262144 --field-trial-handle=2004,i,2807244382201664923,9327370398911472612,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2000 /prefetch:22⤵PID:6128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,7080788586097545725,8537643337259667923,524288 --field-trial-handle=2004,i,2807244382201664923,9327370398911472612,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2248 /prefetch:32⤵
- System Time Discovery
PID:712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,5540429232799650152,8325025740953988171,524288 --field-trial-handle=2004,i,2807244382201664923,9327370398911472612,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2540 /prefetch:82⤵PID:1084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3120,i,6444316944862749315,1564748793116653045,2097152 --field-trial-handle=2004,i,2807244382201664923,9327370398911472612,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3132,i,18178923095137785985,6202565702046683372,2097152 --field-trial-handle=2004,i,2807244382201664923,9327370398911472612,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:1020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4300,i,11230039863404763912,10397944120319266343,2097152 --field-trial-handle=2004,i,2807244382201664923,9327370398911472612,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4312 /prefetch:22⤵PID:1584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4716,i,15017916642142998753,3116407130973877301,2097152 --field-trial-handle=2004,i,2807244382201664923,9327370398911472612,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4732 /prefetch:12⤵PID:2892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,9801093869908485131,13862444048097892047,524288 --field-trial-handle=2004,i,2807244382201664923,9327370398911472612,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5372 /prefetch:82⤵PID:4204
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4052
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:636
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4a29602b-cca8-42e8-9a78-b68f75edc042.tmp
- Size 131KB
- SHA256 1e5decadd87604bb770207600608f5cb53aa404838fe1b91a93c913ce73336c5
- MD5 254a7775c04df6af9bcada8244b0459b
- SHA1 4ddbb4c82023e533198974f3060159db8890189e
- SHA512 376bc6ecfa29d681c19e2b4c2c1f9572bac382775e11410b86c871bba20c9522aaaa4045bde4681282d8d1533d1dac6a1c72c2c02dac5050a7b29633647eaabb
- SSDEEP 3072:8+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:8+hFD+7t56OD9ZfSAppry
- TLSH T16AD31232AA95D8BB89FC6541B187A300CD766CED51DE3A09444A5F8ED09FD4C0773A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7e187b80-7b7c-4513-b052-078413410671.tmp
- Size 130KB
- SHA256 7b9f73272dc876d8c38b34b519ec53889084ab3358f8fff867fb25f81d20520f
- MD5 c1cf3057cf13a6187bb192ad5aad3c9f
- SHA1 40c4078c5e03c86b45f046eb646da0c53e4346c0
- SHA512 f7d78009c6afa496f6bab1e557b9e4a5eb37fa1cac1b92368c162f0c6d14e1ef33bd201e7ed150d472e8a96c03567b885d716fe9dafba35d3510f5a5209511c6
- SSDEEP 3072:P+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:P+hFD+7t56OD9ZfSAppry
- TLSH T1E7D31232AA91C8BBC9BC6541B197A304DE766CED41DE3A09444A5F8EE05FD4C0773A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\10da9a32-127f-4a75-a677-fbcce40cc5b1.tmp
- Size 12KB
- SHA256 0a83eb0bc0ce3f5229b8aab7dfe734f150d17c997f6aa47a5b1a0301bf607934
- MD5 c4b0d1e50470ca76734376fadd4b1679
- SHA1 81ad63d59213d8262485373eb8a6f87d1b7a9a79
- SHA512 a0ea93482073b217bc71201d3937af02cb7cb153305f8739d3ddf608ba7a9f3be382ff9b2e9c66331a4e553a27eed32777533dfde68919efb9e94f91867a3556
- SSDEEP 192:kRwFb9j64HdCRv78pAPRp2IU9THsb+WNnnS5Sv2ewOewwGPm1VyIsnAUge:kRwF0tB4UXgJwSK2eZwhe
- TLSH T14342932DAD10753B5CDBD21AEAA17B97DBF5002230952E84E6FC8D3C25E76DC221742B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\25ce11d2-3154-49e2-b3cd-cd9b4eedc359.tmp
- Size 414B
- SHA256 9514cffb3cde4ea80030f389b63e816b5f2106c37d55768a5599eb85369ec81f
- MD5 b84743cf3e71114ca666fc3bee272b04
- SHA1 5618cf40f573ac4b95ecfce1e7583ec047074eba
- SHA512 b44e4c3e40f072be2b05bb757efd37413c107895d32c18a85e389d6e0f664acd4e947ff3c62f5e4fe25b6b559034c8218663c07efe670afe9118a64cd6b76377
- TLSH T107E02BA6C8219C2748FE171C6191CA85EB54237B3B40498F363C80188F706364BD9D6C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8f5a2b7f-80fa-415f-aa2c-9c2d1acdfb90.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_ink-global.my.salesforce-sites.com_0.indexeddb.leveldb\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
- Size 120B
- SHA256 507e4432634c2b4c5755e16d14b4cf4c8d5418f45b79a50c9bce57dc992a92b4
- MD5 ab5ff9755ade6dbc8d2bcb8f52c9237a
- SHA1 794aa78a9b65618f274a19786006d2be080cb1ff
- SHA512 28ee805877879fd91a84a7dafdb6dd550a67d5d659093be8a5baae2c3bde4df93bc4fcc6c73268aab81298aa44eb6907d68a944e2431053eec5ab62b686be92a
- TLSH T118B0121781412721C00103B011D0A054B3608F35EA32138E95E00D01E8351904027208
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 96B
- SHA256 df50e09e98ebe64e6df546b2ec8df1faa41e0ee67dfd866d3f01025c07470b98
- MD5 7d0af53c5265c32311dee2daeeb2fa30
- SHA1 9b2ea883773e4b8271f8caf90ad75522ffba2ecb
- SHA512 5cde887451bdc43c42c674def8223aa94d5881c2bd69b0416c247fc0b12372031f88a5b5d7081cbe6b00c22c094973e5f061d6087a0c876432345c7dbfa594cb
- TLSH T114B0025ED9076226C04243F129E69ADC7160DF35CE47121BD6F01B66DC356604579A72
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ae6ba57f-bfce-4b03-99a3-e2fb77359562.tmp
- Size 17KB
- SHA256 a55c9d9bfbff27f4080d00af8282862be9cc6b021b0d1cf3b654e6d1857a1705
- MD5 c8926c13ed1e541a9ebca052800d518d
- SHA1 3522a9925410a3faf9a73cb924c1c1fb4dbffb5b
- SHA512 0cc7f70f08f90753f1713955142d2f28c2b7b8284eb83bb86dea581036af8c57e30edda3af83eb81e1295de946e3c6812dc7f1671fca9c13e29cb035d90943a4
- SSDEEP 384:j5j3S7KxkXqKf/pUZNCgVLH2HfgslA/7pLuLceS9YXOD32+ErU3tJHGT7LAE:jJ3S7KxkXqKf/pUZNCgVLH2HfgsC/7pO
- TLSH T1E772FA67BC4C9A3B4F94C68CDC267F4FADB5024B61ED886443FA582603D5ACB05062FB
- MD5 SHA1 SHA512 SSDEEP TLSH