e7e872a7d3a696143c24680a6bd574ae91306d6ca0ec9b29c299e13abb982ac2

Analysis

user interaction
yes
max time kernel
19s
max time network
13s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 11:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6ad8bf221eeb6117b1ba9e24.html
Size 4KB
Sample261023-nfdrjsbs8z
SHA256 e7e872a7d3a696143c24680a6bd574ae91306d6ca0ec9b29c299e13abb982ac2
MD5 bc6f36cae2e64129ba7ae83a0972dbed
SHA1 0000ffe0dc32071d4c8b63ef92f88d4c206e0df6
SHA512 0ccdf0459826b8f1780c001ee3bd1e8a100910ed4b383224c51263abdf18663c8baeb867cc4a4d8a9c145cca8703efce961c9e6c528ecdae9f3befbb48ecd765
SSDEEP 96:A/UtTjTWBT0IgJpY10SOyvyND37fgHp1sRe3bzY+bXbnGqX:A/YHGSJpY1bOyvyNjUHpJ3bzY+bXbnTX
TLSH
T10DA176F36820DC4F53A1C2ADA5E7F188C51A425E84A04CA2F1CAD19F2EE4FF18073B19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2840	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5672	chrome.exe
5672	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5672	chrome.exe
Token: SeCreatePagefilePrivilege	5672	chrome.exe
Token: SeShutdownPrivilege	5672	chrome.exe
Token: SeCreatePagefilePrivilege	5672	chrome.exe
Token: SeShutdownPrivilege	5672	chrome.exe
Token: SeCreatePagefilePrivilege	5672	chrome.exe
Token: SeShutdownPrivilege	5672	chrome.exe
Token: SeCreatePagefilePrivilege	5672	chrome.exe
Token: SeShutdownPrivilege	5672	chrome.exe
Token: SeCreatePagefilePrivilege	5672	chrome.exe
Token: SeShutdownPrivilege	5672	chrome.exe
Token: SeCreatePagefilePrivilege	5672	chrome.exe
Token: SeShutdownPrivilege	5672	chrome.exe
Token: SeCreatePagefilePrivilege	5672	chrome.exe
Token: SeShutdownPrivilege	5672	chrome.exe
Token: SeCreatePagefilePrivilege	5672	chrome.exe
Token: SeShutdownPrivilege	5672	chrome.exe
Token: SeCreatePagefilePrivilege	5672	chrome.exe
Token: SeShutdownPrivilege	5672	chrome.exe
Token: SeCreatePagefilePrivilege	5672	chrome.exe
Token: SeShutdownPrivilege	5672	chrome.exe
Token: SeCreatePagefilePrivilege	5672	chrome.exe
Token: SeShutdownPrivilege	5672	chrome.exe
Token: SeCreatePagefilePrivilege	5672	chrome.exe
Token: SeShutdownPrivilege	5672	chrome.exe
Token: SeCreatePagefilePrivilege	5672	chrome.exe
Token: SeShutdownPrivilege	5672	chrome.exe
Token: SeCreatePagefilePrivilege	5672	chrome.exe
Token: SeShutdownPrivilege	5672	chrome.exe
Token: SeCreatePagefilePrivilege	5672	chrome.exe
Token: SeShutdownPrivilege	5672	chrome.exe
Token: SeCreatePagefilePrivilege	5672	chrome.exe
Token: SeShutdownPrivilege	5672	chrome.exe
Token: SeCreatePagefilePrivilege	5672	chrome.exe
Token: SeShutdownPrivilege	5672	chrome.exe
Token: SeCreatePagefilePrivilege	5672	chrome.exe
Token: SeShutdownPrivilege	5672	chrome.exe
Token: SeCreatePagefilePrivilege	5672	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5672 wrote to memory of 5804	5672	chrome.exe	85
PID 5672 wrote to memory of 4548	5672	chrome.exe	86
PID 5672 wrote to memory of 4548	5672	chrome.exe	86
PID 5672 wrote to memory of 2840	5672	chrome.exe	87
PID 5672 wrote to memory of 4308	5672	chrome.exe	88
PID 5672 wrote to memory of 4308	5672	chrome.exe	88
PID 5672 wrote to memory of 3428	5672	chrome.exe	89
PID 5672 wrote to memory of 6072	5672	chrome.exe	90
PID 5672 wrote to memory of 3428	5672	chrome.exe	89
PID 5672 wrote to memory of 6072	5672	chrome.exe	90
PID 5672 wrote to memory of 5196	5672	chrome.exe	92
PID 5672 wrote to memory of 5196	5672	chrome.exe	92
PID 5672 wrote to memory of 3356	5672	chrome.exe	97

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\6ad8bf221eeb6117b1ba9e24.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8bb74c728,0x7ff8bb74c734,0x7ff8bb74c740
  2⤵
  PID:5804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,13063620935912375426,2031212502581978772,262144 --field-trial-handle=1988,i,109283128553536798,15662522899999108035,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,907086268316049022,410983842120823757,524288 --field-trial-handle=1988,i,109283128553536798,15662522899999108035,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,1395176064877550199,14749428922457921128,524288 --field-trial-handle=1988,i,109283128553536798,15662522899999108035,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2276 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,16850491833185574639,2701035217553919551,2097152 --field-trial-handle=1988,i,109283128553536798,15662522899999108035,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,9028062195176309902,1665440449029487739,2097152 --field-trial-handle=1988,i,109283128553536798,15662522899999108035,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4428,i,13322465462628407832,6675285902061390427,2097152 --field-trial-handle=1988,i,109283128553536798,15662522899999108035,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4432 /prefetch:2
  2⤵
  PID:5196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,8376179518038951517,11821858171299667098,524288 --field-trial-handle=1988,i,109283128553536798,15662522899999108035,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3356

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0f12d8e0-92b3-4760-85c6-330887da7d15.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0f12d8e0-92b3-4760-85c6-330887da7d15.tmp
Size 130KB
SHA256 99150e76c04a2ee8c5233ca82592a46b82df471f6643746aa13f4b9c1b1d77a4
MD5 86e12ee7fd54b2cdb03f923e47b42c32
SHA1 42ed2f0a74798baf45e236d0ec8783581cf1325a
SHA512 563090e092b808d0bb680f7dcbec0f7055543e622e00c30146e8d7193fb76dd3fc0ffa3225ea925be4d01e865b1b4759006d5f5b4d44b621345f60ab0ae5970a
SSDEEP 3072:UB+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:UB+hFD+7t56OD9ZfSApprB
TLSH
T101D31232AA91D8BBC9BC6141B157A300DE76ACED45DE3A09444A5F8EE05FD4C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c6c8761-14ad-4f71-8d34-5c0c77440dca.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2c6c8761-14ad-4f71-8d34-5c0c77440dca.tmp
Size 131KB
SHA256 e256ed84881b0448d96b24c2c046c6e495acef6bd58b499929aa31f425523621
MD5 6b5e8a2f545e3011a454e7806deb8145
SHA1 d7da41b9b062e76b1418e49f9d049cf4f917722d
SHA512 ca59638bbfc967fc878695b4021402e920f2473fbf1ad05e13e1a4fff207c180bc568c1a4309d63fbb9af98bd0f0bb9d11dcf26e62d0fe162a68162a38c07196
SSDEEP 3072:sp+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:sp+hFD+7t56OD9ZfSApprB
TLSH
T1BCD31232AA94D8B7C9FD6541A147A300CE76ACEE45DE3A09444A5F8ED09F94C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

192f86b4-b5c5-4438-b0db-b30bde1cd1eb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\192f86b4-b5c5-4438-b0db-b30bde1cd1eb.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

2cafd2b3-40ba-47d0-9a91-69b71140745d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2cafd2b3-40ba-47d0-9a91-69b71140745d.tmp
Size 12KB
SHA256 8ab29926cdd1f7a8d4aeb55a4378aa50af38bcbda0a9effacf2e2ed9f86fb6b9
MD5 b4a1371781b7a9e8f07f1b77b3502dce
SHA1 5b50467dcb5759e278cd07c43f71413204df3e75
SHA512 c5fd2319aff2155436cfd20ee0878133d154450906192a2ce0d2e2be5cda41da3211e1b75f3958b4786ea87dd1d3ef03889cc697861677c9dd38b23fabe3c6bf
SSDEEP 192:hR3mxcBWMMPg6/Gv7GpAPRp2YR96Hsb+WNnkmTP2gkvv2qC+kw8cdVyIsnAUge:hR3mxXX/yCUX/sw9PYvv2qC+Fre
TLSH
T18F42932EBE10793B5CDBD329E9117757D7F6102620942E84EAFC883C25E76DD222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4a75cdc7-3c94-4040-b6ac-76e1aa50d43c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4a75cdc7-3c94-4040-b6ac-76e1aa50d43c.tmp
Size 17KB
SHA256 2402969cd2ec72ea72b513389c43205a9ee2bceca1c456ef576613e3544e19a0
MD5 ef2f6beced6ed991eb5f4b124485b70c
SHA1 13ae98461b417e18835295fc68f98db326a5bad0
SHA512 5adbe06b2aba408c8975b2dfc7f1c8c160dc3367ebb5f8a049421cc510b871c0310b3c4cd24506c3615f6972ff559c98cb7cd22bc47816248c6501f19779082b
SSDEEP 384:tyjCjRyjH7KxkXqKf/pUZNCgVLH2Hfgslqq7pLuLceSzyjDXODRyjr+ErU3J6HG2:Ie0r7KxkXqKf/pUZNCgVLH2HfgsMq7pw
TLSH
T1A0720A77BC0C9A7B0F94C68CD8167E4FEDB5024B65D9886443FA983503D5BDA110A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

567559cf-a040-421c-ae54-2f50da271534.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\567559cf-a040-421c-ae54-2f50da271534.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f54f9d43-c143-440a-af0b-25d192bb76d2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f54f9d43-c143-440a-af0b-25d192bb76d2.tmp
Size 414B
SHA256 4ea04788192bae9bd6de68d2594066b18ad173af0f28668ba01a73815276a031
MD5 57cca901bc25d53d797aa636c404ea44
SHA1 3db97b583c56c482be250fb159f604bb58c17882
SHA512 83a1cd608d388d9d49443c3325967e1bcb1f1fc52aff1e6ac60e0951bc6053f2b360b28552defcfc238e8126738e7995277d37895e4fee53d81818ba76adb868
TLSH
T12FE0ABF6C825B83718FC9B1C10008B87EA0903173640955F3A3C4108CF74A3A028681C
MD5 SHA1 SHA512 TLSH

Submit Download