d7140018b6ca4711fc2630b815d6aa869dcf472b12ae67d588738eba1765633b

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22-03-2023 04:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54f8a4c3864f17466705a15a2ef2a06f.exe
Size

1.4MB
MD5

54f8a4c3864f17466705a15a2ef2a06f
SHA1

db53ec7eaf2928f8b627f36766ccf7c293bf910f
SHA256

d7140018b6ca4711fc2630b815d6aa869dcf472b12ae67d588738eba1765633b
SHA512

7bb0bc0aa4f22de48284f401a382ed937407324bf25bc30337ca89d342cba0394fedb8e9ead1c8d3c05db6232c6c7bfa484261f633aa1a29940deaef04bcd78a
SSDEEP

24576:AGU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dRbr5hMS6S:bpEUIvU0N9jkpjweXt77X5yjS

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 10 IoCs

Processes:

54f8a4c3864f17466705a15a2ef2a06f.exe

description	ioc	process
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js	54f8a4c3864f17466705a15a2ef2a06f.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js	54f8a4c3864f17466705a15a2ef2a06f.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json	54f8a4c3864f17466705a15a2ef2a06f.exe
File opened for modification	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js	54f8a4c3864f17466705a15a2ef2a06f.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html	54f8a4c3864f17466705a15a2ef2a06f.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png	54f8a4c3864f17466705a15a2ef2a06f.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js	54f8a4c3864f17466705a15a2ef2a06f.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js	54f8a4c3864f17466705a15a2ef2a06f.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js	54f8a4c3864f17466705a15a2ef2a06f.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js	54f8a4c3864f17466705a15a2ef2a06f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1140 taskkill.exe

pid	process
1140	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133239379867535228"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

444 chrome.exe
444 chrome.exe
4952 chrome.exe
4952 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

chrome.exe

pid process

444 chrome.exe
444 chrome.exe
444 chrome.exe
444 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

54f8a4c3864f17466705a15a2ef2a06f.exetaskkill.exechrome.exe

description	pid	process
Token: SeCreateTokenPrivilege	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: SeAssignPrimaryTokenPrivilege	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: SeLockMemoryPrivilege	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: SeIncreaseQuotaPrivilege	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: SeMachineAccountPrivilege	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: SeTcbPrivilege	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: SeSecurityPrivilege	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: SeTakeOwnershipPrivilege	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: SeLoadDriverPrivilege	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: SeSystemProfilePrivilege	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: SeSystemtimePrivilege	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: SeProfSingleProcessPrivilege	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: SeIncBasePriorityPrivilege	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: SeCreatePagefilePrivilege	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: SeCreatePermanentPrivilege	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: SeBackupPrivilege	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: SeRestorePrivilege	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: SeShutdownPrivilege	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: SeDebugPrivilege	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: SeAuditPrivilege	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: SeSystemEnvironmentPrivilege	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: SeChangeNotifyPrivilege	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: SeRemoteShutdownPrivilege	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: SeUndockPrivilege	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: SeSyncAgentPrivilege	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: SeEnableDelegationPrivilege	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: SeManageVolumePrivilege	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: SeImpersonatePrivilege	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: SeCreateGlobalPrivilege	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: 31	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: 32	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: 33	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: 34	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: 35	2212	54f8a4c3864f17466705a15a2ef2a06f.exe
Token: SeDebugPrivilege	1140	taskkill.exe
Token: SeShutdownPrivilege	444	chrome.exe
Token: SeCreatePagefilePrivilege	444	chrome.exe
Token: SeShutdownPrivilege	444	chrome.exe
Token: SeCreatePagefilePrivilege	444	chrome.exe
Token: SeShutdownPrivilege	444	chrome.exe
Token: SeCreatePagefilePrivilege	444	chrome.exe
Token: SeShutdownPrivilege	444	chrome.exe
Token: SeCreatePagefilePrivilege	444	chrome.exe
Token: SeShutdownPrivilege	444	chrome.exe
Token: SeCreatePagefilePrivilege	444	chrome.exe
Token: SeShutdownPrivilege	444	chrome.exe
Token: SeCreatePagefilePrivilege	444	chrome.exe
Token: SeShutdownPrivilege	444	chrome.exe
Token: SeCreatePagefilePrivilege	444	chrome.exe
Token: SeShutdownPrivilege	444	chrome.exe
Token: SeCreatePagefilePrivilege	444	chrome.exe
Token: SeShutdownPrivilege	444	chrome.exe
Token: SeCreatePagefilePrivilege	444	chrome.exe
Token: SeShutdownPrivilege	444	chrome.exe
Token: SeCreatePagefilePrivilege	444	chrome.exe
Token: SeShutdownPrivilege	444	chrome.exe
Token: SeCreatePagefilePrivilege	444	chrome.exe
Token: SeShutdownPrivilege	444	chrome.exe
Token: SeCreatePagefilePrivilege	444	chrome.exe
Token: SeShutdownPrivilege	444	chrome.exe
Token: SeCreatePagefilePrivilege	444	chrome.exe
Token: SeShutdownPrivilege	444	chrome.exe
Token: SeCreatePagefilePrivilege	444	chrome.exe
Token: SeShutdownPrivilege	444	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe
444	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

