253222e09885a3487fc16afff710ffdfe5f8cbda81eb83def2abfe87abd4d54c

Analysis

max time kernel
153s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2023 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Size

1.4MB
MD5

57231d7736db527e4a60ea3fcf6f4b87
SHA1

78e8b2735b6c265cf781feaa97e35d7abb135fa4
SHA256

6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb
SHA512

6883e54aba165e5c994dad2ef6f5384fc5b916551fc019e8f55182f0476c8ef0049ec6905bf0dec1cf1a613e1b826a2c4bc7a6b07e46cf4fb16886d531606a09
SSDEEP

24576:tGU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dR3Y5hsSe:wpEUIvU0N9jkpjweXt77I5ST

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 10 IoCs

Processes:

6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe

description	ioc	process
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
File opened for modification	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4836 taskkill.exe

pid	process
4836	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133238871854356071"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

chrome.exechrome.exe

pid process

980 chrome.exe
980 chrome.exe
980 chrome.exe
980 chrome.exe
4668 chrome.exe
4668 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

chrome.exe

pid process

980 chrome.exe
980 chrome.exe
980 chrome.exe
980 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exetaskkill.exechrome.exe

description	pid	process
Token: SeCreateTokenPrivilege	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: SeAssignPrimaryTokenPrivilege	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: SeLockMemoryPrivilege	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: SeIncreaseQuotaPrivilege	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: SeMachineAccountPrivilege	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: SeTcbPrivilege	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: SeSecurityPrivilege	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: SeTakeOwnershipPrivilege	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: SeLoadDriverPrivilege	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: SeSystemProfilePrivilege	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: SeSystemtimePrivilege	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: SeProfSingleProcessPrivilege	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: SeIncBasePriorityPrivilege	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: SeCreatePagefilePrivilege	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: SeCreatePermanentPrivilege	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: SeBackupPrivilege	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: SeRestorePrivilege	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: SeShutdownPrivilege	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: SeDebugPrivilege	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: SeAuditPrivilege	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: SeSystemEnvironmentPrivilege	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: SeChangeNotifyPrivilege	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: SeRemoteShutdownPrivilege	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: SeUndockPrivilege	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: SeSyncAgentPrivilege	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: SeEnableDelegationPrivilege	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: SeManageVolumePrivilege	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: SeImpersonatePrivilege	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: SeCreateGlobalPrivilege	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: 31	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: 32	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: 33	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: 34	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: 35	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
Token: SeDebugPrivilege	4836	taskkill.exe
Token: SeShutdownPrivilege	980	chrome.exe
Token: SeCreatePagefilePrivilege	980	chrome.exe
Token: SeShutdownPrivilege	980	chrome.exe
Token: SeCreatePagefilePrivilege	980	chrome.exe
Token: SeShutdownPrivilege	980	chrome.exe
Token: SeCreatePagefilePrivilege	980	chrome.exe
Token: SeShutdownPrivilege	980	chrome.exe
Token: SeCreatePagefilePrivilege	980	chrome.exe
Token: SeShutdownPrivilege	980	chrome.exe
Token: SeCreatePagefilePrivilege	980	chrome.exe
Token: SeShutdownPrivilege	980	chrome.exe
Token: SeCreatePagefilePrivilege	980	chrome.exe
Token: SeShutdownPrivilege	980	chrome.exe
Token: SeCreatePagefilePrivilege	980	chrome.exe
Token: SeShutdownPrivilege	980	chrome.exe
Token: SeCreatePagefilePrivilege	980	chrome.exe
Token: SeShutdownPrivilege	980	chrome.exe
Token: SeCreatePagefilePrivilege	980	chrome.exe
Token: SeShutdownPrivilege	980	chrome.exe
Token: SeCreatePagefilePrivilege	980	chrome.exe
Token: SeShutdownPrivilege	980	chrome.exe
Token: SeCreatePagefilePrivilege	980	chrome.exe
Token: SeShutdownPrivilege	980	chrome.exe
Token: SeCreatePagefilePrivilege	980	chrome.exe
Token: SeShutdownPrivilege	980	chrome.exe
Token: SeCreatePagefilePrivilege	980	chrome.exe
Token: SeShutdownPrivilege	980	chrome.exe
Token: SeCreatePagefilePrivilege	980	chrome.exe
Token: SeShutdownPrivilege	980	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.execmd.exechrome.exe

description	pid	process	target process
PID 4208 wrote to memory of 1108	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe	cmd.exe
PID 4208 wrote to memory of 1108	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe	cmd.exe
PID 4208 wrote to memory of 1108	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe	cmd.exe
PID 1108 wrote to memory of 4836	1108	cmd.exe	taskkill.exe
PID 1108 wrote to memory of 4836	1108	cmd.exe	taskkill.exe
PID 1108 wrote to memory of 4836	1108	cmd.exe	taskkill.exe
PID 4208 wrote to memory of 980	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe	chrome.exe
PID 4208 wrote to memory of 980	4208	6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe	chrome.exe
PID 980 wrote to memory of 4352	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 4352	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 3940	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 4080	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 4080	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 868	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 868	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 868	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 868	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 868	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 868	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 868	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 868	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 868	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 868	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 868	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 868	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 868	980	chrome.exe	chrome.exe
PID 980 wrote to memory of 868	980	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe
"C:\Users\Admin\AppData\Local\Temp\6d1133027af2e4788fd15dbe2c48bb73be105e127c751c440242ded990addeeb.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4208

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffecf199758,0x7ffecf199768,0x7ffecf199778
3⤵
PID:4352

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1836 --field-trial-handle=1852,i,15059895705791420743,10096151783499543461,131072 /prefetch:2
3⤵
PID:3940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1852,i,15059895705791420743,10096151783499543461,131072 /prefetch:8
3⤵
PID:4080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2252 --field-trial-handle=1852,i,15059895705791420743,10096151783499543461,131072 /prefetch:8
3⤵
PID:868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3172 --field-trial-handle=1852,i,15059895705791420743,10096151783499543461,131072 /prefetch:1
3⤵
PID:5012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3296 --field-trial-handle=1852,i,15059895705791420743,10096151783499543461,131072 /prefetch:1
3⤵
PID:4512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3780 --field-trial-handle=1852,i,15059895705791420743,10096151783499543461,131072 /prefetch:1
3⤵
PID:2832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5044 --field-trial-handle=1852,i,15059895705791420743,10096151783499543461,131072 /prefetch:1
3⤵
PID:4744

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5216 --field-trial-handle=1852,i,15059895705791420743,10096151783499543461,131072 /prefetch:8
3⤵
PID:2272

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4844 --field-trial-handle=1852,i,15059895705791420743,10096151783499543461,131072 /prefetch:8
3⤵
PID:1736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 --field-trial-handle=1852,i,15059895705791420743,10096151783499543461,131072 /prefetch:8
3⤵
PID:3572

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5564 --field-trial-handle=1852,i,15059895705791420743,10096151783499543461,131072 /prefetch:8
3⤵
PID:212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5700 --field-trial-handle=1852,i,15059895705791420743,10096151783499543461,131072 /prefetch:8
3⤵
PID:4880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 --field-trial-handle=1852,i,15059895705791420743,10096151783499543461,131072 /prefetch:8
3⤵
PID:4700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 --field-trial-handle=1852,i,15059895705791420743,10096151783499543461,131072 /prefetch:8
3⤵
PID:3748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5752 --field-trial-handle=1852,i,15059895705791420743,10096151783499543461,131072 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4668

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2740

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html
Filesize
786B

MD5
9ffe618d587a0685d80e9f8bb7d89d39

SHA1
8e9cae42c911027aafae56f9b1a16eb8dd7a739c

SHA256
a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e

SHA512
a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png
Filesize
6KB

MD5
362695f3dd9c02c83039898198484188

SHA1
85dcacc66a106feca7a94a42fc43e08c806a0322

SHA256
40cfea52dbc50a8a5c250c63d825dcaad3f76e9588f474b3e035b587c912f4ca

SHA512
a04dc31a6ffc3bb5d56ba0fb03ecf93a88adc7193a384313d2955701bd99441ddf507aa0ddfc61dfc94f10a7e571b3d6a35980e61b06f98dd9eee424dc594a6f

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js
Filesize
13KB

MD5
4ff108e4584780dce15d610c142c3e62

SHA1
77e4519962e2f6a9fc93342137dbb31c33b76b04

SHA256
fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a

SHA512
d6eee0fc02205a3422c16ad120cad8d871563d8fcd4bde924654eac5a37026726328f9a47240cf89ed6c9e93ba5f89c833e84e65eee7db2b4d7d1b4240deaef2

