Analysis
- max time kernel
26s - max time network
8s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
01/11/2026, 20:56
Static task
static1
Behavioral task
behavioral1
Sample
clicker.html
Resource
win11-20260911-en
windows11-21h2-x64
9 signatures
120 seconds
Behavioral task
behavioral2
Sample
clicker.html
Resource
android-34-x64-arm64-20260325.1-en
android-14-x64
2 signatures
120 seconds
General
- Target clicker.html
- Size 82KB
- Sample261101-zrdfpsdc67
- SHA256 b16346b13010d7dccffd01a8aa847ef6cb7b53c5e4da5e303899d114f96f1b16
- MD5 7179e63c4372bb24f596f4494ac18316
- SHA1 e26ac29938a6497cd8f0066b9b53b102b171d037
- SHA512 8ae350a37e1b22d5f3ed68608705cf44a01758c1cd2cc0219ae1098c7fb2df7bcd4f38b78e16e3d4dde142ce68aadfdb0cec6ac9935c7fe3df21e93e1942949c
- SSDEEP 768:RUxVOoEcNEphlCjUf+eziaTxTJgi1Fjk3JmbfZUMg2/KBYZr:RUxVOoEDJ+iRgi1Fw3mZVg2/LZr
- TLSH T1D683F8605291106A2533D3B6EB179B1AFEB242376707439876FC01E52FF6A14C27EE9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1512 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4848 chrome.exe 4848 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4848 chrome.exe 4848 chrome.exe - Suspicious use of AdjustPrivilegeToken 52 IoCs
description pid Process Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4848 wrote to memory of 2084 4848 chrome.exe 80 PID 4848 wrote to memory of 3520 4848 chrome.exe 81 PID 4848 wrote to memory of 3520 4848 chrome.exe 81 PID 4848 wrote to memory of 1512 4848 chrome.exe 82 PID 4848 wrote to memory of 2016 4848 chrome.exe 84 PID 4848 wrote to memory of 2016 4848 chrome.exe 84 PID 4848 wrote to memory of 3588 4848 chrome.exe 85 PID 4848 wrote to memory of 3588 4848 chrome.exe 85 PID 4848 wrote to memory of 2468 4848 chrome.exe 86 PID 4848 wrote to memory of 2468 4848 chrome.exe 86 PID 4848 wrote to memory of 5092 4848 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\clicker.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9369dc728,0x7ff9369dc734,0x7ff9369dc7402⤵PID:2084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,13976288111018524278,15249026852087593134,262144 --field-trial-handle=1872,i,6888390319736482523,710294885120428745,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1860 /prefetch:22⤵PID:3520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,14285578207531315277,5548233438347979240,524288 --field-trial-handle=1872,i,6888390319736482523,710294885120428745,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2240 /prefetch:112⤵
- System Time Discovery
PID:1512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,979725629201217565,4825466436965767462,524288 --field-trial-handle=1872,i,6888390319736482523,710294885120428745,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1816 /prefetch:132⤵PID:2016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3180,i,5334377477319927850,9740025741449767731,2097152 --field-trial-handle=1872,i,6888390319736482523,710294885120428745,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:3588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3152,i,3117244036654739095,11755877600991461564,2097152 --field-trial-handle=1872,i,6888390319736482523,710294885120428745,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:2468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5164,i,12868222158286879972,17830916096530901237,524288 --field-trial-handle=1872,i,6888390319736482523,710294885120428745,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5168 /prefetch:142⤵PID:5092
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:704
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3480
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4230f7e5-2819-4e00-9c6d-31842cf41937.tmp
- Size 130KB
- SHA256 2b7b5539c324dfddf07fc4210e239c22119f2602caf0de21f13f62d3a2445495
- MD5 747ff16843422598c646f56598389b06
- SHA1 0f1007cb189016e982a47cff626817ed0297d743
- SHA512 5b28eff0c77d43ed414f3898487afc88424017fb3827e3105dc066cf12a6db200f104510e481b0a42849ca53a3a776986e7b4434e297cab7edc7d3b300e600c9
- SSDEEP 3072:GH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjt:mt4fLJ0L6nGJxi3bzqapJjt
- TLSH T147D302F0C2A06C7ACBFBEE4145755E948F71D5C689CDBE2405F9881806CEA354E13EA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\24443f11-f59d-450d-9337-485eefc8e9dd.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\43d0a152-90f8-41e4-b8b2-f945732ca773.tmp
- Size 414B
- SHA256 b6b3ba3226f269faaacb6fc6b76591671f00893565e9c07d93d932300c0d6ad5
- MD5 dd5fcf117c87c2c5e2d1096feef7fb47
- SHA1 c16064e0942ce8517f82efa3cecf188bad82e6e4
- SHA512 7819f77f9a84bc6708db9ec9cbe9f0065fcf19de3608ff6c7e8b1c0b117fd639ab68c9da90e9201bb8a0ededbc692954d10cfface86b8930c6182c3d648c94f7
- TLSH T162E02BA6CD26EC3708F9071811544B56E751131B2691894F373C8119CF7473705D786C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\5e49b96b-7868-4225-a897-21c0a4d79566.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c9b634e6-9b7b-4a33-b189-780bc0d784f5.tmp
- Size 11KB
- SHA256 1041727d232bb636a1a655bfa3bce9a29d75ea3422ed86578a76c7368b5dacc6
- MD5 2c4f8c4b1d4bf10039a77c22ca5059cc
- SHA1 6955a27aad0729b96174b8c559453388da19c79e
- SHA512 6c340248440e24cc16d8ef399485f33172f4d1dd35fe50c7b5f30699228897372c0f631099d4f8f89012f9b9183a0dded8c389f1d64f2b38b45c5bd0f9a2c0a2
- SSDEEP 192:BReFhUM+5eIv7xpAPRp2pg9qHsb+WNn8iP24eUsa1b1VyIsnAUge:BRcsoU1UXNswFPsaZe
- TLSH T1D142943DAD14753B6CDBD22AEB667B53E6F6102120943E80EAFC897C15D76CC221781B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ecfb0510-5321-4022-9b83-e140c2e29c6d.tmp
- Size 11KB
- SHA256 abd6daa20de1a8efb404d2e6b18db3d1db5a951ea981436a8e6f2178407c092b
- MD5 42120140355b12765ba9657c841e9bee
- SHA1 ce7e475b4029003b3c935b546de18f510441386b
- SHA512 6409499e03bc29a98239958666ce4d65919525a1e2bc13cd4107305eb01fa9c78dc76e63347d2d793a993f53c024dd4ca4cf42079a1d37654c407ef10b4f465c
- SSDEEP 192:e9OI24K6vOIz7KxkXqK4I40pUZNCgVLHrKHfFKslHlOI/XzKD/qOIP+ErUkKNb7S:hzjdQ7KxkXqKf/pUZNCgVLH2HfgslgSp
- TLSH T18A32D927948D9E3F0FDCD509CC167F4BACB5029673684D2496FF9C0803A67CA514A6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f5e717f5-258a-40fe-aef3-b8d2bffdfa51.tmp
- Size 131KB
- SHA256 7fbed3f37243ee176caf20457b9e534e5dc25cb86a60139722b6b3a282dd70fe
- MD5 f4f5878dc4a3534ba7573d4c469badeb
- SHA1 05bd7ed13f75597341697596a5a17c6beacd0865
- SHA512 2d0057bac2f0fd7f965e966aaf5d80e640b3cab91553f06e9943c1ad928d47ee2ecce184f415a52c0ffc0f31ebc27c83ad2d18cddb4317e210097dfa9c9fdbdf
- SSDEEP 3072:qDH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjt:qRt4fLJ0L6nGJxi3bzqapJjt
- TLSH T1F3D312F0C1A06C7ACBF7EE5145756E948FB1D5C689CDBE2005FA8D1806CEA344A13EA3
- MD5 SHA1 SHA512 SSDEEP TLSH