54f8a4c3864f17466705a15a2ef2a06f.execmd.exechrome.exe

description	pid	process	target process
PID 2212 wrote to memory of 5116	2212	54f8a4c3864f17466705a15a2ef2a06f.exe	cmd.exe
PID 2212 wrote to memory of 5116	2212	54f8a4c3864f17466705a15a2ef2a06f.exe	cmd.exe
PID 2212 wrote to memory of 5116	2212	54f8a4c3864f17466705a15a2ef2a06f.exe	cmd.exe
PID 5116 wrote to memory of 1140	5116	cmd.exe	taskkill.exe
PID 5116 wrote to memory of 1140	5116	cmd.exe	taskkill.exe
PID 5116 wrote to memory of 1140	5116	cmd.exe	taskkill.exe
PID 2212 wrote to memory of 444	2212	54f8a4c3864f17466705a15a2ef2a06f.exe	chrome.exe
PID 2212 wrote to memory of 444	2212	54f8a4c3864f17466705a15a2ef2a06f.exe	chrome.exe
PID 444 wrote to memory of 548	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 548	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 3336	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 4536	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 4536	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 836	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 836	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 836	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 836	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 836	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 836	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 836	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 836	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 836	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 836	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 836	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 836	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 836	444	chrome.exe	chrome.exe
PID 444 wrote to memory of 836	444	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\54f8a4c3864f17466705a15a2ef2a06f.exe
"C:\Users\Admin\AppData\Local\Temp\54f8a4c3864f17466705a15a2ef2a06f.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:5116

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:444

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb89319758,0x7ffb89319768,0x7ffb89319778
3⤵
PID:548

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1812,i,14973494629037925893,1185873167359474857,131072 /prefetch:2
3⤵
PID:3336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1812,i,14973494629037925893,1185873167359474857,131072 /prefetch:8
3⤵
PID:4536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1812,i,14973494629037925893,1185873167359474857,131072 /prefetch:8
3⤵
PID:836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3184 --field-trial-handle=1812,i,14973494629037925893,1185873167359474857,131072 /prefetch:1
3⤵
PID:2636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3220 --field-trial-handle=1812,i,14973494629037925893,1185873167359474857,131072 /prefetch:1
3⤵
PID:2848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3852 --field-trial-handle=1812,i,14973494629037925893,1185873167359474857,131072 /prefetch:1
3⤵
PID:3852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4788 --field-trial-handle=1812,i,14973494629037925893,1185873167359474857,131072 /prefetch:1
3⤵
PID:2200

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5080 --field-trial-handle=1812,i,14973494629037925893,1185873167359474857,131072 /prefetch:8
3⤵
PID:2456

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5372 --field-trial-handle=1812,i,14973494629037925893,1185873167359474857,131072 /prefetch:8
3⤵
PID:3900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5228 --field-trial-handle=1812,i,14973494629037925893,1185873167359474857,131072 /prefetch:8
3⤵
PID:2832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5524 --field-trial-handle=1812,i,14973494629037925893,1185873167359474857,131072 /prefetch:8
3⤵
PID:1280

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 --field-trial-handle=1812,i,14973494629037925893,1185873167359474857,131072 /prefetch:8
3⤵
PID:3732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5108 --field-trial-handle=1812,i,14973494629037925893,1185873167359474857,131072 /prefetch:8
3⤵
PID:3640

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 --field-trial-handle=1812,i,14973494629037925893,1185873167359474857,131072 /prefetch:8
3⤵
PID:1788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5564 --field-trial-handle=1812,i,14973494629037925893,1185873167359474857,131072 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4952

