319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25

Analysis

max time kernel
154s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2023, 18:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Size 1.4MB
Sample230505-wwxtcsed9z
SHA256 319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25
MD5 1e1499f1694d87ce6c669da7ddd5dce3
SHA1 bc0bc56ee35fcf1ed71779041c5b41393add03fc
SHA512 ef7d8f937e4ec7ccf5241265ab82f75ebb06fdcb4070d9d4c8478b88331a750c627cb52d7e44a4b1c7a7fd564e03bb548e527155c2a65698b6f4db863cd41bda
SSDEEP 24576:cGU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dRvG5hXSg:3pEUIvU0N9jkpjweXt77O5ZB
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
File opened for modification	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2372	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133277920026742622"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
848	chrome.exe
848	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: SeAssignPrimaryTokenPrivilege	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: SeLockMemoryPrivilege	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: SeIncreaseQuotaPrivilege	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: SeMachineAccountPrivilege	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: SeTcbPrivilege	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: SeSecurityPrivilege	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: SeTakeOwnershipPrivilege	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: SeLoadDriverPrivilege	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: SeSystemProfilePrivilege	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: SeSystemtimePrivilege	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: SeProfSingleProcessPrivilege	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: SeIncBasePriorityPrivilege	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: SeCreatePagefilePrivilege	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: SeCreatePermanentPrivilege	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: SeBackupPrivilege	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: SeRestorePrivilege	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: SeShutdownPrivilege	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: SeDebugPrivilege	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: SeAuditPrivilege	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: SeSystemEnvironmentPrivilege	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: SeChangeNotifyPrivilege	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: SeRemoteShutdownPrivilege	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: SeUndockPrivilege	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: SeSyncAgentPrivilege	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: SeEnableDelegationPrivilege	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: SeManageVolumePrivilege	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: SeImpersonatePrivilege	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: SeCreateGlobalPrivilege	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: 31	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: 32	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: 33	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: 34	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: 35	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
Token: SeDebugPrivilege	2372	taskkill.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 4084	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe	84
PID 2472 wrote to memory of 4084	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe	84
PID 2472 wrote to memory of 4084	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe	84
PID 4084 wrote to memory of 2372	4084	cmd.exe	86
PID 4084 wrote to memory of 2372	4084	cmd.exe	86
PID 4084 wrote to memory of 2372	4084	cmd.exe	86
PID 2472 wrote to memory of 848	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe	87
PID 2472 wrote to memory of 848	2472	319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe	87
PID 848 wrote to memory of 3436	848	chrome.exe	88
PID 848 wrote to memory of 3436	848	chrome.exe	88
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4600	848	chrome.exe	96
PID 848 wrote to memory of 4876	848	chrome.exe	97
PID 848 wrote to memory of 4876	848	chrome.exe	97
PID 848 wrote to memory of 4540	848	chrome.exe	98
PID 848 wrote to memory of 4540	848	chrome.exe	98
PID 848 wrote to memory of 4540	848	chrome.exe	98
PID 848 wrote to memory of 4540	848	chrome.exe	98
PID 848 wrote to memory of 4540	848	chrome.exe	98
PID 848 wrote to memory of 4540	848	chrome.exe	98
PID 848 wrote to memory of 4540	848	chrome.exe	98
PID 848 wrote to memory of 4540	848	chrome.exe	98
PID 848 wrote to memory of 4540	848	chrome.exe	98
PID 848 wrote to memory of 4540	848	chrome.exe	98
PID 848 wrote to memory of 4540	848	chrome.exe	98
PID 848 wrote to memory of 4540	848	chrome.exe	98
PID 848 wrote to memory of 4540	848	chrome.exe	98
PID 848 wrote to memory of 4540	848	chrome.exe	98

C:\Users\Admin\AppData\Local\Temp\319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe
"C:\Users\Admin\AppData\Local\Temp\319f58c16d6a270fa5916a0ce07301763a3b5149c057d6b948866f72062eab25.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffa60039758,0x7ffa60039768,0x7ffa60039778
    3⤵
    PID:3436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1788,i,14988022689279152297,2252573202370993794,131072 /prefetch:2
    3⤵
    PID:4600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1788,i,14988022689279152297,2252573202370993794,131072 /prefetch:8
    3⤵
    PID:4876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 --field-trial-handle=1788,i,14988022689279152297,2252573202370993794,131072 /prefetch:8
    3⤵
    PID:4540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3184 --field-trial-handle=1788,i,14988022689279152297,2252573202370993794,131072 /prefetch:1
    3⤵
    PID:1028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3204 --field-trial-handle=1788,i,14988022689279152297,2252573202370993794,131072 /prefetch:1
    3⤵
    PID:4868
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3876 --field-trial-handle=1788,i,14988022689279152297,2252573202370993794,131072 /prefetch:1
    3⤵
    PID:5068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5740 --field-trial-handle=1788,i,14988022689279152297,2252573202370993794,131072 /prefetch:8
    3⤵
    PID:2788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5832 --field-trial-handle=1788,i,14988022689279152297,2252573202370993794,131072 /prefetch:1
    3⤵
    PID:3964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5816 --field-trial-handle=1788,i,14988022689279152297,2252573202370993794,131072 /prefetch:8
    3⤵
    PID:3980
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6124 --field-trial-handle=1788,i,14988022689279152297,2252573202370993794,131072 /prefetch:8
    3⤵
    PID:3140
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5980 --field-trial-handle=1788,i,14988022689279152297,2252573202370993794,131072 /prefetch:8
    3⤵
    PID:4108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6276 --field-trial-handle=1788,i,14988022689279152297,2252573202370993794,131072 /prefetch:8
    3⤵
    PID:2192
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 --field-trial-handle=1788,i,14988022689279152297,2252573202370993794,131072 /prefetch:8
    3⤵
    PID:1080

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

background.html

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html
Size 786B
SHA256 a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e
MD5 9ffe618d587a0685d80e9f8bb7d89d39
SHA1 8e9cae42c911027aafae56f9b1a16eb8dd7a739c
SHA512 a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12
MD5 SHA1 SHA512

Submit Download

icon.png

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png
Size 6KB
SHA256 40cfea52dbc50a8a5c250c63d825dcaad3f76e9588f474b3e035b587c912f4ca
MD5 362695f3dd9c02c83039898198484188
SHA1 85dcacc66a106feca7a94a42fc43e08c806a0322
SHA512 a04dc31a6ffc3bb5d56ba0fb03ecf93a88adc7193a384313d2955701bd99441ddf507aa0ddfc61dfc94f10a7e571b3d6a35980e61b06f98dd9eee424dc594a6f
SSDEEP 192:+Ux65UF6vFM2Wx8DJCyt5hDeW98wcE587tBq28g7:Mq0tVWx8IyzhDeW98rE587X5
MD5 SHA1 SHA512 SSDEEP

Submit Download

aes.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js
Size 13KB
SHA256 fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a
MD5 4ff108e4584780dce15d610c142c3e62
SHA1 77e4519962e2f6a9fc93342137dbb31c33b76b04
SHA512 d6eee0fc02205a3422c16ad120cad8d871563d8fcd4bde924654eac5a37026726328f9a47240cf89ed6c9e93ba5f89c833e84e65eee7db2b4d7d1b4240deaef2
SSDEEP 192:9pQGDuD690MPdz8Ui015ll1I57I2Tru6h0hNmHV+m9eIfyAqYfinNVYEUUFJZmUY:9OiT0wz8Uiw/1S7DegkcHpeIuScZbAX
MD5 SHA1 SHA512 SSDEEP

Submit Download

background.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js
Size 20KB
SHA256 652363a374543cdc8962515ce6f054a82093ada89806f5cda106481e1464266e
MD5 e9959d4f47b9f687fb93b1196394cd22
SHA1 d5edcaeecf9e0cb7d592a47adbb1440fc36e891c
SHA512 10ac878cfeec8f3434cf5fa26c93a1bf2249bf72319fc89f8e52c81b2adbc413c3e941a58110cc438a5cb6d738d3e33cc7f899482a544d9486cce16244db3060
SSDEEP 384:4SF+xqMJkx/i+2GVRxXVIyL7SvXXPopXZyS2sBw9s499UiylQCJ9h0aP5naVg:42+c6kx/i+2GVRxXVIyL7SvXXPopXusT
MD5 SHA1 SHA512 SSDEEP

Submit Download

content.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js
Size 3KB
SHA256 03601415885fd5d8967c407f7320d53f4c9ca2ec33bbe767d73a1589c5e36c54
MD5 c31f14d9b1b840e4b9c851cbe843fc8f
SHA1 205e3a99dc6c0af0e2f4450ebaa49ebde8e76bb4
SHA512 2c3d7ed5384712a0013a2ebbc526e762f257e32199651192742282a9641946b6aea6235d848b1e8cb3b0f916f85d3708a14717a69cbcf081145bc634d11d75aa
MD5 SHA1 SHA512

Submit Download

jquery-3.3.1.min.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js
Size 84KB
SHA256 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
MD5 a09e13ee94d51c524b7e2a728c7d4039
SHA1 0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae
SHA512 f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a
SSDEEP 1536:jLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6t3:5kn6x2xe9NK6nC69
MD5 SHA1 SHA512 SSDEEP

Submit Download

mode-ecb.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js
Size 604B
SHA256 03164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a
MD5 23231681d1c6f85fa32e725d6d63b19b
SHA1 f69315530b49ac743b0e012652a3a5efaed94f17
SHA512 36860113871707a08401f29ab2828545932e57a4ae99e727d8ca2a9f85518d3db3a4e5e4d46ac2b6ba09494fa9727c033d77c36c4bdc376ae048541222724bc2
MD5 SHA1 SHA512

Submit Download

pad-nopadding.js

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js
Size 268B
SHA256 282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d
MD5 0f26002ee3b4b4440e5949a969ea7503
SHA1 31fc518828fe4894e8077ec5686dce7b1ed281d7
SHA512 4290a1aee5601fcbf1eb2beec9b4924c30cd218e94ae099b87ba72c9a4fa077e39d218fc723b8465d259028a6961cc07c0cd6896aa2f67e83f833ca023a80b11
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json
Size 1KB
SHA256 04392a223cc358bc79fcd306504e8e834d6febbff0f3496f2eb8451797d28aa1
MD5 05bfb082915ee2b59a7f32fa3cc79432
SHA1 c1acd799ae271bcdde50f30082d25af31c1208c3
SHA512 6feea1c8112ac33d117aef3f272b1cc42ec24731c51886ed6f8bc2257b91e4d80089e8ca7ce292cc2f39100a7f662bcc5c37e5622a786f8dc8ea46b8127152f3
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 268f618c547fbec0c6b3f14cba92c8f8444cc32ea80569e86fb8446641e4863b
MD5 9eeb39cf8b750c4fb536ece56d328536
SHA1 5d44cbac063c7c4264d4e792203d9c009274a440
SHA512 eee31dc9ec5ce45b55a04d03884bc3fc9e119ddf31354eda751e7ab4979154624342eb009dadfc980b648d3fab47ba44c9a9028a4b87272dc04c70ae92c378e8
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 874B
SHA256 b9fa02f956dbef0be9e32902f36640605635c876bc41bb4c8d0169d7d2da5abd
MD5 d56a5ca4831387819f7b3f28061ab460
SHA1 6d94f20059c7004de6565b5638ddb6a8c553bc2c
SHA512 c98a0829339321ba1e776dc0fd61f179460689d0f21e6c2621aec3baa66f58fe85c37a5649e2c4fdb4a05b1d9471644f46994aa437d3737d2820c193cb51fc6e
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 874B
SHA256 8f659e41766fa39833c00aa3bb55329f357d69d746785c75fb720a79e8d3ef5f
MD5 4708e494116f622a100f4c58ac0e8879
SHA1 67e1d85f529486811bbfeb2bed8a39ec3327da9c
SHA512 bf09a7e36e802907de66045e881f89c7ac5acce4fcad84120225b8184c896a330cc890575ff75bfb00e14da276d92303bca95a87e51b8f81fbadc52b10754f14
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 874B
SHA256 f09b4f4fb103ec9d828094601b7fcca2c9bb5847997325e3ac578c9b2743de03
MD5 aa3f513d33544a544e392480361ec1d3
SHA1 175be3569255d27fc2131e009e80196b05dbbb3e
SHA512 707889952b0f7d94235878356f0dc6b794c10a5cda151dc273d7df48ae46f1ef6ced458f441df95d094d5632fd2d4e089c779801eb78d253707de87ce7dbbbda
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 4KB
SHA256 63b5891df71abf2cad829b3e9b263e907d29634fbbae270ac9b8affd51673f14
MD5 02db762f032556ef9629d08bb3f06399
SHA1 2d0ec91e4f72887db84f78cbaa2a63dffb0b3873
SHA512 38298268d42288a7df11ad6434d9660f493df54c8a2b5d6dd2f52829385f8132f4ddf73d3d2dcfea52330d886a93e655058bd07f579ba48ea9c345ad4d92f9c5
SSDEEP 96:hl4uKIxwRjpd8iZRy7Di+6Msmde0+OzyjV39:h2uvajT8syy+F0b
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 4KB
SHA256 5d2873b7ce14e9966acaaa77d8ac88ad8126edf6ed0c81613c6823e9657a4358
MD5 e91e0a9cc6cb39b640ad4098a28359fd
SHA1 6ae7cbe9805c1884d8ce9a8733252beb8ec43f1d
SHA512 843f7c63c7a411ac86f732e05e29a1fc4cb7d9563714735e5bfe0d6ed6d9d605978585a9b325e6f7316fc54e9f3a69cfdbd8c23a2ed9fcd007a2f922e6e47e25
SSDEEP 96:hl4uKIxwRjpd8iZRy7Di+6MsmdeRylOzyjV39:h2uvajT8syy+FTb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 4KB
SHA256 990e83cb82634cce28c93d7487f9f2eb353c084cbe8e06b4b850747487accbd8
MD5 604ede45fdef889ca2b5df84fd557e81
SHA1 9083c39a201096daa76e74b4a90bcc09eb24bed9
SHA512 e6ad0a400429f93f638d4db81ee60f3263dbcc66ecd9d3563f47cb09b5fd679d7ff259f14eb2cce3268465786595a33904066bbb07d9baa3f567ed42442e9d72
SSDEEP 96:hl4uKIxwRjpd8iZRy7Di+6MsmdeuIOzyjV1:h2uvajT8syy+FHIH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 a51358bceef037490c08acbccf5336396f3fbe8f00e3c941b25c76c4bb8439ba
MD5 7374347769000209e7265c8232208b10
SHA1 5aeaf4b344aa465afd6cc6e1831d5a2a1a4f07d0
SHA512 544a949ca9a5c6ac540b4e7a1cf759a2581c0240b4f27116c374fbfd66e3daec99f92a1c8b0695c337297fbdbc60f6695ce390fc9440f67bf69278c357aaf929
SSDEEP 192:i44kX+v1kXqK4I40pUZNCgVLHrKHfFynrUKKTVx+xn7Nt+44Box2ERI9j+9:iKXw1kXqKf/pUZNCgVLH2HfknrUb85ht
MD5 SHA1 SHA512 SSDEEP

Submit Download

d1b38452-54f0-4ff8-b0a9-bae01212b380.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d1b38452-54f0-4ff8-b0a9-bae01212b380.tmp
Size 11KB
SHA256 c87d6788737a486a12e621e522286d431cc92683f596c8f6e5f9e563abd74f3c
MD5 b44beee3c2c323a15b2854f5b3afa377
SHA1 bae1f47675c50f363d6cee5a3942d91e8cb56bb3
SHA512 ebdfbabdafafd2318c27fcc1859331501a3b6ab2e707c25cf9718ca8467e396e1d87cff1e72c96d1efabc89ca2c2c4846b3eda62be051f81bf5ae9462d424cf2
SSDEEP 192:i44kX+v1kXqK4I40pUZNCgVLHrKHfFynrUKKTVxWxn7Nt+44Box2ERI9j+h:iKXw1kXqKf/pUZNCgVLH2HfknrUbk5hx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 71KB
SHA256 3e97d9e5fb9774774fc29c6c3472a2ba272919ba6465adabcd41a44ee43562fa
MD5 fd2dd0c0d8e0bf7b6c40b2b075d58236
SHA1 36ac853335e56d178efac9658a8add806d298bda
SHA512 cd669e83dbcd9edd3357b242b009577c0f384450809b9abe390a4fa7a3e370d1eb452fd9d8e813abd7cba3dd2421bc87120bbaea6959b30a19812f3ca425fa3c
SSDEEP 1536:iYk/Q/OccbxYiWU/vXyVOlgZiHGOM7nF+ABbauqzgW:iH/Q/6Zp/viVwg0GOM7VzW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 148KB
SHA256 f971653b5108185e25d3df84cc192fa21eee7cbf108090390800566821e0b576
MD5 4e162e9709e48979aaac27f3045c5c80
SHA1 45fc937a0a17b354742bf4c430fa39f05e684822
SHA512 a9fd5a9c64b44b534ffce9809de0ba8ad82b7344af34325da3fb7c9b0c2273eed8b304b4854d82869a3c6be2b6af7d671ad727ade6fa5a31ef490e9636e3ecd5
SSDEEP 3072:tX+pc9iEc0xbi9v3ZLJnVCgaeBtcH/Q/6Zp/viVwg0GOM7Vzm:tupc9ikQfMgae7c4/S/viVLjh6
MD5 SHA1 SHA512 SSDEEP

Submit Download