bd4980b80bbfe71c069decda458efcdba82feaa64a25514118366146a8e78f6e

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2023, 05:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
45d0c24a2f3e49488f564f7a4235529f.exe
Size 1.4MB
Sample230404-ggbj9afa3t
SHA256 bd4980b80bbfe71c069decda458efcdba82feaa64a25514118366146a8e78f6e
MD5 45d0c24a2f3e49488f564f7a4235529f
SHA1 796ff86b93ff4a55545d6cdef8760c96bc5a2375
SHA512 02fd2a037ce6219328267a0bd1204933814c4d35ec0473d5369e3fd3d82da39d149974cc4b23ea2c7f9d5d6185941b35610903d01a30dda25ed0491f91002bda
SSDEEP 24576:OVYkTpy0OVnKhXJ04BJFKA3wRKB7a9WscrmCqeQrEL75hutMW:qpJOl8xFMRy/SeQgP58OW
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js	45d0c24a2f3e49488f564f7a4235529f.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js	45d0c24a2f3e49488f564f7a4235529f.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js	45d0c24a2f3e49488f564f7a4235529f.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json	45d0c24a2f3e49488f564f7a4235529f.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html	45d0c24a2f3e49488f564f7a4235529f.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png	45d0c24a2f3e49488f564f7a4235529f.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js	45d0c24a2f3e49488f564f7a4235529f.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js	45d0c24a2f3e49488f564f7a4235529f.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js	45d0c24a2f3e49488f564f7a4235529f.exe
File opened for modification	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js	45d0c24a2f3e49488f564f7a4235529f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
208	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133250680055615870"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2232	chrome.exe
2232	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: SeAssignPrimaryTokenPrivilege	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: SeLockMemoryPrivilege	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: SeIncreaseQuotaPrivilege	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: SeMachineAccountPrivilege	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: SeTcbPrivilege	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: SeSecurityPrivilege	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: SeTakeOwnershipPrivilege	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: SeLoadDriverPrivilege	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: SeSystemProfilePrivilege	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: SeSystemtimePrivilege	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: SeProfSingleProcessPrivilege	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: SeIncBasePriorityPrivilege	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: SeCreatePagefilePrivilege	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: SeCreatePermanentPrivilege	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: SeBackupPrivilege	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: SeRestorePrivilege	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: SeShutdownPrivilege	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: SeDebugPrivilege	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: SeAuditPrivilege	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: SeSystemEnvironmentPrivilege	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: SeChangeNotifyPrivilege	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: SeRemoteShutdownPrivilege	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: SeUndockPrivilege	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: SeSyncAgentPrivilege	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: SeEnableDelegationPrivilege	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: SeManageVolumePrivilege	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: SeImpersonatePrivilege	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: SeCreateGlobalPrivilege	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: 31	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: 32	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: 33	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: 34	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: 35	544	45d0c24a2f3e49488f564f7a4235529f.exe
Token: SeDebugPrivilege	208	taskkill.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 1640	544	45d0c24a2f3e49488f564f7a4235529f.exe	87
PID 544 wrote to memory of 1640	544	45d0c24a2f3e49488f564f7a4235529f.exe	87
PID 544 wrote to memory of 1640	544	45d0c24a2f3e49488f564f7a4235529f.exe	87
PID 1640 wrote to memory of 208	1640	cmd.exe	89
PID 1640 wrote to memory of 208	1640	cmd.exe	89
PID 1640 wrote to memory of 208	1640	cmd.exe	89
PID 544 wrote to memory of 2232	544	45d0c24a2f3e49488f564f7a4235529f.exe	94
PID 544 wrote to memory of 2232	544	45d0c24a2f3e49488f564f7a4235529f.exe	94
PID 2232 wrote to memory of 2828	2232	chrome.exe	95
PID 2232 wrote to memory of 2828	2232	chrome.exe	95
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 1772	2232	chrome.exe	96
PID 2232 wrote to memory of 4824	2232	chrome.exe	97
PID 2232 wrote to memory of 4824	2232	chrome.exe	97
PID 2232 wrote to memory of 1536	2232	chrome.exe	98
PID 2232 wrote to memory of 1536	2232	chrome.exe	98
PID 2232 wrote to memory of 1536	2232	chrome.exe	98
PID 2232 wrote to memory of 1536	2232	chrome.exe	98
PID 2232 wrote to memory of 1536	2232	chrome.exe	98
PID 2232 wrote to memory of 1536	2232	chrome.exe	98
PID 2232 wrote to memory of 1536	2232	chrome.exe	98
PID 2232 wrote to memory of 1536	2232	chrome.exe	98
PID 2232 wrote to memory of 1536	2232	chrome.exe	98
PID 2232 wrote to memory of 1536	2232	chrome.exe	98
PID 2232 wrote to memory of 1536	2232	chrome.exe	98
PID 2232 wrote to memory of 1536	2232	chrome.exe	98
PID 2232 wrote to memory of 1536	2232	chrome.exe	98
PID 2232 wrote to memory of 1536	2232	chrome.exe	98

C:\Users\Admin\AppData\Local\Temp\45d0c24a2f3e49488f564f7a4235529f.exe
"C:\Users\Admin\AppData\Local\Temp\45d0c24a2f3e49488f564f7a4235529f.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffb9ffd9758,0x7ffb9ffd9768,0x7ffb9ffd9778
    3⤵
    PID:2828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 --field-trial-handle=1856,i,15205405763081838930,3187835668543824866,131072 /prefetch:2
    3⤵
    PID:1772
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1856,i,15205405763081838930,3187835668543824866,131072 /prefetch:8
    3⤵
    PID:4824
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1856,i,15205405763081838930,3187835668543824866,131072 /prefetch:8
    3⤵
    PID:1536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3168 --field-trial-handle=1856,i,15205405763081838930,3187835668543824866,131072 /prefetch:1
    3⤵
    PID:2340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3304 --field-trial-handle=1856,i,15205405763081838930,3187835668543824866,131072 /prefetch:1
    3⤵
    PID:1332
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3760 --field-trial-handle=1856,i,15205405763081838930,3187835668543824866,131072 /prefetch:1
    3⤵
    PID:680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4780 --field-trial-handle=1856,i,15205405763081838930,3187835668543824866,131072 /prefetch:1
    3⤵
    PID:3188
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4840 --field-trial-handle=1856,i,15205405763081838930,3187835668543824866,131072 /prefetch:8
    3⤵
    PID:2980
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5408 --field-trial-handle=1856,i,15205405763081838930,3187835668543824866,131072 /prefetch:8
    3⤵
    PID:3332
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4868 --field-trial-handle=1856,i,15205405763081838930,3187835668543824866,131072 /prefetch:8
    3⤵
    PID:4416
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5732 --field-trial-handle=1856,i,15205405763081838930,3187835668543824866,131072 /prefetch:8
    3⤵
    PID:3908
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 --field-trial-handle=1856,i,15205405763081838930,3187835668543824866,131072 /prefetch:8
    3⤵
    PID:5108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 --field-trial-handle=1856,i,15205405763081838930,3187835668543824866,131072 /prefetch:8
    3⤵
    PID:544

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

background.html

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html
Size 786B
SHA256 a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e
MD5 9ffe618d587a0685d80e9f8bb7d89d39
SHA1 8e9cae42c911027aafae56f9b1a16eb8dd7a739c
SHA512 a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12
MD5 SHA1 SHA512

Submit Download

icon.png

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png
Size 6KB
SHA256 40cfea52dbc50a8a5c250c63d825dcaad3f76e9588f474b3e035b587c912f4ca
MD5 362695f3dd9c02c83039898198484188
SHA1 85dcacc66a106feca7a94a42fc43e08c806a0322
SHA512 a04dc31a6ffc3bb5d56ba0fb03ecf93a88adc7193a384313d2955701bd99441ddf507aa0ddfc61dfc94f10a7e571b3d6a35980e61b06f98dd9eee424dc594a6f
SSDEEP 192:+Ux65UF6vFM2Wx8DJCyt5hDeW98wcE587tBq28g7:Mq0tVWx8IyzhDeW98rE587X5
MD5 SHA1 SHA512 SSDEEP

Submit Download

aes.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js
Size 13KB
SHA256 fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a
MD5 4ff108e4584780dce15d610c142c3e62
SHA1 77e4519962e2f6a9fc93342137dbb31c33b76b04
SHA512 d6eee0fc02205a3422c16ad120cad8d871563d8fcd4bde924654eac5a37026726328f9a47240cf89ed6c9e93ba5f89c833e84e65eee7db2b4d7d1b4240deaef2
SSDEEP 192:9pQGDuD690MPdz8Ui015ll1I57I2Tru6h0hNmHV+m9eIfyAqYfinNVYEUUFJZmUY:9OiT0wz8Uiw/1S7DegkcHpeIuScZbAX
MD5 SHA1 SHA512 SSDEEP

Submit Download

background.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js
Size 20KB
SHA256 f83312b7338344ce084c79664725fd69f9e5b2abf29f6e85f931b604431b05d9
MD5 7471dd32912203bac84262ad0a74f2a0
SHA1 08905f1aff631aa1fa8d255088ce2d0c974c93fd
SHA512 c5fbdc71c1eef4a63a658d14bbdc5f67cdc7ce143fd62e657a51a05691ccb9d3493356a4022a1e57076a2885b9d332b0eb62263d4cbb9228ecb1f473a211fdcc
SSDEEP 384:YSczYxqMJkEmbbfLSgi0nZgsS4xwYjn9iYnZRd9OSGH5fCFu:Yx8c6kEmbbfLSgi0nZgsS4xwYjndF94H
MD5 SHA1 SHA512 SSDEEP

Submit Download

content.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js
Size 3KB
SHA256 03601415885fd5d8967c407f7320d53f4c9ca2ec33bbe767d73a1589c5e36c54
MD5 c31f14d9b1b840e4b9c851cbe843fc8f
SHA1 205e3a99dc6c0af0e2f4450ebaa49ebde8e76bb4
SHA512 2c3d7ed5384712a0013a2ebbc526e762f257e32199651192742282a9641946b6aea6235d848b1e8cb3b0f916f85d3708a14717a69cbcf081145bc634d11d75aa
MD5 SHA1 SHA512

Submit Download

jquery-3.3.1.min.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js
Size 84KB
SHA256 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
MD5 a09e13ee94d51c524b7e2a728c7d4039
SHA1 0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae
SHA512 f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a
SSDEEP 1536:jLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6t3:5kn6x2xe9NK6nC69
MD5 SHA1 SHA512 SSDEEP

Submit Download

mode-ecb.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js
Size 604B
SHA256 03164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a
MD5 23231681d1c6f85fa32e725d6d63b19b
SHA1 f69315530b49ac743b0e012652a3a5efaed94f17
SHA512 36860113871707a08401f29ab2828545932e57a4ae99e727d8ca2a9f85518d3db3a4e5e4d46ac2b6ba09494fa9727c033d77c36c4bdc376ae048541222724bc2
MD5 SHA1 SHA512

Submit Download

pad-nopadding.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js
Size 268B
SHA256 282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d
MD5 0f26002ee3b4b4440e5949a969ea7503
SHA1 31fc518828fe4894e8077ec5686dce7b1ed281d7
SHA512 4290a1aee5601fcbf1eb2beec9b4924c30cd218e94ae099b87ba72c9a4fa077e39d218fc723b8465d259028a6961cc07c0cd6896aa2f67e83f833ca023a80b11
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json
Size 1KB
SHA256 04392a223cc358bc79fcd306504e8e834d6febbff0f3496f2eb8451797d28aa1
MD5 05bfb082915ee2b59a7f32fa3cc79432
SHA1 c1acd799ae271bcdde50f30082d25af31c1208c3
SHA512 6feea1c8112ac33d117aef3f272b1cc42ec24731c51886ed6f8bc2257b91e4d80089e8ca7ce292cc2f39100a7f662bcc5c37e5622a786f8dc8ea46b8127152f3
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 59e3108330d626319b9f5b7e3f105241ffebb0bc2eb4d5e502718fca9d7c7bad
MD5 b7df3088fb7867efe7bde88039424695
SHA1 a46a39fd5916e7931cc320c5fdd1c6a2bdfd6cd1
SHA512 dfa5e332363719d36687dfa3592a65502d28bb50c720f8235bf22625f426f7efc9b288c63a7423dc0ad97a7ee94ac243d8e84549f2b6389dbbc983bd8a1b92b8
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 64376fd4c59ab971885132bb4b8a8b235bd1c31e70e27c0dce208f88c0aee0d8
MD5 42d0e4d61e3fc889b2e6334f946733d1
SHA1 c5e86b05e90130597758fb621a727c5e32a10ee6
SHA512 b6b31d7e061f3ef1ce5a93bd0c4d8498f69f493574e3f88f1508d5c6116302406386331edae371beb33025a3f2cacb15967250457884d6e699efd9016f577f1c
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 9412491627558eed6125844755742628412397ef94379549415f53204c1ee741
MD5 8393745d66bab1a554f52c63b8df03ee
SHA1 9a467238591522e9c4bb392d42a98ad6216338f4
SHA512 cde288e832c225710ea065220c5b0c403fc37e2e0a5b202af5d3f255253c0b5f857daf1c31cafa3a833c8a8df6e4232f4e8a7aede3c0e0d3591ce817b51ca9a9
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 5dad83ba882e797996dcf14cfb93436365f4d3aed0d80bf95c414c53cbf255b0
MD5 83a65241a475c8fa6b87c0f2d15c3332
SHA1 61a368a47038d2198d8e5ac45a4e65649d5d860e
SHA512 94224a59f943caf3bfeffaa0e89650f8a3a3e7a4feb7f43a40349d0d2dc704cb12ccb2ceb4fe29c60ec7126e92816f8acde1a3560434b4e7fbc1417712b7d5f1
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 b3594805b600ae12a3eee12e8f3800fa0a97a3a16fb74335829f481fdcf97c8a
MD5 8ae855a7af9b9ec071bdc7b23b8dcc89
SHA1 241d39a20d0ab0bc1aa438cba4aa8923f7bf402a
SHA512 1c65f55972cc3dbe04f3e7f71ecade0b04293b54b47ede57ee6943d229d60151d0dcc01d54eb5cae659170b1abe78d62ae48c19f9a38dfab89047a2ec6447e3b
SSDEEP 96:ecMMsXyOhFKIhp8iZRy7Di+6MsmdemObGfljVhYtjEsXt0/cg2Vup:R3sdHd8syy+FPlotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 f3cd74df54454f0153beba88b1763c64e64bf974f20274c2b9fe4572d7698a37
MD5 09c1104d7e9ef78f2377c8a6f0fe848b
SHA1 a995d6f8d3cdf47afa9282b53dcaba3cbc359e15
SHA512 39d5ffeaa0f5628c3fc1b2597b5d7a92a9452d1e60a74ea913978b5cea9c58bd13bd510ad0308cb4c8a242003b541bdedd1787bb74a1d4b84c432aecffe92e16
SSDEEP 96:ecMMsXyOhFKIhp8iZRy7Di+6MsmdeYIObGfljVhYtjEsXt0/cg2Vup:R3sdHd8syy+FlGlotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 32aba359f1b91e23a972b738c9d8132d001743afc653bda5a0adeab1648ab78a
MD5 6065f2f2841e056b648742b96f23533c
SHA1 ff00abfc1427177624cc4bf0ada3e0d082f02141
SHA512 87a5d64fdca9cbacb8fdc031db31ac4825e6df7951bdf1652516379404f3aa13ff94578e8887623fd00c358a3c58c81dd0d6d85699482599f7599e05e21fbd76
SSDEEP 384:YzLALPHXO1kXqKf/pUZNCgVLH2HfkVrU7HGc8pf0a1j4kWKd:SLALPO1kXqKf/pUZNCgVLH2HfmrULGcq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 955e1d79c33664e31459bbd031f10e54a76fa159678701a433bd4dbb66a1575c
MD5 580961fa85bfbd01073843a19b23af4f
SHA1 4ee035998d1454fef2dde9f5e9e1ccbb1a18a700
SHA512 59fe5cc3ca30e181fa03c07c3d8e5e432d557e3b11c90122fdd47f88c615491f4fecf56daa01d9fe13c41f15af96c439412a11671ccece85a522be67f05139c1
SSDEEP 384:YULALPHXO1kXqKf/pUZNCgVLH2HfkVrUjHGckpfz+0anj4kWY:9LALPO1kXqKf/pUZNCgVLH2HfmrUDGc5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 174KB
SHA256 c7362e4c70acc0cb90ab9bfe37fe1527ef0d931095634722c940e3ce0c79dc46
MD5 53d874e44a630ae07898a64faab44166
SHA1 7ed2f5083622f36084739ac2582cf7d00c4101ed
SHA512 77f4b7438eaf360f2775ae8e764167ed98c21df3c594c5b11481945f04ce1768506ca2ff7f298b247ee99b9a6f03b3fd246a491cf2cb5ddc5195abc90c32b08c
SSDEEP 3072:BqaFslSJXMZL25h3bWQNTLpxOUzTCrF3v10k0H/Q/6Zp/viVwg0GOM7Vzn:ga+6YYrWOLpYUCrFNB04/S/viVLjh7
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download