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2232

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html
Filesize
786B

MD5
9ffe618d587a0685d80e9f8bb7d89d39

SHA1
8e9cae42c911027aafae56f9b1a16eb8dd7a739c

SHA256
a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e

SHA512
a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png
Filesize
6KB

MD5
362695f3dd9c02c83039898198484188

SHA1
85dcacc66a106feca7a94a42fc43e08c806a0322

SHA256
40cfea52dbc50a8a5c250c63d825dcaad3f76e9588f474b3e035b587c912f4ca

SHA512
a04dc31a6ffc3bb5d56ba0fb03ecf93a88adc7193a384313d2955701bd99441ddf507aa0ddfc61dfc94f10a7e571b3d6a35980e61b06f98dd9eee424dc594a6f

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js
Filesize
13KB

MD5
4ff108e4584780dce15d610c142c3e62

SHA1
77e4519962e2f6a9fc93342137dbb31c33b76b04

SHA256
fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a

SHA512
d6eee0fc02205a3422c16ad120cad8d871563d8fcd4bde924654eac5a37026726328f9a47240cf89ed6c9e93ba5f89c833e84e65eee7db2b4d7d1b4240deaef2

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js
Filesize
20KB

MD5
8b59456bf52fc54fc2c78cada988a1b0

SHA1
f30528186ece378cfcdf95cde441982a78d55733

SHA256
3191896fd3c148a2c295c0eaf5fa1c4cd6384f197cb1431521a013f807588e24

SHA512
399b8aaf48566ef09fa34e8b5ef0caa1b6aeabe9c0a39eee3f50ced3737a5631cdba0bb72035015f480070d1e17a4c8ed6cb921b88d07c5cc27585d3128dd482

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js
Filesize
3KB

MD5
c31f14d9b1b840e4b9c851cbe843fc8f

SHA1
205e3a99dc6c0af0e2f4450ebaa49ebde8e76bb4

SHA256
03601415885fd5d8967c407f7320d53f4c9ca2ec33bbe767d73a1589c5e36c54

SHA512
2c3d7ed5384712a0013a2ebbc526e762f257e32199651192742282a9641946b6aea6235d848b1e8cb3b0f916f85d3708a14717a69cbcf081145bc634d11d75aa

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js
Filesize
84KB

MD5
a09e13ee94d51c524b7e2a728c7d4039

SHA1
0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae

SHA256
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

SHA512
f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js
Filesize
604B

MD5
23231681d1c6f85fa32e725d6d63b19b

SHA1
f69315530b49ac743b0e012652a3a5efaed94f17

SHA256
03164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a

SHA512
36860113871707a08401f29ab2828545932e57a4ae99e727d8ca2a9f85518d3db3a4e5e4d46ac2b6ba09494fa9727c033d77c36c4bdc376ae048541222724bc2

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js
Filesize
268B

MD5
0f26002ee3b4b4440e5949a969ea7503

SHA1
31fc518828fe4894e8077ec5686dce7b1ed281d7

SHA256
282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d

SHA512
4290a1aee5601fcbf1eb2beec9b4924c30cd218e94ae099b87ba72c9a4fa077e39d218fc723b8465d259028a6961cc07c0cd6896aa2f67e83f833ca023a80b11

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json
Filesize
1KB

MD5
05bfb082915ee2b59a7f32fa3cc79432

SHA1
c1acd799ae271bcdde50f30082d25af31c1208c3

SHA256
04392a223cc358bc79fcd306504e8e834d6febbff0f3496f2eb8451797d28aa1

SHA512
6feea1c8112ac33d117aef3f272b1cc42ec24731c51886ed6f8bc2257b91e4d80089e8ca7ce292cc2f39100a7f662bcc5c37e5622a786f8dc8ea46b8127152f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
24b03da76bbe7294e5a457056160d249

SHA1
3eb022e9cc57d54a86b8f023a8f176a65808574b

SHA256
77bbecbc2e0057a06db679a4f718d618152a9c10390d51ae311020739e0e5de0

SHA512
0349d9572a212d3908444efde0650d21b9e9f4a6102f270c02f97cb1ea1b0979a552c87a8f48ea1f0e112e534a2145e42ef7278ab068f344cb0dc6f590053ed0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
874B