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js
Filesize
20KB

MD5
4d1d51371c713079ef327c586ba33e36

SHA1
065b168d91c39ee7435d82abeb717678e57b0696

SHA256
7b18f8189a48ed45adcc1b26dc9c67b6703617c72e53e4072cbdd03eb56331d7

SHA512
adb84c849a9610cc5eb8d3405c1d775473ed772fd0be34f1ed4ee1097673745250a07876cd5a8118c29deeed3460ef8995b47adaac9347aa5d6b7561a6143650

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js
Filesize
3KB

MD5
c31f14d9b1b840e4b9c851cbe843fc8f

SHA1
205e3a99dc6c0af0e2f4450ebaa49ebde8e76bb4

SHA256
03601415885fd5d8967c407f7320d53f4c9ca2ec33bbe767d73a1589c5e36c54

SHA512
2c3d7ed5384712a0013a2ebbc526e762f257e32199651192742282a9641946b6aea6235d848b1e8cb3b0f916f85d3708a14717a69cbcf081145bc634d11d75aa

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js
Filesize
84KB

MD5
a09e13ee94d51c524b7e2a728c7d4039

SHA1
0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae

SHA256
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

SHA512
f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js
Filesize
604B

MD5
23231681d1c6f85fa32e725d6d63b19b

SHA1
f69315530b49ac743b0e012652a3a5efaed94f17

SHA256
03164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a

SHA512
36860113871707a08401f29ab2828545932e57a4ae99e727d8ca2a9f85518d3db3a4e5e4d46ac2b6ba09494fa9727c033d77c36c4bdc376ae048541222724bc2

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js
Filesize
268B

MD5
0f26002ee3b4b4440e5949a969ea7503

SHA1
31fc518828fe4894e8077ec5686dce7b1ed281d7

SHA256
282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d

SHA512
4290a1aee5601fcbf1eb2beec9b4924c30cd218e94ae099b87ba72c9a4fa077e39d218fc723b8465d259028a6961cc07c0cd6896aa2f67e83f833ca023a80b11

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json
Filesize
1KB

MD5
05bfb082915ee2b59a7f32fa3cc79432

SHA1
c1acd799ae271bcdde50f30082d25af31c1208c3

SHA256
04392a223cc358bc79fcd306504e8e834d6febbff0f3496f2eb8451797d28aa1

SHA512
6feea1c8112ac33d117aef3f272b1cc42ec24731c51886ed6f8bc2257b91e4d80089e8ca7ce292cc2f39100a7f662bcc5c37e5622a786f8dc8ea46b8127152f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
230267a7a3d2648635a8189919c61649

SHA1
6e0aa2f3491e0639aeeb45523f725743677bf4b2

SHA256
c7fb1660ea7bfa27a1b7da37e50762dbb60a67742ca089d0ad432e8605283be7

SHA512
fd7e1120bf509642caa7ad9b69602cc71a467247f1a3efce4146673563d98be4dceca217a03e65413954cc1b7287d3048730a76e52c5d9a2057931c7a1d3fcaa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
874B

MD5
cca87e311b3553f27e63dbe6e76b7813

SHA1
7201c6a60ee76a018ffab7927c06d851aeb32233

SHA256
02818ea7e5bc0fb8ecc7bd73cfa6b8ed36e74d4476b328e3cbdd17131eb47771

SHA512
c1cdcb05227eef6ad02b87e11ba06456ffda518c2ce1d92b130969f8243b3d56aca5786ad7940df879cbe9d4f94bf2a8c9868f3e65caba10dc3b66ef23b18243

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
874B

MD5
cbcf1d0815a0a56a42847efe0f810951

SHA1
e14c78934db0d0b94aab2843ae5930aa35f87433

SHA256
09d2cb0dd29fc0f357ab28da6fb6721a611125aad635f70f7daded9b573b16b2

SHA512
4d08e4b1ea1f60ee2321d9d18b8a5602e89cf51eec27653468f6d0980c14e69bf2268033acbce597229f89f705fa82cba9c68b3a81968aa348f6c5893deb046d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
874B

MD5
6d46f686076f17b17190242d1b0639d3

SHA1
75cc007b44bfb0429345e7cb6923dcf2be47f42b

SHA256
909e6122133b30913e705a07a37031476159a413c843de29ed308cd9dbff29b5

SHA512
c9a7ce31a7646cc9f7ac6f192d2c1d423045b77ff67b56cf6a61c9722a65aae2aa77fc314766441f16ac5b40b035a951e198221c6de0e8a702b2eb49e0c2ebad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
c9d88937bc09d900b89b456b47ab3c12

SHA1
801f6c7941b8af5e3edba2fee6082887d28786c7

SHA256
4f96fdd41af7dfc806cde1843c5655f273321e9191ad658002564e2fb3d8e934

SHA512
91a4dc0793383ecbe1df3a6756ec9501d9439398c630ef7d0be84439a08f7e34103304d998374588d6845799348d451c530ea732a7571c2ae3fc7ecea680ae09

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
76894987178999e7221a895923fc42ab

SHA1
8d0ddc3094ae4eae88ccbc1bbe398081ce748dd4

SHA256
6f9de9060f4f8eff51412ed94c1b32d45632fc4a6073d4df86e771e7e33cd995

SHA512
a46b2384307c6afc2d31007766c614dcb98dd35fa4cd6c754ce4d7e9b0dccb57d24e6211169b419c386cd150d7017325a051abd70b718196a502ffe9981f7401

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
16KB

MD5
1cb8a8299921d6e0c6aebf0d6d422bda

SHA1
84772e39f1361d103801faaeea9ba09a66d0ed2a

SHA256
6130dcd359cad8069de8f4b0dbfcccc8489af3e4be81cfa1862f6276e4172e33

SHA512
62069d87faf3568de4efff4512b088b9b9bc35816818d44c205ac95d6142102be664fd3fe929960548c420940c05b68bf238dadd8ac123b6334a2cb378e560f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
16KB

MD5
685836dc47698fbe1784025acdc48f43

SHA1
5248faf3a26213df0af72b066b40e31c15cd0489

SHA256
f7771e5bb0faefe54e412bbd34aa0295a5615b78755ba24fa18cf2b6bcf7aae5

SHA512
f549ab0a597b7b269ac6c9d320f3e68f2b2fce859854090ab6842fa42093752cd94df0e4482c6b6b831f0d8a9e96fdff109ead07910bb728aacb5061c426af7c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
73KB

MD5
9291a9ecc14bbf1a0923f92c78f89e38

SHA1
0f6c97ce8f92eb61e30cbe999a8aa223b5463e01

SHA256
300c29835619b146a00b998a2b4f299f2f5668423222493b5c5932b4c11eaf11

SHA512
4ca0a87d01d40dc142cab804625de1ee88b854c2a620a91db0166e633bf5d47e0924cca67880284d9c1718b63618a63a0f0aa403bd235dae40014ef3b5a55344

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
74KB

MD5
dcfa2983b943686eca184fa0d02b06b9

SHA1
862765a5b73607e0ec934acd85cdae08766c6fe0

SHA256
3ed661bb5f44d70181a27c04e9cc0a0c5116435f67b1b25cddbfe518b0d6937e

SHA512
a65dd6faebd7f1d839032f9236976214bac89f0ac9fc28684e628285a860b340117753198582c4421f95cab483cf6ef6333ffe47303d7cea1983c5405bd0d2b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
72KB

MD5
54859653ca3e03c823097c4bec1454f7

SHA1
d8dff8bd2648dbb87df42ea4b4fdb01fb8e75cf6

SHA256
91126abe542b7c773ea7f757afc968428b472f07ac59221053efd5f0ae7b9547

SHA512
f6ad5fad75abd4638ed7e69531f56762f35922e57a7a5a4c826d106a1f53e597cdba54f274a2b887e8e75b42f3aad14d1d04073dd0fa6dec28873a979ddae88e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
73KB

MD5
0febe3ebcdf0a5613fd2e20b5d610e1e

SHA1
045eed87709107c51e0061db4d0703464df49ec2

SHA256
9aa3dc8acad390087736c1c8d3111a5e13e98826a46f1d0c9618b553face9816

SHA512
0fd77e28980b9cf390b9bbb127faf8b42a12892989575d2f97ad5e4ac872118985bdca7e48a35873a49fa6dc90a5cf279d52098ecff2abd9bc1661e6e56282f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_980_EMPFYRCGYAEJEMSB
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit