acf0a39be776853a0eb482fb11ad415291ed137fc4745ba58d4bbdae85c696e0

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2023, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9843219cf85f24b82c58989f4d739217.exe
Size 1.4MB
Sample230122-vs55wsgf66
SHA256 acf0a39be776853a0eb482fb11ad415291ed137fc4745ba58d4bbdae85c696e0
MD5 9843219cf85f24b82c58989f4d739217
SHA1 668d5af0b66c94c2dcc872133404883694fac527
SHA512 ed9beda9f8428147d0246753d13619737b1a0401b804901f84723602e8c84e6018e720d86b4f4fc516dbba6753c4aafd1b2e378af2702cad896312dbca79dc2c
SSDEEP 24576:0cpZQKEcUuafn9VsSuFlwk/4xK4v3DkODFBvUbLxaqW3neu6eho:pplErZv9xj5BvUbLxaT3eveO
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png	9843219cf85f24b82c58989f4d739217.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js	9843219cf85f24b82c58989f4d739217.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js	9843219cf85f24b82c58989f4d739217.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js	9843219cf85f24b82c58989f4d739217.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js	9843219cf85f24b82c58989f4d739217.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json	9843219cf85f24b82c58989f4d739217.exe
File opened for modification	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js	9843219cf85f24b82c58989f4d739217.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html	9843219cf85f24b82c58989f4d739217.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js	9843219cf85f24b82c58989f4d739217.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js	9843219cf85f24b82c58989f4d739217.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4608	taskkill.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3336	chrome.exe
3336	chrome.exe
1296	chrome.exe
1296	chrome.exe
4860	chrome.exe
4860	chrome.exe
2240	chrome.exe
2240	chrome.exe
4556	chrome.exe
4556	chrome.exe
3820	chrome.exe
3820	chrome.exe
5096	chrome.exe
5096	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	4948	9843219cf85f24b82c58989f4d739217.exe
Token: SeAssignPrimaryTokenPrivilege	4948	9843219cf85f24b82c58989f4d739217.exe
Token: SeLockMemoryPrivilege	4948	9843219cf85f24b82c58989f4d739217.exe
Token: SeIncreaseQuotaPrivilege	4948	9843219cf85f24b82c58989f4d739217.exe
Token: SeMachineAccountPrivilege	4948	9843219cf85f24b82c58989f4d739217.exe
Token: SeTcbPrivilege	4948	9843219cf85f24b82c58989f4d739217.exe
Token: SeSecurityPrivilege	4948	9843219cf85f24b82c58989f4d739217.exe
Token: SeTakeOwnershipPrivilege	4948	9843219cf85f24b82c58989f4d739217.exe
Token: SeLoadDriverPrivilege	4948	9843219cf85f24b82c58989f4d739217.exe
Token: SeSystemProfilePrivilege	4948	9843219cf85f24b82c58989f4d739217.exe
Token: SeSystemtimePrivilege	4948	9843219cf85f24b82c58989f4d739217.exe
Token: SeProfSingleProcessPrivilege	4948	9843219cf85f24b82c58989f4d739217.exe
Token: SeIncBasePriorityPrivilege	4948	9843219cf85f24b82c58989f4d739217.exe
Token: SeCreatePagefilePrivilege	4948	9843219cf85f24b82c58989f4d739217.exe
Token: SeCreatePermanentPrivilege	4948	9843219cf85f24b82c58989f4d739217.exe
Token: SeBackupPrivilege	4948	9843219cf85f24b82c58989f4d739217.exe
Token: SeRestorePrivilege	4948	9843219cf85f24b82c58989f4d739217.exe
Token: SeShutdownPrivilege	4948	9843219cf85f24b82c58989f4d739217.exe
Token: SeDebugPrivilege	4948	9843219cf85f24b82c58989f4d739217.exe
Token: SeAuditPrivilege	4948	9843219cf85f24b82c58989f4d739217.exe
Token: SeSystemEnvironmentPrivilege	4948	9843219cf85f24b82c58989f4d739217.exe
Token: SeChangeNotifyPrivilege	4948	9843219cf85f24b82c58989f4d739217.exe
Token: SeRemoteShutdownPrivilege	4948	9843219cf85f24b82c58989f4d739217.exe
Token: SeUndockPrivilege	4948	9843219cf85f24b82c58989f4d739217.exe
Token: SeSyncAgentPrivilege	4948	9843219cf85f24b82c58989f4d739217.exe
Token: SeEnableDelegationPrivilege	4948	9843219cf85f24b82c58989f4d739217.exe
Token: SeManageVolumePrivilege	4948	9843219cf85f24b82c58989f4d739217.exe
Token: SeImpersonatePrivilege	4948	9843219cf85f24b82c58989f4d739217.exe
Token: SeCreateGlobalPrivilege	4948	9843219cf85f24b82c58989f4d739217.exe
Token: 31	4948	9843219cf85f24b82c58989f4d739217.exe
Token: 32	4948	9843219cf85f24b82c58989f4d739217.exe
Token: 33	4948	9843219cf85f24b82c58989f4d739217.exe
Token: 34	4948	9843219cf85f24b82c58989f4d739217.exe
Token: 35	4948	9843219cf85f24b82c58989f4d739217.exe
Token: SeDebugPrivilege	4608	taskkill.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 3408	4948	9843219cf85f24b82c58989f4d739217.exe	82
PID 4948 wrote to memory of 3408	4948	9843219cf85f24b82c58989f4d739217.exe	82
PID 4948 wrote to memory of 3408	4948	9843219cf85f24b82c58989f4d739217.exe	82
PID 3408 wrote to memory of 4608	3408	cmd.exe	84
PID 3408 wrote to memory of 4608	3408	cmd.exe	84
PID 3408 wrote to memory of 4608	3408	cmd.exe	84
PID 4948 wrote to memory of 1296	4948	9843219cf85f24b82c58989f4d739217.exe	85
PID 4948 wrote to memory of 1296	4948	9843219cf85f24b82c58989f4d739217.exe	85
PID 1296 wrote to memory of 792	1296	chrome.exe	86
PID 1296 wrote to memory of 792	1296	chrome.exe	86
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 1696	1296	chrome.exe	88
PID 1296 wrote to memory of 3336	1296	chrome.exe	89
PID 1296 wrote to memory of 3336	1296	chrome.exe	89
PID 1296 wrote to memory of 2280	1296	chrome.exe	90
PID 1296 wrote to memory of 2280	1296	chrome.exe	90
PID 1296 wrote to memory of 2280	1296	chrome.exe	90
PID 1296 wrote to memory of 2280	1296	chrome.exe	90
PID 1296 wrote to memory of 2280	1296	chrome.exe	90
PID 1296 wrote to memory of 2280	1296	chrome.exe	90
PID 1296 wrote to memory of 2280	1296	chrome.exe	90
PID 1296 wrote to memory of 2280	1296	chrome.exe	90
PID 1296 wrote to memory of 2280	1296	chrome.exe	90
PID 1296 wrote to memory of 2280	1296	chrome.exe	90
PID 1296 wrote to memory of 2280	1296	chrome.exe	90
PID 1296 wrote to memory of 2280	1296	chrome.exe	90