MD5
cc9510a3311f4b4682a93df151c2ff4b

SHA1
77f1417e5961a768593a215abc19516f03c1892e

SHA256
a2039045591b0b1a64999cecfd23d169e64e6d532e09aca6802f2e89e7aa5407

SHA512
f3cdb1135530be4c75314fb5ece458507465a48a752b31dc3af4210ab5204ba071e6c7861c46ab3c6ed4fabcced9317faeb0b4b9f32c01ad31db11ee7ac39b42

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
874B

MD5
7467178f94bf97389ab90b74c07aeded

SHA1
dd472ac2ddc12d1973846487a864e81eea22f376

SHA256
0186573970593414e094bfd253277e3e82810e15e1266021a9e5ef4d7c63f977

SHA512
96ef0a675979663b5f452f162fc6129e137ea6c56f21d4ba9722120e7d711db89fd963dcb81814d33c6f061557115d76adc10bcc4d2822f8b7c6d34a237584f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
874B

MD5
4bb91c6e4b538fcc00d44fcaad68d2e5

SHA1
b19463b178b3d6bbbda7f769046f01abb3a338ff

SHA256
3a6412df0c6a040521bf32280d96f3e4263bc5320299f170c8878d8a69f73c32

SHA512
62e0eff05cd0667ac2b0259f1046cac4058ce09109035506e6517a55c0bc803c95fd3c3e4f4d079c2a4184e4b9506ba43ce63483e9e4b742bddf61ba5d97841e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\e5e8c4d9-096f-434a-b312-10626d6fbd86.tmp
Filesize
874B

MD5
49067125a696ab8ccedf9b052238fd11

SHA1
31c5958e1a20874d9ba66d43571d17e2198e993c

SHA256
d11c7413ed6872e65794135ef10c381efa814542460b2c19b3156d8e0146138a

SHA512
490e4e10d04571eb077b3834a99805a79fa605687d9c8acd1afa726d36a9145d90ecc324ad5b30f46aa54d6eb2ba7654e7d06bd46379a229337769287ef0f3f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
7623c04d598e391ead4e9b7dbd60f252

SHA1
122beb74369565ebbe04de7c420e3b9ada6b508d

SHA256
dad3ac6a023bd9763f2ea9d98436b8eb1c87ee47610105c13be26305a06d0b01

SHA512
0a2e08a97965cf9cbfd611cc76d13630dc88ccbf16447ffdf715fe20a427397e5ca80b25269219b2b81c7521930037e792e7d1d6d765d3674cd87b7346f8ee6e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
3f8c6af77a42c72499d4d36ac3417c36

SHA1
acb2a5c9047db1596c60e43795999fecaeaa0483

SHA256
be0969cb5e8cf7f2869e3aee3801725373f976911df866750d7401f01172e82a

SHA512
d482a243597e3aaf57a3db5203a62d1aa3c1ebe937179b2a85dd8f819bffdd1dc1dbf9e626647e79623532568f344bc034539d743d2a7ccb1167b81f74a84001

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
16KB

MD5
ac821ea53c1507f9d1c5ba900bda2bb0

SHA1
20180a35eb36abb179ccb205ecd4de974c7e2a91

SHA256
87dbcf25a4a3b902169a4d330e2abdd36f3c383035dc0113b5991970ca46380f

SHA512
661875f18d4ff6717828168cc8f47b203bee8aa4e1bebd401a69fb82b5c3234b27fe7365151fd36226eba42e1aad57e7322fda20192f52a1f86593f4dda6f9e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
16KB

MD5
dcf919cfebdf8eb50829ec16d6078f8d

SHA1
cfe05c7872df9cd571ec784705110835e394f6bd

SHA256
449a4b055ded0d01df6ad38085a655314b7acbf8ef3e48437f67f4e650807afe

SHA512
728be4c00c9e9a5937d3041b37215644bb92d9513f48294d1709d8693b477454d9cfb8b624e524e07e38a84936e2635d8164cee12bb56400b27e9d5837bf4573

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
144KB

MD5
959165292b6e22101fcec82ceb7e4ab6

SHA1
70e89cf5e8e7589a37fc303d0c1522cdfa9fd7f7

SHA256
8e0a7255991211f23e3d34d37232fa8f7166a55f0b4405bddfeb22b3af9bea11

SHA512
49d423d20f972e23a00a817a050f374d006ebbe5fdf3b537690dea54299c3ebc20676ac803d5ee353ce1744fc531952bb580722e002185ff08339f7f58cdf6ea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_444_VKHQMQESBDZJNYTL
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit