aede6ea2d498e8a16c17483e53eba59866f01cb1d468ee96067042d037a6010a

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
30/03/2023, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2644502236f017d4c97825b0d24fc434.exe
Size 1.4MB
Sample230330-vxkprade74
SHA256 aede6ea2d498e8a16c17483e53eba59866f01cb1d468ee96067042d037a6010a
MD5 2644502236f017d4c97825b0d24fc434
SHA1 f18ac07f033922a89126c1ce424858a75ee17401
SHA512 1c42cb5f0cca7e1f8b328591a19efa6834ad0f782934333e0862f8bb45a24a1a3a42ea63c556b9db328a6afaf7c5cbbab1e0a13484abc31a1b5580fda66a0f2e
SSDEEP 24576:BVYkTpy0OVnKhXJ04BJFKA3wRKB7a9WscrmCqeQrEXR5h8tmW:vpJOl8xFMRy/SeQgB5OwW
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js	2644502236f017d4c97825b0d24fc434.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js	2644502236f017d4c97825b0d24fc434.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json	2644502236f017d4c97825b0d24fc434.exe
File opened for modification	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js	2644502236f017d4c97825b0d24fc434.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js	2644502236f017d4c97825b0d24fc434.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js	2644502236f017d4c97825b0d24fc434.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html	2644502236f017d4c97825b0d24fc434.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png	2644502236f017d4c97825b0d24fc434.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js	2644502236f017d4c97825b0d24fc434.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js	2644502236f017d4c97825b0d24fc434.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4852	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133246777612833018"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3056	chrome.exe
3056	chrome.exe
1672	chrome.exe
1672	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	4576	2644502236f017d4c97825b0d24fc434.exe
Token: SeAssignPrimaryTokenPrivilege	4576	2644502236f017d4c97825b0d24fc434.exe
Token: SeLockMemoryPrivilege	4576	2644502236f017d4c97825b0d24fc434.exe
Token: SeIncreaseQuotaPrivilege	4576	2644502236f017d4c97825b0d24fc434.exe
Token: SeMachineAccountPrivilege	4576	2644502236f017d4c97825b0d24fc434.exe
Token: SeTcbPrivilege	4576	2644502236f017d4c97825b0d24fc434.exe
Token: SeSecurityPrivilege	4576	2644502236f017d4c97825b0d24fc434.exe
Token: SeTakeOwnershipPrivilege	4576	2644502236f017d4c97825b0d24fc434.exe
Token: SeLoadDriverPrivilege	4576	2644502236f017d4c97825b0d24fc434.exe
Token: SeSystemProfilePrivilege	4576	2644502236f017d4c97825b0d24fc434.exe
Token: SeSystemtimePrivilege	4576	2644502236f017d4c97825b0d24fc434.exe
Token: SeProfSingleProcessPrivilege	4576	2644502236f017d4c97825b0d24fc434.exe
Token: SeIncBasePriorityPrivilege	4576	2644502236f017d4c97825b0d24fc434.exe
Token: SeCreatePagefilePrivilege	4576	2644502236f017d4c97825b0d24fc434.exe
Token: SeCreatePermanentPrivilege	4576	2644502236f017d4c97825b0d24fc434.exe
Token: SeBackupPrivilege	4576	2644502236f017d4c97825b0d24fc434.exe
Token: SeRestorePrivilege	4576	2644502236f017d4c97825b0d24fc434.exe
Token: SeShutdownPrivilege	4576	2644502236f017d4c97825b0d24fc434.exe
Token: SeDebugPrivilege	4576	2644502236f017d4c97825b0d24fc434.exe
Token: SeAuditPrivilege	4576	2644502236f017d4c97825b0d24fc434.exe
Token: SeSystemEnvironmentPrivilege	4576	2644502236f017d4c97825b0d24fc434.exe
Token: SeChangeNotifyPrivilege	4576	2644502236f017d4c97825b0d24fc434.exe
Token: SeRemoteShutdownPrivilege	4576	2644502236f017d4c97825b0d24fc434.exe
Token: SeUndockPrivilege	4576	2644502236f017d4c97825b0d24fc434.exe
Token: SeSyncAgentPrivilege	4576	2644502236f017d4c97825b0d24fc434.exe
Token: SeEnableDelegationPrivilege	4576	2644502236f017d4c97825b0d24fc434.exe
Token: SeManageVolumePrivilege	4576	2644502236f017d4c97825b0d24fc434.exe
Token: SeImpersonatePrivilege	4576	2644502236f017d4c97825b0d24fc434.exe
Token: SeCreateGlobalPrivilege	4576	2644502236f017d4c97825b0d24fc434.exe
Token: 31	4576	2644502236f017d4c97825b0d24fc434.exe
Token: 32	4576	2644502236f017d4c97825b0d24fc434.exe
Token: 33	4576	2644502236f017d4c97825b0d24fc434.exe
Token: 34	4576	2644502236f017d4c97825b0d24fc434.exe
Token: 35	4576	2644502236f017d4c97825b0d24fc434.exe
Token: SeDebugPrivilege	4852	taskkill.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 4472	4576	2644502236f017d4c97825b0d24fc434.exe	85
PID 4576 wrote to memory of 4472	4576	2644502236f017d4c97825b0d24fc434.exe	85
PID 4576 wrote to memory of 4472	4576	2644502236f017d4c97825b0d24fc434.exe	85
PID 4472 wrote to memory of 4852	4472	cmd.exe	87
PID 4472 wrote to memory of 4852	4472	cmd.exe	87
PID 4472 wrote to memory of 4852	4472	cmd.exe	87
PID 4576 wrote to memory of 3056	4576	2644502236f017d4c97825b0d24fc434.exe	88
PID 4576 wrote to memory of 3056	4576	2644502236f017d4c97825b0d24fc434.exe	88
PID 3056 wrote to memory of 3496	3056	chrome.exe	89
PID 3056 wrote to memory of 3496	3056	chrome.exe	89
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4200	3056	chrome.exe	90
PID 3056 wrote to memory of 4864	3056	chrome.exe	91
PID 3056 wrote to memory of 4864	3056	chrome.exe	91
PID 3056 wrote to memory of 4500	3056	chrome.exe	92
PID 3056 wrote to memory of 4500	3056	chrome.exe	92
PID 3056 wrote to memory of 4500	3056	chrome.exe	92
PID 3056 wrote to memory of 4500	3056	chrome.exe	92
PID 3056 wrote to memory of 4500	3056	chrome.exe	92
PID 3056 wrote to memory of 4500	3056	chrome.exe	92
PID 3056 wrote to memory of 4500	3056	chrome.exe	92
PID 3056 wrote to memory of 4500	3056	chrome.exe	92
PID 3056 wrote to memory of 4500	3056	chrome.exe	92
PID 3056 wrote to memory of 4500	3056	chrome.exe	92
PID 3056 wrote to memory of 4500	3056	chrome.exe	92
PID 3056 wrote to memory of 4500	3056	chrome.exe	92
PID 3056 wrote to memory of 4500	3056	chrome.exe	92
PID 3056 wrote to memory of 4500	3056	chrome.exe	92

C:\Users\Admin\AppData\Local\Temp\2644502236f017d4c97825b0d24fc434.exe
"C:\Users\Admin\AppData\Local\Temp\2644502236f017d4c97825b0d24fc434.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd7719758,0x7ffcd7719768,0x7ffcd7719778
    3⤵
    PID:3496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 --field-trial-handle=1872,i,2632775620525488031,15750068611151906830,131072 /prefetch:2
    3⤵
    PID:4200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1872,i,2632775620525488031,15750068611151906830,131072 /prefetch:8
    3⤵
    PID:4864
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2144 --field-trial-handle=1872,i,2632775620525488031,15750068611151906830,131072 /prefetch:8
    3⤵
    PID:4500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3204 --field-trial-handle=1872,i,2632775620525488031,15750068611151906830,131072 /prefetch:1
    3⤵
    PID:2156
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3344 --field-trial-handle=1872,i,2632775620525488031,15750068611151906830,131072 /prefetch:1
    3⤵
    PID:1012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3920 --field-trial-handle=1872,i,2632775620525488031,15750068611151906830,131072 /prefetch:1
    3⤵
    PID:3540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4896 --field-trial-handle=1872,i,2632775620525488031,15750068611151906830,131072 /prefetch:1
    3⤵
    PID:4452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5236 --field-trial-handle=1872,i,2632775620525488031,15750068611151906830,131072 /prefetch:8
    3⤵
    PID:4076
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4856 --field-trial-handle=1872,i,2632775620525488031,15750068611151906830,131072 /prefetch:8
    3⤵
    PID:2328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 --field-trial-handle=1872,i,2632775620525488031,15750068611151906830,131072 /prefetch:8
    3⤵
    PID:4268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5684 --field-trial-handle=1872,i,2632775620525488031,15750068611151906830,131072 /prefetch:8
    3⤵
    PID:3968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 --field-trial-handle=1872,i,2632775620525488031,15750068611151906830,131072 /prefetch:8
    3⤵
    PID:3500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3016 --field-trial-handle=1872,i,2632775620525488031,15750068611151906830,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1672

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1456

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

background.html

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html
Size 786B
SHA256 a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e
MD5 9ffe618d587a0685d80e9f8bb7d89d39
SHA1 8e9cae42c911027aafae56f9b1a16eb8dd7a739c
SHA512 a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12
MD5 SHA1 SHA512

Submit Download

icon.png

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png
Size 6KB
SHA256 40cfea52dbc50a8a5c250c63d825dcaad3f76e9588f474b3e035b587c912f4ca
MD5 362695f3dd9c02c83039898198484188
SHA1 85dcacc66a106feca7a94a42fc43e08c806a0322
SHA512 a04dc31a6ffc3bb5d56ba0fb03ecf93a88adc7193a384313d2955701bd99441ddf507aa0ddfc61dfc94f10a7e571b3d6a35980e61b06f98dd9eee424dc594a6f
SSDEEP 192:+Ux65UF6vFM2Wx8DJCyt5hDeW98wcE587tBq28g7:Mq0tVWx8IyzhDeW98rE587X5
MD5 SHA1 SHA512 SSDEEP

Submit Download

aes.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js
Size 13KB
SHA256 fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a
MD5 4ff108e4584780dce15d610c142c3e62
SHA1 77e4519962e2f6a9fc93342137dbb31c33b76b04
SHA512 d6eee0fc02205a3422c16ad120cad8d871563d8fcd4bde924654eac5a37026726328f9a47240cf89ed6c9e93ba5f89c833e84e65eee7db2b4d7d1b4240deaef2
SSDEEP 192:9pQGDuD690MPdz8Ui015ll1I57I2Tru6h0hNmHV+m9eIfyAqYfinNVYEUUFJZmUY:9OiT0wz8Uiw/1S7DegkcHpeIuScZbAX
MD5 SHA1 SHA512 SSDEEP

Submit Download

background.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js
Size 20KB
SHA256 29a899a9db4d7681f149843e4503287e5097a12f99e076498c92efa6a684747d
MD5 faf93871388fbc57bbec8b639548950f
SHA1 d9c570a09eead4d3cfa0e92fa0c563bbe8ef4e6f
SHA512 fdd207cdc9c5f9476e55a1720db57a6fca7303675be773d71ca00bf0c23a780f4460409e9f78f6d8d2b5f848e97bf591f25a69f189c6598700060eb39cd0d1d1
SSDEEP 384:CS6vxqMJkDx0kIE9/9zSIh5SdjlHsqs7u+860VclVdV9:Cfvc6kDx0kIE9/9zSIh5SdjlHsqs7B9
MD5 SHA1 SHA512 SSDEEP

Submit Download

content.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js
Size 3KB
SHA256 03601415885fd5d8967c407f7320d53f4c9ca2ec33bbe767d73a1589c5e36c54
MD5 c31f14d9b1b840e4b9c851cbe843fc8f
SHA1 205e3a99dc6c0af0e2f4450ebaa49ebde8e76bb4
SHA512 2c3d7ed5384712a0013a2ebbc526e762f257e32199651192742282a9641946b6aea6235d848b1e8cb3b0f916f85d3708a14717a69cbcf081145bc634d11d75aa
MD5 SHA1 SHA512

Submit Download

jquery-3.3.1.min.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js
Size 84KB
SHA256 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
MD5 a09e13ee94d51c524b7e2a728c7d4039
SHA1 0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae
SHA512 f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a
SSDEEP 1536:jLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6t3:5kn6x2xe9NK6nC69
MD5 SHA1 SHA512 SSDEEP

Submit Download

mode-ecb.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js
Size 604B
SHA256 03164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a
MD5 23231681d1c6f85fa32e725d6d63b19b
SHA1 f69315530b49ac743b0e012652a3a5efaed94f17
SHA512 36860113871707a08401f29ab2828545932e57a4ae99e727d8ca2a9f85518d3db3a4e5e4d46ac2b6ba09494fa9727c033d77c36c4bdc376ae048541222724bc2
MD5 SHA1 SHA512

Submit Download

pad-nopadding.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js
Size 268B
SHA256 282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d
MD5 0f26002ee3b4b4440e5949a969ea7503
SHA1 31fc518828fe4894e8077ec5686dce7b1ed281d7
SHA512 4290a1aee5601fcbf1eb2beec9b4924c30cd218e94ae099b87ba72c9a4fa077e39d218fc723b8465d259028a6961cc07c0cd6896aa2f67e83f833ca023a80b11
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json
Size 1KB
SHA256 04392a223cc358bc79fcd306504e8e834d6febbff0f3496f2eb8451797d28aa1
MD5 05bfb082915ee2b59a7f32fa3cc79432
SHA1 c1acd799ae271bcdde50f30082d25af31c1208c3
SHA512 6feea1c8112ac33d117aef3f272b1cc42ec24731c51886ed6f8bc2257b91e4d80089e8ca7ce292cc2f39100a7f662bcc5c37e5622a786f8dc8ea46b8127152f3
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a41d9281547e0aa7b2396e082a332e2d36fba378537600da134b1a7be89e0e27
MD5 de9699dadafee0c82206621d59ae7946
SHA1 3e4ba0313b0f67129ac8fbed3e05663502557e17
SHA512 b266de7128fe209fad2b5e6170222b10c1a7b98412d94d1f40ce5d8c02368771235b2f8c06079667ccce8a0197f1521310ddf43c91a1a61f7edeca2b5e9bb25f
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 539B
SHA256 691fa80a3032357a7a9f48adec8b0f605d46f89fffa4f4d02db69423cc3cc314
MD5 cdf1c94360972b2a2dfc86e0a2a8a0ba
SHA1 25334b00e0745f2b0269f2e34de79b1af59bb236
SHA512 6480c24df3344ddb03d6c161d805db3ee21ae401377213de4a4b8065db8b60383e751307ac5bc90de30954a2e3598659adfcdb7d8fe3a613933dcea12e58fd96
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 868B
SHA256 c1cb2762c496401ed68b3386bbc083abbf03f8361131c9b6157fb7cb55b9dcef
MD5 08e4ed96221412d3f5189e356187ea60
SHA1 19425318e93d216fc03e07ed907e373f6e0c96e5
SHA512 4d4f6cf3bf33372b09010862c1a81728b7d4b3ee1c7139cdb805da6d54c7acabf56076bb5baeec68398baadb4fcbad4df258aa710e5384107cc6b9aa4974ff7e
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 874B
SHA256 0f42c47a30ce0e801e701bca8be5544cd8391abb328975780f96a1d6b215432f
MD5 bda9cd70efa732710234d4087e27ef2c
SHA1 2396c7648a5336d93e3304f89926411ac7df2a3d
SHA512 4bf3961ecf1d75ced31c40fbe46b7a8c93d0c1fb703fd08f93b8a08ef89c01e36e0f0e5eb479501fcc20dba47195f8e0c3559dff4c7f6d539da7c4db8db52245
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 3399605a63d5521319cb17f80aa0b128807399ce6b0b894438ef253e7ee4540a
MD5 02c3a8b046d1bf04c8e27c21d8e3896f
SHA1 7f5cd4deba2d57e5fe5ec29ae5fcc00cf3523c51
SHA512 52cd6fa3fb7a289b1fb4203da35b1212272d411c7f106ef719dd282a51373957ef582aff89edbf2ce9b2808f410272f712b79ceee255d3c9a36eb13271bcad90
SSDEEP 96:aYgpZXirCS/puKIhFB8iZRy7Di+6MsmdeY+IOoR+mjVhYtjEsXt0/cg2Vup:aYmZgz/puHH8syy+FT+vmotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 3a062f957fc7016973cd5f98179b8abfb1895fc65585fd917945a4f6d78f7a95
MD5 e2439d0087315c805986ee626469eb7b
SHA1 6742beff3720ef861b42e5c3a4eae4be924c0c0b
SHA512 c64929d53828d568b5a78be15d26f2ad9f89da29805b2b76af1579c74475c79963a0e24285716058de483eadfb8c70b27d9d91e1ac691c9002a47e296a58fc07
SSDEEP 96:aYgpZXirCS/puKIhFB8iZRy7Di+6MsmdeYGAOoR+mjVhYtjEsXt0/cg2Vup:aYmZgz/puHH8syy+FT4motjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 10e1df46fbc34b42ec83784b6f1acad7a1acaa8c4701b92190b6b8f31de98e51
MD5 973e33d24ebbe8b07ab002a2daf45f85
SHA1 e763b14aba9e85db3be16d8e3b141c6a0ced99c9
SHA512 8423fc5e8519a5057ce6aa4d61416e801d9ffccb552ce654dec99eef04981e843da0cc6106646ae8c70b09b2c4b6dfd1fa345173f71ffe7d9835e2cc05e42207
SSDEEP 384:X2DLALPt/XW51kXqKf/pUZNCgVLH2Hfkz3rUtHGc8LAgQG:XMLALVvW51kXqKf/pUZNCgVLH2HfK3rl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 285d25f19bb86bbc16489ff38eadd72d72a4fb077465925267490358c2a3bbf1
MD5 38ba78298608b1f4bc2fa44731164657
SHA1 aaf69d9baee15b12077a1e902adcaeb18ca6d0f8
SHA512 9c9fd1834acaffb27e88e2cbc2caad7b685ceab54f9c51ec55189a1d5d0a1318db39343b3ca049fb64b1478af172e54def1a5b4f6cd4db66c63b0c5301acca3e
SSDEEP 384:X2nLALPt/XW51kXqKf/pUZNCgVLH2Hfkz3rUUHGckN/gQy:X0LALVvW51kXqKf/pUZNCgVLH2HfK3rn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 145KB
SHA256 ed67183d1189d49706ae1c6345b61a66fbf0d686407ca696f38f31d5b76c32ed
MD5 879ae6140bca5afc77144a90b87df3ed
SHA1 ae882bbf251ca3143ca96944b72dc99e66412c2a
SHA512 bcca13df282a7eb2dc84d4b082d6a858fabea6e93cd022ceb226aaf83660ca3d46f06fe6cb44052f51fc3cd637007323071642619ada5d310f53b00030a8bec4
SSDEEP 3072:cLLpsl6ERJ3KdBx7tj8PpMbZyDD3H/Q/6Zp/viVwg0GOM7Vz5:cLLpslFn3MBx7SBW84/S/viVLjhN
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download