Analysis
- user interaction
yes - max time kernel
28s - max time network
29s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/10/2026, 03:46
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://farmer24turners.responsivewebsitebuilder.io/site/77a78d08/benz?preview=true&insitepreview=true&dm_device=desktop
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
600 seconds
General
- Target https://farmer24turners.responsivewebsitebuilder.io/site/77a78d08/benz?preview=true&insitepreview=true&dm_device=desktop
- Sample261027-ebqqwabs4l
Score
6/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4200 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2980 chrome.exe 2980 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2980 chrome.exe 2980 chrome.exe - Suspicious use of AdjustPrivilegeToken 56 IoCs
description pid Process Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2980 wrote to memory of 1124 2980 chrome.exe 85 PID 2980 wrote to memory of 1276 2980 chrome.exe 86 PID 2980 wrote to memory of 1276 2980 chrome.exe 86 PID 2980 wrote to memory of 4200 2980 chrome.exe 87 PID 2980 wrote to memory of 4272 2980 chrome.exe 88 PID 2980 wrote to memory of 4272 2980 chrome.exe 88 PID 2980 wrote to memory of 1852 2980 chrome.exe 90 PID 2980 wrote to memory of 4740 2980 chrome.exe 91 PID 2980 wrote to memory of 1852 2980 chrome.exe 90 PID 2980 wrote to memory of 4740 2980 chrome.exe 91 PID 2980 wrote to memory of 1064 2980 chrome.exe 96
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://farmer24turners.responsivewebsitebuilder.io/site/77a78d08/benz?preview=true&insitepreview=true&dm_device=desktop1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8d915c728,0x7ff8d915c734,0x7ff8d915c7402⤵PID:1124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,15504606878514240795,12115328816198386418,262144 --field-trial-handle=1980,i,2836162961241358139,2576594851977073682,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1976 /prefetch:22⤵PID:1276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,16859218102847689517,5691607826302039082,524288 --field-trial-handle=1980,i,2836162961241358139,2576594851977073682,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2304 /prefetch:32⤵
- System Time Discovery
PID:4200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,15121868016569708011,12237986895647324533,524288 --field-trial-handle=1980,i,2836162961241358139,2576594851977073682,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2292 /prefetch:82⤵PID:4272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,8374002389425954134,2766902939181388385,2097152 --field-trial-handle=1980,i,2836162961241358139,2576594851977073682,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:1852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,18329559647236357111,2817748958174834705,2097152 --field-trial-handle=1980,i,2836162961241358139,2576594851977073682,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:4740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5132,i,1713892283202806805,8182585187174381736,524288 --field-trial-handle=1980,i,2836162961241358139,2576594851977073682,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5140 /prefetch:82⤵PID:1064
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3448
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4116
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1758a82f-3407-4ad6-b607-0e3b62468d03.tmp
- Size 131KB
- SHA256 773ba0cb6807782fa1b3168473e2d9f397e0ae3235b780b8b0408600099492c1
- MD5 d77e35a5a4c84c3f0c2224676eaefc39
- SHA1 5b475c9c6cb35c1e9c3d292a6bd2dd12d625edb0
- SHA512 d615b79274117254a22f2693e1583b5a61f61576350d104ec44fb7987a38db874b00a39c6ea85dbf102aa87dcff8b78ed2b5cff0d6fc8c6f820e907900ea52e8
- SSDEEP 3072:iu+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gZ:iu+hFD+7t56OD9ZfSApprZ
- TLSH T1D7D31232BA95D8BB89FD6541B147A300DEB66CED45DE3A09444A5F8ED09FC4C07A3A33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4396f2e0-ae76-4609-9d2b-9a3693f7df44.tmp
- Size 414B
- SHA256 3fc1f4224cc43d5b3c8f82c2e6591a13e773d50818776a4c5d110d33f2146387
- MD5 c66adffb0a3552529951b854dcce8ba8
- SHA1 9cc991eb9d9551456eea6f011b63d39a8130cdf5
- SHA512 5553fe34e23ab8ea43d19b6e18a20ce782999444e7518019aa5a22ee7b99a3dfc6276d2f9ce88174f5e451df9e45d9b17b1245d546d46441d26be39fd04ef73c
- TLSH T104E022A9C922EC7718FD075A6464178AF74513672680888F3A3C820D8FB463A918A81C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5b79ffec-cb29-4f0c-b79c-04b2e90a06fb.tmp
- Size 12KB
- SHA256 5a0463a1e0c9e4b5bd7877be605bb69d1a7b62af72bf30d21270cf29e7db6cd3
- MD5 55dcbd81fb72d3711434d91b67f0d468
- SHA1 c544225e9eac7a7e6202f7e54a1bc617e0086b46
- SHA512 f965eed5bf89a2aa7da6369740ccbeca57cff9a96d1fdf71bd0c33356439eb0d6ccedb3715775b6fa66c3b10c821aaa3ab1f7454748a8f1c94fde99891ed22ab
- SSDEEP 192:XRmuubVFv73pAPRp22lZ9vHsb+WNn5v6ta21Y2e/EkwbnHasVyIsnAUge:XRmuuB1bUXNhwl52C2aE7HaIe
- TLSH T16B42B52EED20B97B5DDBC22AEA227B53D7F9102164946E84EAFDC83C24D75CC6127407
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7e1044c4-5bde-4333-82f0-e52c8ea1f6fc.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c2980254-019e-4bd1-b75f-4eb83636a0bb.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fc6f6efb-c601-479b-be60-407693a26359.tmp
- Size 13KB
- SHA256 eff4472df129bc4e2b803cc39a1ba520374d3b607d22cd6393104a3be124b9c2
- MD5 8607790a422ecb522e4c0dbd3b269b34
- SHA1 e5c7ec8f685c74ebdd01a67f0e763209d8676d75
- SHA512 27cdf461b3cdb01cf1d4a2f802f426248ba3f5fe8ed4c31dd046a71cdb0f38b25a10db78f318bacc40577b31c54a1cd046ec06e134194cc0934ab8961d501a55
- SSDEEP 384:ftjDu7KxkXqKf/pUZNCgVLH2HfgslHEXODDK+ErU3gbHGVQoiTCGY:ftDu7KxkXqKf/pUZNCgVLH2HfgsdWOHH
- TLSH T120521927A88C9A7F0FD4D98DDC176F4FACF501576568486852FB9C0803A6BCA114E2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\bc45b31a-0151-46d6-905c-73c7c4fa8903.tmp
- Size 130KB
- SHA256 24926001ae6b66c192c27b1b70e6218e7d28ad1fcce2639f5b7d49ec1c07ead1
- MD5 6e9ab157a1c0e33f23f9c1ec242d4908
- SHA1 eed20eba2059eef1437fd18e1220d794caf3955c
- SHA512 5f4cdc6d42428d9decbd99fd17701b39e90e97d4a3b352708b0dbd871b9b600c511b9721378b02d6f25677a05f20403d66e9caf09ec5c5df7bd8d487bfa17598
- SSDEEP 3072:x+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gZ:x+hFD+7t56OD9ZfSApprZ
- TLSH T1DCD31232AA91C8BBC9FC6541B197A300DE666CED45DE3A09444A5F8EE09FC4C0773A37
- MD5 SHA1 SHA512 SSDEEP TLSH