C:\Users\Admin\AppData\Local\Temp\9843219cf85f24b82c58989f4d739217.exe
"C:\Users\Admin\AppData\Local\Temp\9843219cf85f24b82c58989f4d739217.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe9ed4f50,0x7fffe9ed4f60,0x7fffe9ed4f70
    3⤵
    PID:792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1604,3469393697801218734,11243532516258957221,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1632 /prefetch:2
    3⤵
    PID:1696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1604,3469393697801218734,11243532516258957221,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1984 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1604,3469393697801218734,11243532516258957221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2268 /prefetch:8
    3⤵
    PID:2280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,3469393697801218734,11243532516258957221,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2948 /prefetch:1
    3⤵
    PID:1916
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,3469393697801218734,11243532516258957221,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
    3⤵
    PID:4836
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,3469393697801218734,11243532516258957221,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2708 /prefetch:1
    3⤵
    PID:1624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,3469393697801218734,11243532516258957221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
    3⤵
    PID:668
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,3469393697801218734,11243532516258957221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4676 /prefetch:8
    3⤵
    PID:1252
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,3469393697801218734,11243532516258957221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4612 /prefetch:8
    3⤵
    PID:1752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,3469393697801218734,11243532516258957221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4924 /prefetch:8
    3⤵
    PID:1908
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,3469393697801218734,11243532516258957221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5824 /prefetch:8
    3⤵
    PID:3992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1604,3469393697801218734,11243532516258957221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2240
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,3469393697801218734,11243532516258957221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5484 /prefetch:8
    3⤵
    PID:2352
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1604,3469393697801218734,11243532516258957221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4860
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,3469393697801218734,11243532516258957221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5884 /prefetch:8
    3⤵
    PID:4876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,3469393697801218734,11243532516258957221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5824 /prefetch:8
    3⤵
    PID:4592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,3469393697801218734,11243532516258957221,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
    3⤵
    PID:2348
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1604,3469393697801218734,11243532516258957221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1468 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1604,3469393697801218734,11243532516258957221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3820
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,3469393697801218734,11243532516258957221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
    3⤵
    PID:4296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1604,3469393697801218734,11243532516258957221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,3469393697801218734,11243532516258957221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
    3⤵
    PID:4608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,3469393697801218734,11243532516258957221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
    3⤵
    PID:2848
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,3469393697801218734,11243532516258957221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
    3⤵
    PID:4884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,3469393697801218734,11243532516258957221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
    3⤵
    PID:1316
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,3469393697801218734,11243532516258957221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
    3⤵
    PID:1464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1604,3469393697801218734,11243532516258957221,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2100 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,3469393697801218734,11243532516258957221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1468 /prefetch:8
    3⤵
    PID:3872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

background.html

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html
Size 786B
SHA256 a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e
MD5 9ffe618d587a0685d80e9f8bb7d89d39
SHA1 8e9cae42c911027aafae56f9b1a16eb8dd7a739c
SHA512 a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12
MD5 SHA1 SHA512

Submit Download

icon.png

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png
Size 6KB
SHA256 40cfea52dbc50a8a5c250c63d825dcaad3f76e9588f474b3e035b587c912f4ca
MD5 362695f3dd9c02c83039898198484188
SHA1 85dcacc66a106feca7a94a42fc43e08c806a0322
SHA512 a04dc31a6ffc3bb5d56ba0fb03ecf93a88adc7193a384313d2955701bd99441ddf507aa0ddfc61dfc94f10a7e571b3d6a35980e61b06f98dd9eee424dc594a6f
SSDEEP 192:+Ux65UF6vFM2Wx8DJCyt5hDeW98wcE587tBq28g7:Mq0tVWx8IyzhDeW98rE587X5
MD5 SHA1 SHA512 SSDEEP

Submit Download

aes.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js
Size 13KB
SHA256 fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a
MD5 4ff108e4584780dce15d610c142c3e62
SHA1 77e4519962e2f6a9fc93342137dbb31c33b76b04
SHA512 d6eee0fc02205a3422c16ad120cad8d871563d8fcd4bde924654eac5a37026726328f9a47240cf89ed6c9e93ba5f89c833e84e65eee7db2b4d7d1b4240deaef2
SSDEEP 192:9pQGDuD690MPdz8Ui015ll1I57I2Tru6h0hNmHV+m9eIfyAqYfinNVYEUUFJZmUY:9OiT0wz8Uiw/1S7DegkcHpeIuScZbAX
MD5 SHA1 SHA512 SSDEEP

Submit Download

background.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js
Size 20KB
SHA256 425567cd8aec35641357b604787645d2c89d11547306bdbd8ca59bf383940a82
MD5 2b164b439434999575f9a04a9be2db4e
SHA1 8a69b2dc19cffa5b46422904095d5d6765bedeb6
SHA512 0cc77cdb3510b5d8500b39594aa021ec9cdd330ef357d187ed6c9374b5ecdd7a765172a579f79faabbbabeb4caeffa46a43a3314e097cf5b10993a9aa787f36c
SSDEEP 384:MBS4kxHMJkk6P77jysa4PlAYS5uxIk8mjHflPwnn7EO2lGCOy1yygHyskAT5iclb:MB7kd6kk6P77jysa4PlAYS5uxIk8mjH4
MD5 SHA1 SHA512 SSDEEP

Submit Download

content.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js
Size 3KB
SHA256 1fa3f358c7877cd49011adc35d8ac163b3b7dfa5703ac840ae01777c379cb71c
MD5 e4f23ca32cacfb4de268eb194cc21143
SHA1 8d747bec1f49e0de55efefe79765870ea5b1b27c
SHA512 ecc4c7da2b69b9badec1fb378ad1d8773142d2fa6377ff0ab2d825568a950205cfb48752c84479863eedf3f362b84aecc9bc6c542eb8fb26f136b8df364162ca
MD5 SHA1 SHA512

Submit Download

jquery-3.3.1.min.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js
Size 84KB
SHA256 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
MD5 a09e13ee94d51c524b7e2a728c7d4039
SHA1 0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae
SHA512 f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a
SSDEEP 1536:jLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6t3:5kn6x2xe9NK6nC69
MD5 SHA1 SHA512 SSDEEP

Submit Download

mode-ecb.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js
Size 604B
SHA256 03164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a
MD5 23231681d1c6f85fa32e725d6d63b19b
SHA1 f69315530b49ac743b0e012652a3a5efaed94f17
SHA512 36860113871707a08401f29ab2828545932e57a4ae99e727d8ca2a9f85518d3db3a4e5e4d46ac2b6ba09494fa9727c033d77c36c4bdc376ae048541222724bc2
MD5 SHA1 SHA512

Submit Download

pad-nopadding.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js
Size 268B
SHA256 282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d
MD5 0f26002ee3b4b4440e5949a969ea7503
SHA1 31fc518828fe4894e8077ec5686dce7b1ed281d7
SHA512 4290a1aee5601fcbf1eb2beec9b4924c30cd218e94ae099b87ba72c9a4fa077e39d218fc723b8465d259028a6961cc07c0cd6896aa2f67e83f833ca023a80b11
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json
Size 1KB
SHA256 04392a223cc358bc79fcd306504e8e834d6febbff0f3496f2eb8451797d28aa1
MD5 05bfb082915ee2b59a7f32fa3cc79432
SHA1 c1acd799ae271bcdde50f30082d25af31c1208c3
SHA512 6feea1c8112ac33d117aef3f272b1cc42ec24731c51886ed6f8bc2257b91e4d80089e8ca7ce292cc2f39100a7f662bcc5c37e5622a786f8dc8ea46b8127152f3
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 d68ee6e985da2da59a0c5c3404feb1c51a1af9f1e1d8669c9d55813ac57b9a00
MD5 f9564f170a40d1b46cf2cdecff3d900a
SHA1 1c073ebfaadb5cc2393a5f7b88a3199053844aec
SHA512 cff7410937d73da90cbe442c9bfd009276feaeb8928fbb001f283cb33190bd62be2f04dd6db9ed71e76490d1e8d3ed8f783dc7cb1fb70e50ff52c22d9326ffa9
SSDEEP 384:5TtvLlNXp1kXqKf/pUZNCgVLH2Hfn7rUa8ypFJJS2IW:zLlpp1kXqKf/pUZNCgVLH2Hf7rUa8ypd
MD5 SHA1 SHA512 SSDEEP

Submit Download