6f87279408e636370163c451bdeb0fda8666c5d49771a7a18e654aa1082716c0

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2023, 01:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Size 1.4MB
Sample230421-bqdhbadd46
SHA256 eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da
MD5 3a8c9acdcdab4caac232e5ce449a261d
SHA1 5f3e09f6276ab96a23766ab04237f0a51eeb3bb1
SHA512 1e7ca33380d5bf3d1fc4e89a4560bc60bd1eeb5daa605f451084a4ae97344bdeefee18c081991b1a8be22260ccd811f45942e1973075a0eb5636d3ea1c929723
SSDEEP 24576:zGU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dRrI5hQSI:ypEUIvU0N9jkpjweXt77U5WR
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
File opened for modification	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
916	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133265208521544635"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1232	chrome.exe
1232	chrome.exe
3036	chrome.exe
3036	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: SeAssignPrimaryTokenPrivilege	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: SeLockMemoryPrivilege	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: SeIncreaseQuotaPrivilege	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: SeMachineAccountPrivilege	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: SeTcbPrivilege	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: SeSecurityPrivilege	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: SeTakeOwnershipPrivilege	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: SeLoadDriverPrivilege	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: SeSystemProfilePrivilege	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: SeSystemtimePrivilege	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: SeProfSingleProcessPrivilege	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: SeIncBasePriorityPrivilege	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: SeCreatePagefilePrivilege	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: SeCreatePermanentPrivilege	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: SeBackupPrivilege	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: SeRestorePrivilege	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: SeShutdownPrivilege	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: SeDebugPrivilege	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: SeAuditPrivilege	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: SeSystemEnvironmentPrivilege	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: SeChangeNotifyPrivilege	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: SeRemoteShutdownPrivilege	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: SeUndockPrivilege	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: SeSyncAgentPrivilege	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: SeEnableDelegationPrivilege	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: SeManageVolumePrivilege	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: SeImpersonatePrivilege	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: SeCreateGlobalPrivilege	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: 31	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: 32	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: 33	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: 34	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: 35	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
Token: SeDebugPrivilege	916	taskkill.exe
Token: SeShutdownPrivilege	1232	chrome.exe
Token: SeCreatePagefilePrivilege	1232	chrome.exe
Token: SeShutdownPrivilege	1232	chrome.exe
Token: SeCreatePagefilePrivilege	1232	chrome.exe
Token: SeShutdownPrivilege	1232	chrome.exe
Token: SeCreatePagefilePrivilege	1232	chrome.exe
Token: SeShutdownPrivilege	1232	chrome.exe
Token: SeCreatePagefilePrivilege	1232	chrome.exe
Token: SeShutdownPrivilege	1232	chrome.exe
Token: SeCreatePagefilePrivilege	1232	chrome.exe
Token: SeShutdownPrivilege	1232	chrome.exe
Token: SeCreatePagefilePrivilege	1232	chrome.exe
Token: SeShutdownPrivilege	1232	chrome.exe
Token: SeCreatePagefilePrivilege	1232	chrome.exe
Token: SeShutdownPrivilege	1232	chrome.exe
Token: SeCreatePagefilePrivilege	1232	chrome.exe
Token: SeShutdownPrivilege	1232	chrome.exe
Token: SeCreatePagefilePrivilege	1232	chrome.exe
Token: SeShutdownPrivilege	1232	chrome.exe
Token: SeCreatePagefilePrivilege	1232	chrome.exe
Token: SeShutdownPrivilege	1232	chrome.exe
Token: SeCreatePagefilePrivilege	1232	chrome.exe
Token: SeShutdownPrivilege	1232	chrome.exe
Token: SeCreatePagefilePrivilege	1232	chrome.exe
Token: SeShutdownPrivilege	1232	chrome.exe
Token: SeCreatePagefilePrivilege	1232	chrome.exe
Token: SeShutdownPrivilege	1232	chrome.exe
Token: SeCreatePagefilePrivilege	1232	chrome.exe
Token: SeShutdownPrivilege	1232	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe
1232	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 4160	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe	83
PID 3388 wrote to memory of 4160	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe	83
PID 3388 wrote to memory of 4160	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe	83
PID 4160 wrote to memory of 916	4160	cmd.exe	85
PID 4160 wrote to memory of 916	4160	cmd.exe	85
PID 4160 wrote to memory of 916	4160	cmd.exe	85
PID 3388 wrote to memory of 1232	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe	90
PID 3388 wrote to memory of 1232	3388	eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe	90
PID 1232 wrote to memory of 4088	1232	chrome.exe	91
PID 1232 wrote to memory of 4088	1232	chrome.exe	91
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3408	1232	chrome.exe	92
PID 1232 wrote to memory of 3728	1232	chrome.exe	93
PID 1232 wrote to memory of 3728	1232	chrome.exe	93
PID 1232 wrote to memory of 3744	1232	chrome.exe	94
PID 1232 wrote to memory of 3744	1232	chrome.exe	94
PID 1232 wrote to memory of 3744	1232	chrome.exe	94
PID 1232 wrote to memory of 3744	1232	chrome.exe	94
PID 1232 wrote to memory of 3744	1232	chrome.exe	94
PID 1232 wrote to memory of 3744	1232	chrome.exe	94
PID 1232 wrote to memory of 3744	1232	chrome.exe	94
PID 1232 wrote to memory of 3744	1232	chrome.exe	94
PID 1232 wrote to memory of 3744	1232	chrome.exe	94
PID 1232 wrote to memory of 3744	1232	chrome.exe	94
PID 1232 wrote to memory of 3744	1232	chrome.exe	94
PID 1232 wrote to memory of 3744	1232	chrome.exe	94
PID 1232 wrote to memory of 3744	1232	chrome.exe	94
PID 1232 wrote to memory of 3744	1232	chrome.exe	94

C:\Users\Admin\AppData\Local\Temp\eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe
"C:\Users\Admin\AppData\Local\Temp\eb5ba579930927bcfdb6a9aeb22336528e0546f552123309fea1fba7f21df3da.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff92a5e9758,0x7ff92a5e9768,0x7ff92a5e9778
    3⤵
    PID:4088
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1832,i,695419312780518168,14554092284812456878,131072 /prefetch:2
    3⤵
    PID:3408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1832,i,695419312780518168,14554092284812456878,131072 /prefetch:8
    3⤵
    PID:3728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1832,i,695419312780518168,14554092284812456878,131072 /prefetch:8
    3⤵
    PID:3744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3192 --field-trial-handle=1832,i,695419312780518168,14554092284812456878,131072 /prefetch:1
    3⤵
    PID:460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3316 --field-trial-handle=1832,i,695419312780518168,14554092284812456878,131072 /prefetch:1
    3⤵
    PID:1156
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3856 --field-trial-handle=1832,i,695419312780518168,14554092284812456878,131072 /prefetch:1
    3⤵
    PID:4848
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4700 --field-trial-handle=1832,i,695419312780518168,14554092284812456878,131072 /prefetch:1
    3⤵
    PID:4528
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5132 --field-trial-handle=1832,i,695419312780518168,14554092284812456878,131072 /prefetch:8
    3⤵
    PID:4836
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5212 --field-trial-handle=1832,i,695419312780518168,14554092284812456878,131072 /prefetch:8
    3⤵
    PID:3496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5256 --field-trial-handle=1832,i,695419312780518168,14554092284812456878,131072 /prefetch:8
    3⤵
    PID:3340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 --field-trial-handle=1832,i,695419312780518168,14554092284812456878,131072 /prefetch:8
    3⤵
    PID:3752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 --field-trial-handle=1832,i,695419312780518168,14554092284812456878,131072 /prefetch:8
    3⤵
    PID:1880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5732 --field-trial-handle=1832,i,695419312780518168,14554092284812456878,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3036

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

background.html

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html
Size 786B
SHA256 a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e
MD5 9ffe618d587a0685d80e9f8bb7d89d39
SHA1 8e9cae42c911027aafae56f9b1a16eb8dd7a739c
SHA512 a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12
MD5 SHA1 SHA512

Submit Download

icon.png

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png
Size 6KB
SHA256 40cfea52dbc50a8a5c250c63d825dcaad3f76e9588f474b3e035b587c912f4ca
MD5 362695f3dd9c02c83039898198484188
SHA1 85dcacc66a106feca7a94a42fc43e08c806a0322
SHA512 a04dc31a6ffc3bb5d56ba0fb03ecf93a88adc7193a384313d2955701bd99441ddf507aa0ddfc61dfc94f10a7e571b3d6a35980e61b06f98dd9eee424dc594a6f
SSDEEP 192:+Ux65UF6vFM2Wx8DJCyt5hDeW98wcE587tBq28g7:Mq0tVWx8IyzhDeW98rE587X5
MD5 SHA1 SHA512 SSDEEP

Submit Download

aes.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js
Size 13KB
SHA256 fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a
MD5 4ff108e4584780dce15d610c142c3e62
SHA1 77e4519962e2f6a9fc93342137dbb31c33b76b04
SHA512 d6eee0fc02205a3422c16ad120cad8d871563d8fcd4bde924654eac5a37026726328f9a47240cf89ed6c9e93ba5f89c833e84e65eee7db2b4d7d1b4240deaef2
SSDEEP 192:9pQGDuD690MPdz8Ui015ll1I57I2Tru6h0hNmHV+m9eIfyAqYfinNVYEUUFJZmUY:9OiT0wz8Uiw/1S7DegkcHpeIuScZbAX
MD5 SHA1 SHA512 SSDEEP

Submit Download

background.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js
Size 20KB
SHA256 614239be5154f54c087cf6d298e2993b53b6881e486152482c0e630027d1f565
MD5 08e5fafc79e21714f7f6d2f96ac7cfe1
SHA1 09a4d5010811ca8172a1cf3f833e15f88d41d4b9
SHA512 9a502168a1eb5ddd06d3fe56b4a3acf9cc5d5d719f1af00ce1740bdb52be77ec8f97a11c41e3e4b8355beeee4336b0c4c798f5d2ce36b18e895598e43a16f0ef
SSDEEP 384:ixS45YxqMJk2YtZZpw+QKJfOySOJOXMWpDpCmu6kFccuJrwyCmuP4W:a7uc6k2YtZZpw+QKJfOySOJOXMWcz
MD5 SHA1 SHA512 SSDEEP

Submit Download

content.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js
Size 3KB
SHA256 03601415885fd5d8967c407f7320d53f4c9ca2ec33bbe767d73a1589c5e36c54
MD5 c31f14d9b1b840e4b9c851cbe843fc8f
SHA1 205e3a99dc6c0af0e2f4450ebaa49ebde8e76bb4
SHA512 2c3d7ed5384712a0013a2ebbc526e762f257e32199651192742282a9641946b6aea6235d848b1e8cb3b0f916f85d3708a14717a69cbcf081145bc634d11d75aa
MD5 SHA1 SHA512

Submit Download

jquery-3.3.1.min.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js
Size 84KB
SHA256 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
MD5 a09e13ee94d51c524b7e2a728c7d4039
SHA1 0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae
SHA512 f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a
SSDEEP 1536:jLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6t3:5kn6x2xe9NK6nC69
MD5 SHA1 SHA512 SSDEEP

Submit Download

mode-ecb.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js
Size 604B
SHA256 03164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a
MD5 23231681d1c6f85fa32e725d6d63b19b
SHA1 f69315530b49ac743b0e012652a3a5efaed94f17
SHA512 36860113871707a08401f29ab2828545932e57a4ae99e727d8ca2a9f85518d3db3a4e5e4d46ac2b6ba09494fa9727c033d77c36c4bdc376ae048541222724bc2
MD5 SHA1 SHA512

Submit Download

pad-nopadding.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js
Size 268B
SHA256 282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d
MD5 0f26002ee3b4b4440e5949a969ea7503
SHA1 31fc518828fe4894e8077ec5686dce7b1ed281d7
SHA512 4290a1aee5601fcbf1eb2beec9b4924c30cd218e94ae099b87ba72c9a4fa077e39d218fc723b8465d259028a6961cc07c0cd6896aa2f67e83f833ca023a80b11
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json
Size 1KB
SHA256 04392a223cc358bc79fcd306504e8e834d6febbff0f3496f2eb8451797d28aa1
MD5 05bfb082915ee2b59a7f32fa3cc79432
SHA1 c1acd799ae271bcdde50f30082d25af31c1208c3
SHA512 6feea1c8112ac33d117aef3f272b1cc42ec24731c51886ed6f8bc2257b91e4d80089e8ca7ce292cc2f39100a7f662bcc5c37e5622a786f8dc8ea46b8127152f3
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 868d76da4ac54080e7110d6747f2002392baa0a0d516e1aa6ece7cc8b3a2a0f3
MD5 e4d6fcad3e8ac9e65f5a3b8f81c73526
SHA1 99e5412dee8e1267c6de038819959fd7e4a00c7f
SHA512 3e65e33d3ee3d7d02d0420c33434fb6927e7e02144d8758a0ca5abd0a496dec4dd3671e4c523283ba23e54c9867bbace0cb94d9f732f2ae1dbf0f6c6926351af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 874B
SHA256 b77267f688098167f8da050310f3a42e1b32e9a9af96d11a5592ddf1f2b9aa8c
MD5 2b53729ba20527e6236c7d3333cce552
SHA1 9e25d9ac8952729bb435c454eb3c015e928f689c
SHA512 20099eceefa85d79e71d33453eca06e8da9baaa661333e521f5c25ba9c112be3df1dcec4e7a6108033f805dd18eba13eb296e9fb721ff64881b2d949976dc85b
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 874B
SHA256 a7a0ea97624227715f9f0d4280e888e0e2ca41e29f0cee30cdb555f7a2eb7f5a
MD5 959f2ceb2848a786c0e98f4d2d9efcd0
SHA1 af8a9aa5e3341c1914afc9812e5e9af62726f4f4
SHA512 5d4a476233a9e24ad698b0d5ffec745de07fba3dc60801a899afabe01831e67d3bdb9d9fc3ecd9258a1bbf8042ec4f98871a849f37ffdf48595774650917b31b
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 862B
SHA256 2fbb585de4d570b737eb8b0d0e78eef4e698cefed8289b02d545326b4a4329bf
MD5 38542862ab1242ed170265d20ee1312f
SHA1 b06afe086a119b53566e82f76604666410a424a6
SHA512 b63caf6de0b569c2a6a6f90aef300826e83c12c765a9e19c176f00a36338e78cb6d49e0545664e8612ee80bd9352db2a74555384fd73d48098f044d75a237a51
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 874B
SHA256 045864ae2a280ebea60587c54686348a2d69e1f186278ecfbfa283cbdc878b4f
MD5 41f3f11effacdb0aa6b31991941de67e
SHA1 02c19d3b2e8a59e8bf340bcc35164a6eb47696be
SHA512 e2f27c1781c2b0567f86b9361a839fddc164bc81decdba350704adfa1bc4718d759295aa0918e05a64b86f0db8f6816c9c22400a223c5a860250fabce5359d6c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 c0953859c648b8182d5a8e6c9467321dbaebc509ab64e4bca3ec926267cd960a
MD5 ebdc44e2b1f1a848ca86c0f113fab473
SHA1 9ab1dea17996f6cff56ec5633b84b9f854b718f9
SHA512 66c4924dbb4d5ec58e36e7d0ebbde57880e1f8c97d901ccb44d7340b4f0752d1dea91f1c22ff80ef07527831d41fcecd287139f1c74659ee94e05b67beeb4f26
SSDEEP 96:mvLYXYEeHmWCo8KIl6J8iZRy7Di+6MsmdeEOEXAU+jVhYtjEsXt0/cg2Vup:mzY6oo848syy+FJJ+otjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 f416c39d1ab19c788d2d7c18b7ebb89be1a3465af0b16492abb413f1b577b302
MD5 58977577896b7159252a144738c3b444
SHA1 0541ecd8096e2ffb3cd631eac9205953e8a84b41
SHA512 96878d873455d0c1830e980c7ca7ffc0e6e56cb651ea0e8cd3ee68a6280c34c6dcb2ffb111df82ef11c1fca7b3a90546a8bec604c3415d909e127c5556972c7a
SSDEEP 96:mvLYXYEeHmWCo8KIl6J8iZRy7Di+6MsmdeCIOEXAU+jVhYtjEsXt0/cg2Vup:mzY6oo848syy+Fj+J+otjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 87dbcf25a4a3b902169a4d330e2abdd36f3c383035dc0113b5991970ca46380f
MD5 ac821ea53c1507f9d1c5ba900bda2bb0
SHA1 20180a35eb36abb179ccb205ecd4de974c7e2a91
SHA512 661875f18d4ff6717828168cc8f47b203bee8aa4e1bebd401a69fb82b5c3234b27fe7365151fd36226eba42e1aad57e7322fda20192f52a1f86593f4dda6f9e1
SSDEEP 384:2+LALP9Xo1kXqKf/pUZNCgVLH2HfkLrUBHGc8Tffbu:VLALho1kXqKf/pUZNCgVLH2HforU1Gcr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 f16176bf2b48474fd0c0a5b3ef6446cf06dd96d61d1beb40b30f05c0315bf11d
MD5 ad0478903986f26760ae556b834f7ef6
SHA1 badcdf15e940faf2aea35cf91fddabee76985283
SHA512 2be2dc8abb399ae1d37153a81539eabc753573820f5985d96cd56361bb8c86d2c294e300b1a9db9efdd14e5828eee773e7521380a95fb893398d7dda03a8772a
SSDEEP 384:2GLALP9Xo1kXqKf/pUZNCgVLH2HfkLrUQHGckTWbV:BLALho1kXqKf/pUZNCgVLH2HforUUGc7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 200KB
SHA256 036bd5f7409569e00fef4ab5ec10e486727f8346ffe0fce616b4d7401bf35cdc
MD5 663a8101f85d9f94b01bbca0fde11474
SHA1 5ec6d8bbed4c51f7d1066a254a5ad071067feff2
SHA512 b72f9c2897b8ad53d0bb8f5176120a845dbab01ca09cd336909b30da909296c54e5534f333ad76959000203b24d5966e799c67572012401f81ab31cfdce95ed6
SSDEEP 3072:5pqn8GsWaejKTaDqWyOyqSJzJGpWW2FtteJLFgH/Q/6Zp/viVwg0GOM7Vz9:c4eKEZbmzw4BvMLm4/S/viVLjhZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download