3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2023, 23:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Size 1.4MB
Sample230430-3hgcsabc4s
SHA256 3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a
MD5 278cdf8260e91e72953442bc24a4484c
SHA1 5fb5fa43011f786a9221b2b3f4b23eda767bacd4
SHA512 decc7c8581403a06909923ee5e234c2b53edcbb056851933a41158ba22b140bdfbb550d0d3799f2102df1ba68be6aca005c884f3cae95df17ffa7108fa38bc12
SSDEEP 24576:iGU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dR7U5haSM:xpEUIvU0N9jkpjweXt77A5sJ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
File opened for modification	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1020	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133273724890372361"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2264	chrome.exe
2264	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: SeAssignPrimaryTokenPrivilege	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: SeLockMemoryPrivilege	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: SeIncreaseQuotaPrivilege	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: SeMachineAccountPrivilege	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: SeTcbPrivilege	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: SeSecurityPrivilege	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: SeTakeOwnershipPrivilege	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: SeLoadDriverPrivilege	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: SeSystemProfilePrivilege	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: SeSystemtimePrivilege	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: SeProfSingleProcessPrivilege	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: SeIncBasePriorityPrivilege	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: SeCreatePagefilePrivilege	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: SeCreatePermanentPrivilege	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: SeBackupPrivilege	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: SeRestorePrivilege	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: SeShutdownPrivilege	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: SeDebugPrivilege	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: SeAuditPrivilege	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: SeSystemEnvironmentPrivilege	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: SeChangeNotifyPrivilege	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: SeRemoteShutdownPrivilege	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: SeUndockPrivilege	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: SeSyncAgentPrivilege	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: SeEnableDelegationPrivilege	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: SeManageVolumePrivilege	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: SeImpersonatePrivilege	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: SeCreateGlobalPrivilege	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: 31	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: 32	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: 33	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: 34	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: 35	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
Token: SeDebugPrivilege	1020	taskkill.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 4732	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe	90
PID 1000 wrote to memory of 4732	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe	90
PID 1000 wrote to memory of 4732	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe	90
PID 4732 wrote to memory of 1020	4732	cmd.exe	92
PID 4732 wrote to memory of 1020	4732	cmd.exe	92
PID 4732 wrote to memory of 1020	4732	cmd.exe	92
PID 1000 wrote to memory of 2264	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe	94
PID 1000 wrote to memory of 2264	1000	3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe	94
PID 2264 wrote to memory of 4688	2264	chrome.exe	95
PID 2264 wrote to memory of 4688	2264	chrome.exe	95
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 2972	2264	chrome.exe	96
PID 2264 wrote to memory of 4528	2264	chrome.exe	97
PID 2264 wrote to memory of 4528	2264	chrome.exe	97
PID 2264 wrote to memory of 4684	2264	chrome.exe	98
PID 2264 wrote to memory of 4684	2264	chrome.exe	98
PID 2264 wrote to memory of 4684	2264	chrome.exe	98
PID 2264 wrote to memory of 4684	2264	chrome.exe	98
PID 2264 wrote to memory of 4684	2264	chrome.exe	98
PID 2264 wrote to memory of 4684	2264	chrome.exe	98
PID 2264 wrote to memory of 4684	2264	chrome.exe	98
PID 2264 wrote to memory of 4684	2264	chrome.exe	98
PID 2264 wrote to memory of 4684	2264	chrome.exe	98
PID 2264 wrote to memory of 4684	2264	chrome.exe	98
PID 2264 wrote to memory of 4684	2264	chrome.exe	98
PID 2264 wrote to memory of 4684	2264	chrome.exe	98
PID 2264 wrote to memory of 4684	2264	chrome.exe	98
PID 2264 wrote to memory of 4684	2264	chrome.exe	98

C:\Users\Admin\AppData\Local\Temp\3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe
"C:\Users\Admin\AppData\Local\Temp\3227e4497a324caa08fe292452ae6b95aad4a89981be27d601de0312ece4cf9a.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff87f339758,0x7ff87f339768,0x7ff87f339778
    3⤵
    PID:4688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 --field-trial-handle=1796,i,15970220879191636403,11421339600300634164,131072 /prefetch:2
    3⤵
    PID:2972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1796,i,15970220879191636403,11421339600300634164,131072 /prefetch:8
    3⤵
    PID:4528
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1796,i,15970220879191636403,11421339600300634164,131072 /prefetch:8
    3⤵
    PID:4684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3200 --field-trial-handle=1796,i,15970220879191636403,11421339600300634164,131072 /prefetch:1
    3⤵
    PID:3704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3332 --field-trial-handle=1796,i,15970220879191636403,11421339600300634164,131072 /prefetch:1
    3⤵
    PID:800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3780 --field-trial-handle=1796,i,15970220879191636403,11421339600300634164,131072 /prefetch:1
    3⤵
    PID:1904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4912 --field-trial-handle=1796,i,15970220879191636403,11421339600300634164,131072 /prefetch:1
    3⤵
    PID:5028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5208 --field-trial-handle=1796,i,15970220879191636403,11421339600300634164,131072 /prefetch:8
    3⤵
    PID:2736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5188 --field-trial-handle=1796,i,15970220879191636403,11421339600300634164,131072 /prefetch:8
    3⤵
    PID:3908
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4780 --field-trial-handle=1796,i,15970220879191636403,11421339600300634164,131072 /prefetch:8
    3⤵
    PID:4660
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5200 --field-trial-handle=1796,i,15970220879191636403,11421339600300634164,131072 /prefetch:8
    3⤵
    PID:3024
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 --field-trial-handle=1796,i,15970220879191636403,11421339600300634164,131072 /prefetch:8
    3⤵
    PID:744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 --field-trial-handle=1796,i,15970220879191636403,11421339600300634164,131072 /prefetch:8
    3⤵
    PID:4300

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

background.html

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html
Size 786B
SHA256 a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e
MD5 9ffe618d587a0685d80e9f8bb7d89d39
SHA1 8e9cae42c911027aafae56f9b1a16eb8dd7a739c
SHA512 a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12
MD5 SHA1 SHA512

Submit Download

icon.png

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png
Size 6KB
SHA256 40cfea52dbc50a8a5c250c63d825dcaad3f76e9588f474b3e035b587c912f4ca
MD5 362695f3dd9c02c83039898198484188
SHA1 85dcacc66a106feca7a94a42fc43e08c806a0322
SHA512 a04dc31a6ffc3bb5d56ba0fb03ecf93a88adc7193a384313d2955701bd99441ddf507aa0ddfc61dfc94f10a7e571b3d6a35980e61b06f98dd9eee424dc594a6f
SSDEEP 192:+Ux65UF6vFM2Wx8DJCyt5hDeW98wcE587tBq28g7:Mq0tVWx8IyzhDeW98rE587X5
MD5 SHA1 SHA512 SSDEEP

Submit Download

aes.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js
Size 13KB
SHA256 fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a
MD5 4ff108e4584780dce15d610c142c3e62
SHA1 77e4519962e2f6a9fc93342137dbb31c33b76b04
SHA512 d6eee0fc02205a3422c16ad120cad8d871563d8fcd4bde924654eac5a37026726328f9a47240cf89ed6c9e93ba5f89c833e84e65eee7db2b4d7d1b4240deaef2
SSDEEP 192:9pQGDuD690MPdz8Ui015ll1I57I2Tru6h0hNmHV+m9eIfyAqYfinNVYEUUFJZmUY:9OiT0wz8Uiw/1S7DegkcHpeIuScZbAX
MD5 SHA1 SHA512 SSDEEP

Submit Download

background.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js
Size 20KB
SHA256 08dcb6a8677da4a66ae9116c387d677d96cd190160fce91a216e24d8e8219299
MD5 fd3ea9983702229b2713d17c98b0a1a9
SHA1 5dc7e3cc22a9255fa4e87b575ab29aab02979ed7
SHA512 775603fcd9daee173c1b69bfabbb75fbeb06b99b24624247b701d2f8e56ec1462c61682a02a2f8c9cfc0c02570775a0a88f507d7f5d93f866fa894cd090cb070
SSDEEP 384:5S45YxqMJk2YtZZpw+QKJfOySOJOXMWpDpCmu6kFccuJrwyCmuP4W:57uc6k2YtZZpw+QKJfOySOJOXMWcz
MD5 SHA1 SHA512 SSDEEP

Submit Download

content.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js
Size 3KB
SHA256 03601415885fd5d8967c407f7320d53f4c9ca2ec33bbe767d73a1589c5e36c54
MD5 c31f14d9b1b840e4b9c851cbe843fc8f
SHA1 205e3a99dc6c0af0e2f4450ebaa49ebde8e76bb4
SHA512 2c3d7ed5384712a0013a2ebbc526e762f257e32199651192742282a9641946b6aea6235d848b1e8cb3b0f916f85d3708a14717a69cbcf081145bc634d11d75aa
MD5 SHA1 SHA512

Submit Download

jquery-3.3.1.min.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js
Size 84KB
SHA256 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
MD5 a09e13ee94d51c524b7e2a728c7d4039
SHA1 0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae
SHA512 f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a
SSDEEP 1536:jLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6t3:5kn6x2xe9NK6nC69
MD5 SHA1 SHA512 SSDEEP

Submit Download

mode-ecb.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js
Size 604B
SHA256 03164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a
MD5 23231681d1c6f85fa32e725d6d63b19b
SHA1 f69315530b49ac743b0e012652a3a5efaed94f17
SHA512 36860113871707a08401f29ab2828545932e57a4ae99e727d8ca2a9f85518d3db3a4e5e4d46ac2b6ba09494fa9727c033d77c36c4bdc376ae048541222724bc2
MD5 SHA1 SHA512

Submit Download

pad-nopadding.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js
Size 268B
SHA256 282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d
MD5 0f26002ee3b4b4440e5949a969ea7503
SHA1 31fc518828fe4894e8077ec5686dce7b1ed281d7
SHA512 4290a1aee5601fcbf1eb2beec9b4924c30cd218e94ae099b87ba72c9a4fa077e39d218fc723b8465d259028a6961cc07c0cd6896aa2f67e83f833ca023a80b11
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json
Size 1KB
SHA256 04392a223cc358bc79fcd306504e8e834d6febbff0f3496f2eb8451797d28aa1
MD5 05bfb082915ee2b59a7f32fa3cc79432
SHA1 c1acd799ae271bcdde50f30082d25af31c1208c3
SHA512 6feea1c8112ac33d117aef3f272b1cc42ec24731c51886ed6f8bc2257b91e4d80089e8ca7ce292cc2f39100a7f662bcc5c37e5622a786f8dc8ea46b8127152f3
MD5 SHA1 SHA512

Submit Download

43dbc1dc-dd9b-40fe-a1ff-d4f4d226539a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\43dbc1dc-dd9b-40fe-a1ff-d4f4d226539a.tmp
Size 11KB
SHA256 a164bb0407892cfaf0c338fdc6b0444ecaecf26c62a6ae0550bf7ecf5c1b5547
MD5 50946888df1f28e14cbd7501be8b3640
SHA1 20f08ff5e25de15c6b2c859b58086f5094bbd471
SHA512 893c1dd7b8b5f4f2fcbdfcb1030dc5c162cdb326aad6186cb35bb602eaac7697052c13ddba9c1a5cf6f61146cc58945b6515d933f6a109254f81509d27af1201
SSDEEP 192:J44SX+a1kXqK4I40pUZNCgVLHrKHfFyMrUKKT6xWxI4J9Zxm2y98a:J0Xl1kXqKf/pUZNCgVLH2HfkMrUYkBp8
MD5 SHA1 SHA512 SSDEEP

Submit Download

4d3c3efe-c133-4c5d-93f2-43996139eaec.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4d3c3efe-c133-4c5d-93f2-43996139eaec.tmp
Size 5KB
SHA256 bb41ceac16db3fdbd72d711a316b2b83dcca6702a72e44282ea8e2874decfefa
MD5 a8dfb034bc13bd6dcfc81c01445d049a
SHA1 c646a07ee9a7a7a97bac4ece3308948e3cac05f1
SHA512 63a3cd0b4b02d3f9a6940068e47b482ab4bcb689768bb52ddb976afb41c689c585a8504c87c40d632742c3136864bfd7fe6700de51f74eceb6657492a0c417d1
SSDEEP 96:fKX9oKI7f/Av8iZRy7Di+6MsmdeNIOAEOjVhYtjEsXt0/cg2Vup:fC9o93Av8syy+FU2otjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e2353197b9a64a3db9ff3f521738feaa9b5b1c186a1b0a10185faf079a5b04dd
MD5 3cfc68c1bbbfc42fd0bb63e6e9a64f0f
SHA1 d0c08229793e4c704cb74e078a3d69587aafad4e
SHA512 ebc501fa094728836dc00d20b91d00f0d8fc2416a839beb62d76f101cf8328b29ccbf8bf4f142ec6d50ab1cd6c3e2379ca963e217791e3b39cf2b8491c575dbd
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 874B
SHA256 a69638c5110ff64a93243e43c4d44fec5c93f3f2da4637f214cff9d707ffd7fa
MD5 bef3468a4b25b0c17db602b9a6494d1c
SHA1 ef808a72dbddf02157c2696b23dd15c66d650a25
SHA512 8b771d042a2de2a75c2b17e4a3a821e3a8d240844dc8d8b925ae7b18194498b574445e16c90c50b5a82b295b19d591310186a6e5730492545d7d68197ad4153a
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 874B
SHA256 aa3a61655724d87091107d6a4dc36c0ae46d4d93c07cb1a48228637218f2e569
MD5 3299fe14c9d1035e32f722e00cd21621
SHA1 a208bbab2b380885df88d7b335ddb419cbcfde01
SHA512 3845d7d7aad0cdabf2f49e5108a699bfe6ae6c584ab06141106d1ea64c177bc0e8623587733d1394b0c7b91f06284cee069e1a04ef1f1b75ffc51f609fbf26a6
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 874B
SHA256 94cbf176bfbab8a0a9b8b657eb1ad6035c29d54dfd72c4faad7c76f4cf3a4417
MD5 30d88c3a5576641053631bb6c80401f1
SHA1 8d248415039a2dd80791b73d2465a3dd061e4408
SHA512 11b49058e08b51cd08053b3e13b2ef404a149e9ced789e79bd32a940021a6a9ec4629aae1a7e38a996b2193aa45939944902a68cf87a2ba11c382cfabec88314
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 be0fdbbd593033c15fc551ab8b456d36186c55ba79d06864da6ac3ac07572744
MD5 6d0fcd88a02db9f0136131cbde3a65f4
SHA1 18d0ea92efbc4a63b978dfbe7980e10f55e0520f
SHA512 7b4f09ea3fd0fb0e0c5ce7245a1b68a3a5aa4a238291f7741cd03e00be2c4a7e1120b087fd9eb09282506c258c3d809f9811552450427cbe5af42cd59cb23c5c
SSDEEP 96:fKX9oKI7f/Av8iZRy7Di+6MsmdeAOAEOjVhYtjEsXt0/cg2Vup:fC9o93Av8syy+FlotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 cb19ff1925687ee02fe56748d1867f01dbfa338bc6f8345eedf8f812585105a2
MD5 1d476d4380c4582d54f5f18370562a43
SHA1 94755216a767b6cd5aa8b914d476f3f284ac0cd6
SHA512 52e9c2d99fe9fd7de29c637b763e4b86316050931711387a4c88387fdebe1615d7bd72c6ab8440049b5a4bcd95cc5ffdbca0e7ddfee3459909630484759605bf
SSDEEP 96:fKX9oKI7f/Av8iZRy7Di+6MsmdegOAEOjVhYtjEsXt0/cg2Vup:fC9o93Av8syy+FxotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 147f6798ad4cbc68c2404f343db9a3cd4140c3a503233d9c5bf92be4500c6009
MD5 2bd089522b71dd2e6569cf4dbd69b222
SHA1 a2b4409d48376f611aa238341e60f4a19f9625f6
SHA512 359037169c91a500df98a13aae3194d1685ba503e6d9545d7473574cb38265821bb364f45b7138c1b81e087e73c8aca8b17837e6510a575571eb78735845152c
SSDEEP 192:J44SX+a1kXqK4I40pUZNCgVLHrKHfFyMrUKKT6x+xI4J9Zxm2y987:J0Xl1kXqKf/pUZNCgVLH2HfkMrUY8BpV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 148KB
SHA256 8fef314f5c15f1a7ea8c978cbdb886e8d9e31e2eb6ab9bf735904667ab2a6432
MD5 9baf0fc3bf1562ddf865499247eaf132
SHA1 0bc8464503348ae354767cddb9b4b55ba1e6c6e6
SHA512 d2bd2b957c6b43821c854c6cae1dc823b219c1e9821e5b3f3f5344f2e93c78f7d3a721974187f6c7d00069f0902d9d8ecba310128488076cbbc1009d0afde8cf
SSDEEP 3072:1LaCzw+6Ka3iPGXVtGTvTwpGyBHSH/Q/6Zp/viVwg0GOM7VzT:1rJa3ieHw6GqS4/S/viVLjhH
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download