3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2023 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Size

1.4MB
MD5

8df956ac511457104458fc4ac187302b
SHA1

875535886b6120d3af1db8b48f043406b7964a26
SHA256

3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb
SHA512

1113b0e436ce6ae9c209c5870f2df60fda219c4893c72b59c53e68d91b96db8c7667f9e945c14be70b84ad12f98e5ca0801f16bd04b07c5aa14205e8a7debf0e
SSDEEP

24576:yGU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dR3r5hYSp:hpEUIvU0N9jkpjweXt77b5W4

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 10 IoCs

Processes:

3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe

description	ioc	process
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
File opened for modification	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

3520 taskkill.exe

pid	process
3520	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133243786213938694"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

4036 chrome.exe
4036 chrome.exe
3088 chrome.exe
3088 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

chrome.exe

pid process

4036 chrome.exe
4036 chrome.exe
4036 chrome.exe
4036 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exetaskkill.exechrome.exe

description	pid	process
Token: SeCreateTokenPrivilege	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: SeAssignPrimaryTokenPrivilege	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: SeLockMemoryPrivilege	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: SeIncreaseQuotaPrivilege	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: SeMachineAccountPrivilege	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: SeTcbPrivilege	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: SeSecurityPrivilege	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: SeTakeOwnershipPrivilege	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: SeLoadDriverPrivilege	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: SeSystemProfilePrivilege	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: SeSystemtimePrivilege	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: SeProfSingleProcessPrivilege	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: SeIncBasePriorityPrivilege	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: SeCreatePagefilePrivilege	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: SeCreatePermanentPrivilege	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: SeBackupPrivilege	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: SeRestorePrivilege	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: SeShutdownPrivilege	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: SeDebugPrivilege	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: SeAuditPrivilege	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: SeSystemEnvironmentPrivilege	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: SeChangeNotifyPrivilege	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: SeRemoteShutdownPrivilege	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: SeUndockPrivilege	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: SeSyncAgentPrivilege	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: SeEnableDelegationPrivilege	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: SeManageVolumePrivilege	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: SeImpersonatePrivilege	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: SeCreateGlobalPrivilege	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: 31	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: 32	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: 33	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: 34	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: 35	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
Token: SeDebugPrivilege	3520	taskkill.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.execmd.exechrome.exe

description	pid	process	target process
PID 1636 wrote to memory of 992	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe	cmd.exe
PID 1636 wrote to memory of 992	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe	cmd.exe
PID 1636 wrote to memory of 992	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe	cmd.exe
PID 992 wrote to memory of 3520	992	cmd.exe	taskkill.exe
PID 992 wrote to memory of 3520	992	cmd.exe	taskkill.exe
PID 992 wrote to memory of 3520	992	cmd.exe	taskkill.exe
PID 1636 wrote to memory of 4036	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe	chrome.exe
PID 1636 wrote to memory of 4036	1636	3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe	chrome.exe
PID 4036 wrote to memory of 2000	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 2000	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 688	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 4344	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 4344	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 748	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 748	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 748	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 748	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 748	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 748	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 748	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 748	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 748	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 748	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 748	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 748	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 748	4036	chrome.exe	chrome.exe
PID 4036 wrote to memory of 748	4036	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe
"C:\Users\Admin\AppData\Local\Temp\3ce58e6ed8034405bf6553b19e4c247f3e21a6f1c233b571832d4f76756c9aeb.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:992

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd33de9758,0x7ffd33de9768,0x7ffd33de9778
3⤵
PID:2000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=1816,i,11746782056819673197,3224407592156869002,131072 /prefetch:2
3⤵
PID:688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1816,i,11746782056819673197,3224407592156869002,131072 /prefetch:8
3⤵
PID:4344

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2184 --field-trial-handle=1816,i,11746782056819673197,3224407592156869002,131072 /prefetch:8
3⤵
PID:748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3196 --field-trial-handle=1816,i,11746782056819673197,3224407592156869002,131072 /prefetch:1
3⤵
PID:4928

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3224 --field-trial-handle=1816,i,11746782056819673197,3224407592156869002,131072 /prefetch:1
3⤵
PID:1168

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3936 --field-trial-handle=1816,i,11746782056819673197,3224407592156869002,131072 /prefetch:1
3⤵
PID:2500

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4992 --field-trial-handle=1816,i,11746782056819673197,3224407592156869002,131072 /prefetch:1
3⤵
PID:4004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5060 --field-trial-handle=1816,i,11746782056819673197,3224407592156869002,131072 /prefetch:8
3⤵
PID:1720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4792 --field-trial-handle=1816,i,11746782056819673197,3224407592156869002,131072 /prefetch:8
3⤵
PID:2760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5524 --field-trial-handle=1816,i,11746782056819673197,3224407592156869002,131072 /prefetch:8
3⤵
PID:5076

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 --field-trial-handle=1816,i,11746782056819673197,3224407592156869002,131072 /prefetch:8
3⤵
PID:432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 --field-trial-handle=1816,i,11746782056819673197,3224407592156869002,131072 /prefetch:8
3⤵
PID:1200

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3672 --field-trial-handle=1816,i,11746782056819673197,3224407592156869002,131072 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3088

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2636

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html
Filesize
786B

MD5
9ffe618d587a0685d80e9f8bb7d89d39

SHA1
8e9cae42c911027aafae56f9b1a16eb8dd7a739c

SHA256
a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e

SHA512
a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png
Filesize
6KB

MD5
362695f3dd9c02c83039898198484188

SHA1
85dcacc66a106feca7a94a42fc43e08c806a0322

SHA256
40cfea52dbc50a8a5c250c63d825dcaad3f76e9588f474b3e035b587c912f4ca

SHA512
a04dc31a6ffc3bb5d56ba0fb03ecf93a88adc7193a384313d2955701bd99441ddf507aa0ddfc61dfc94f10a7e571b3d6a35980e61b06f98dd9eee424dc594a6f

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js
Filesize
13KB

MD5
4ff108e4584780dce15d610c142c3e62

SHA1
77e4519962e2f6a9fc93342137dbb31c33b76b04

SHA256
fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a

SHA512
d6eee0fc02205a3422c16ad120cad8d871563d8fcd4bde924654eac5a37026726328f9a47240cf89ed6c9e93ba5f89c833e84e65eee7db2b4d7d1b4240deaef2

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js
Filesize
20KB

MD5
991292a920d94bac3492055eea6e0dca

SHA1
916076bc7dc7353885a0b4653b4ff6ae4c46b391

SHA256
4c3327256edff026c5c3590a04e5faa1be33b2b87614f5c86626c200a3b99e6d

SHA512
d7bfb1dda70bb7eb1c84d975df0a9f8dccaf0cab77929e802a09ca826e541a8994a6e2d20322effba2826c2e89149ce50e37577519fa6d2139ee429967575128

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js
Filesize
3KB

MD5
c31f14d9b1b840e4b9c851cbe843fc8f

SHA1
205e3a99dc6c0af0e2f4450ebaa49ebde8e76bb4

SHA256
03601415885fd5d8967c407f7320d53f4c9ca2ec33bbe767d73a1589c5e36c54

SHA512
2c3d7ed5384712a0013a2ebbc526e762f257e32199651192742282a9641946b6aea6235d848b1e8cb3b0f916f85d3708a14717a69cbcf081145bc634d11d75aa

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js
Filesize
84KB

MD5
a09e13ee94d51c524b7e2a728c7d4039

SHA1
0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae

SHA256
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

SHA512
f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js
Filesize
604B

MD5
23231681d1c6f85fa32e725d6d63b19b

SHA1
f69315530b49ac743b0e012652a3a5efaed94f17

SHA256
03164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a

SHA512
36860113871707a08401f29ab2828545932e57a4ae99e727d8ca2a9f85518d3db3a4e5e4d46ac2b6ba09494fa9727c033d77c36c4bdc376ae048541222724bc2

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js
Filesize
268B

MD5
0f26002ee3b4b4440e5949a969ea7503

SHA1
31fc518828fe4894e8077ec5686dce7b1ed281d7

SHA256
282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d

SHA512
4290a1aee5601fcbf1eb2beec9b4924c30cd218e94ae099b87ba72c9a4fa077e39d218fc723b8465d259028a6961cc07c0cd6896aa2f67e83f833ca023a80b11

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json
Filesize
1KB

MD5
05bfb082915ee2b59a7f32fa3cc79432

SHA1
c1acd799ae271bcdde50f30082d25af31c1208c3

SHA256
04392a223cc358bc79fcd306504e8e834d6febbff0f3496f2eb8451797d28aa1

SHA512
6feea1c8112ac33d117aef3f272b1cc42ec24731c51886ed6f8bc2257b91e4d80089e8ca7ce292cc2f39100a7f662bcc5c37e5622a786f8dc8ea46b8127152f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
d648358fed559252b1373c2d3b300e95

SHA1
5b020695d758861ced6a43613ea6492e4cb2ac18

SHA256
b547732c9a5227748a31bfdb2784c70dd3dcc5f5872ee90959d495226bc9b53c

SHA512
c0281c44482b8ee6c024794d041b310fc39926138363c7d040082f532dd125edfac2557f479ce07161aabd61cb211540fec5bb8907979042ccd24a76b639b653

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
874B

MD5
9f6202ff953c75893a9963ca6a675704

SHA1
eddbbbaa272efc60c06fc5cee003d3dfeac3db13

SHA256
f2ec5dc56e80da786698a84027ed100d34e70b5bc1f0593d1cbdb6c372c0022d

SHA512
0ddebef1406676942bfbdd02e17c51f7e44b3bf5cf362ffe13e1fcd809ffc8a1696aef9bf06a6fb503b8a68bb36152ce4c565f96656f7995ad5b06ce5cb165a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
874B

MD5
97872fcce9f5602e70bce1315e194dda

SHA1
01aa8403b488c289b5aff6dc4a362007b9069286

SHA256
5c040a9eeb8992dc13923e8775c1aa3d9509983e659e0fd35bded0b782684791

SHA512
8ab96a967fb239fa1ed637e0d99cf75ba6893b45b59a356db914e95369b076782cb7d8b6e437aa1ad94bb24ce43e26a9b243b375cc63712b87dc9a897bf9431d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
874B

MD5
066b33426b20bd41f2d98b0a0c1f92e3

SHA1
c8d1c8227e52211196e4f4132ae948a49466fe02

SHA256
a0290e31e70e8fa32ba97e61fc22646280f84ac84380f9c5061078ab0eef2b41

SHA512
aab921aa6939ec0379872c37251699cca90a618de16a45161ed65cc0f98070783671cf252032514c488a757b0c51057da1d876128a26fd107117a3af692bfc4d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
874B

MD5
5991dcab332f7c6e62dc27b833464222

SHA1
0a1090a07f848a6b0395ac727be711d8be983fcd

SHA256
5dfb3bdf38e3dc00848a2b5ba14d6bde3f334044384e7d55fcf6c3186f3402ea

SHA512
db8864cca398f2db82177b6f23b24e174e8aa253e213f49d756e26f983854c4ab6525f96066ead020ca664b0bca987ca43cfe811e573d07e37b63675fb120492

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
9496e78ef434328c9592a48015885f3f

SHA1
2bcce0895321535e9828036d12e1a959615ece67

SHA256
5333872420a1859e95ebeab502a7ac73c06cc5262ba6bd87cc81ea0b94ff96ae

SHA512
f08277f23cfd800bf77204e33c0d68e549bf1f6180cce092c3a4f8bd36ac1dbb597ef66e76012fee1305bd9a34bfbef91b95bb9c4975b07b9a2eb06edb5e588e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
7ce904c9ba13926812d3bebd6976053d

SHA1
932b872bdea9328c4a88e044146e0cbb2d2c21e2

SHA256
31e3c9bd7293e3650f842c7547b922507227176cd9b27639acf1bef444e06336

SHA512
86f7b38d12916b581b263837816d7e0f0e860e6c03e1056563c54a59afbc5a4122f77605858b433227bd5614ad6db7db7129140f3c1ae43a1e4099c58387b43d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
16KB

MD5
ac821ea53c1507f9d1c5ba900bda2bb0

SHA1
20180a35eb36abb179ccb205ecd4de974c7e2a91

SHA256
87dbcf25a4a3b902169a4d330e2abdd36f3c383035dc0113b5991970ca46380f

SHA512
661875f18d4ff6717828168cc8f47b203bee8aa4e1bebd401a69fb82b5c3234b27fe7365151fd36226eba42e1aad57e7322fda20192f52a1f86593f4dda6f9e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
16KB

MD5
a111cfed8509255d2a3902fbd0c9faed

SHA1
2d9e9b2d13b0305a344d9184b83a11b305aa1581

SHA256
01213b79ad1dc0821bf4a270cc932a08164d2b63584a63e550f01ec913bb8f32

SHA512
a696c67ad74d15e7e5272fab4f57c55707df65bd20cdb6d6743408db607849377df86ab77c89a89df6a187abcef37aa092e2f591a0d32daebefb93ba4e9b29d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
144KB

MD5
499b39132de7e4a2ab3ae69aff20c0e1

SHA1
94c4d2fd9d5949a131bc6ac2626401dc738fe5b8

SHA256
f7b44c10d1c1fae02dc566315e3f7053ef28d6fe7e884dc39da2c91dbfdb02a4

SHA512
9eaa509cd799b41659bd808089ba951f667d7c22bdbe36e86d6724698c4b0f3a6dcb399100e48a2d2e42ccff6b0881c0ead7beb4456fc21089c2808e515f3a86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_4036_FXQYRJURBAMFPSYP
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit