hxxps://63[.]48[.]167[.]72[.]host[.]secureserver[.]net/?jQUnut7u?ref=8DDS&exp=56190&doc=3DA3L

Analysis

user interaction
yes
max time kernel
19s
max time network
15s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://63.48.167.72.host.secureserver.net/?jQUnut7u?ref=8DDS&exp=56190&doc=3DA3L
Sample261030-tebhpadt7x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2360	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4932	chrome.exe
4932	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 4916	4932	chrome.exe	85
PID 4932 wrote to memory of 4328	4932	chrome.exe	86
PID 4932 wrote to memory of 4328	4932	chrome.exe	86
PID 4932 wrote to memory of 2360	4932	chrome.exe	87
PID 4932 wrote to memory of 1380	4932	chrome.exe	88
PID 4932 wrote to memory of 1380	4932	chrome.exe	88
PID 4932 wrote to memory of 368	4932	chrome.exe	90
PID 4932 wrote to memory of 3592	4932	chrome.exe	91
PID 4932 wrote to memory of 368	4932	chrome.exe	90
PID 4932 wrote to memory of 3592	4932	chrome.exe	91
PID 4932 wrote to memory of 4672	4932	chrome.exe	92
PID 4932 wrote to memory of 4672	4932	chrome.exe	92
PID 4932 wrote to memory of 1704	4932	chrome.exe	93
PID 4932 wrote to memory of 1704	4932	chrome.exe	93
PID 4932 wrote to memory of 3692	4932	chrome.exe	98

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://63.48.167.72.host.secureserver.net/?jQUnut7u?ref=8DDS&exp=56190&doc=3DA3L
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8593bc728,0x7ff8593bc734,0x7ff8593bc740
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1728,i,15199175976770637385,3335540281016287291,262144 --field-trial-handle=1996,i,12385999077665956139,15454367579977185330,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1572,i,11558688528489322312,10944125764633228005,524288 --field-trial-handle=1996,i,12385999077665956139,15454367579977185330,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,12436808658825943180,12708379025568370797,524288 --field-trial-handle=1996,i,12385999077665956139,15454367579977185330,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2476 /prefetch:8
  2⤵
  PID:1380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3152,i,12581232491522770129,11410021918763357802,2097152 --field-trial-handle=1996,i,12385999077665956139,15454367579977185330,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3172,i,6553327675751671309,11620596305332671493,2097152 --field-trial-handle=1996,i,12385999077665956139,15454367579977185330,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3844,i,15357791994957557492,14144329014892049664,2097152 --field-trial-handle=1996,i,12385999077665956139,15454367579977185330,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4404 /prefetch:2
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4412,i,15088558049129661849,8571573725863185000,2097152 --field-trial-handle=1996,i,12385999077665956139,15454367579977185330,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5860,i,5700691386154436741,14456725309478787413,524288 --field-trial-handle=1996,i,12385999077665956139,15454367579977185330,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:3692

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6f0b42ea-b594-4ade-a2e2-b39f12ce99d8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6f0b42ea-b594-4ade-a2e2-b39f12ce99d8.tmp
Size 131KB
SHA256 8ad1bad4ef2c1d6efd2a3db4deb6fd81ab6f5913453fece600ca962c65243dbf
MD5 258bdfc172e02e72e387fa88de237a7e
SHA1 33abc524954c9e73c5d33c2351051a71a7c38681
SHA512 3a4086ef46bf22e753d55185be064037af9e982e2cfc374bff125dba6dfbdf22efdbd6b3080162985e151892f121b3bb56259a7330816a7b14f033e0959f1244
SSDEEP 3072:SD+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:SD+hFD+7t56OD9ZfSAppr2
TLSH
T11FD312326A95D8BB89FD6541F157A300DE626CEE41DE3A09444A5F8ED09FC4D07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c34d7a4-7a54-44d0-b9d7-42dc07dd219d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4c34d7a4-7a54-44d0-b9d7-42dc07dd219d.tmp
Size 414B
SHA256 43a0fab29ba4ed2a00d3ccbd31be071f1b0786aa438832a24a8d5627979f98fc
MD5 0dfe3e501e79099e7db55b8d0d6014fb
SHA1 2701408fa6139b2b62056cf3f1af4b5d17a5c3ef
SHA512 d318126b7a10bab6bdb0e2e4ef93c905a6711968fc05a9745f99bec58791f5c0ffacf22b983e8d09f4d55c365bf3be087894dee46443ed1d803c787f94b65c39
TLSH
T131E022FEC922E82719FE0B5E6450168EEB4013672A81894F7F3D910D8FB163602CA92C
MD5 SHA1 SHA512 TLSH

Submit Download

6f9e4298-5e54-41e8-94fc-0d4da8751556.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6f9e4298-5e54-41e8-94fc-0d4da8751556.tmp
Size 17KB
SHA256 f7e0a7036b9bf87d18941afe0a0039bacd2a6a85b55115963a1d3bb3d3d25ed8
MD5 f5dea701d1a456a3a13710f824722a0b
SHA1 61f3bdb433c2dbd53fdfbd02fb2c0b467fc8f51a
SHA512 57ad41f970191f2aefbe4c358b9171c2932649453a5d90e4b2377a9c358a9d2f45247433f41a6836a315424d66459abb42a476e472641e65c9e0855795e04ac4
SSDEEP 384:nNjzO7KxkXqKf/pUZNCgVLH2HfgslYk7pLuLceSZkXODzq+ErU3yTHG3E5TZ64:nNzO7KxkXqKf/pUZNCgVLH2Hfgsik7p6
TLSH
T17A72F9A7BC4C9E3B4FE4C99CDC167B4FADB5024755E9886442FA582903C5BCB11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a5f41518-b2ed-4ce9-bbd7-94c08c1bdc82.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a5f41518-b2ed-4ce9-bbd7-94c08c1bdc82.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ba5104a34ca534a1610274f0db82e12ec61dc297f274b96367d9b36a35eb1a11
MD5 6c8cbfc8a7e072f504793e26d8bd1825
SHA1 00476ce44f04a7a365491f045a3c7aaf3ea6b6b6
SHA512 7278a5c25a9ed9bbc48d3b5e6ff6efccdbcb4ea622e1b335f7cbc62352564e5aa63a794a31532d49019b4f6a6b9cfe1c87863ac5ab9db59eda37222557b0f9c2
SSDEEP 192:eRtf+4LHSpv7+p3M3LPRp2hwsM29THsb+WNQTWr3cb27k0Ser7am7VyIsnAUge:eRtfApaFMXa9w342I0fa8e
TLSH
T1B752A32DFA10793B5CEBD229EA217757E7F5103264D42E80EAFC882C15DB9CC612741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e7920e6cef10c09_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\9e7920e6cef10c09_0
Size 196KB
SHA256 789405ef614e1e5acc182285ace12f0e389bd885dd74486c3533b779743bf2eb
MD5 c26e241ff5f433179d281fcda13f3c70
SHA1 db098c51deae4c833f5a400c567b656792c79e4a
SHA512 007021b6aeb9304eb62dbea50596ed04f15d02251cb492ea3c532e46475a76eed7665bb3b1c49993f1470eff11463283eafc0d1f8b872eabe1ff76d8a8376bcb
SSDEEP 3072:a2XU0LBARbIRdaYcob5ISvXFjvyomKJZu:ZXxLBKIRdaYxdImNNJZ
TLSH
T1A1146B356300F43FB923DE6162BE7F4E3C25A167DD0686FCA5A4E9309AD6DF20522748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef4c4731-bcdf-4c6c-b741-7a9d2dcb0f1b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ef4c4731-bcdf-4c6c-b741-7a9d2dcb0f1b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

b371d0c6-271d-446c-81c6-aa5d81743dcc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b371d0c6-271d-446c-81c6-aa5d81743dcc.tmp
Size 130KB
SHA256 c9ac92114cb7dbadcda351bb8c5c57f0d9b1cfd1e73b25c0ce3e35745fd0ee16
MD5 c0ec3bda0c945a4b0459f466292a5196
SHA1 d74e8c43d9d044aa532b63511fe14a559b380e74
SHA512 0118077ebe365b627fb5788a4f274090a9ae0199863cd14089237ef6f54ce2113c863fc5fdee76d9641950eb603863ced6414c1ead3b0d9567a4b9365d46af95
SSDEEP 3072:9+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:9+hFD+7t56OD9ZfSAppr2
TLSH
T192D31232AA91D8BBC9BC6541B157A304DE62ACED81DE3A0944495F8EE09FC4D0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download