socelars | 55fc7e624b75a66d04ed1dfc8d6957ceb013db94e9be29e779280378011d1399

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/12/2023, 18:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7908fc00709580c4e12534bcd7ef8aae.exe
Size 1.4MB
Sample231219-w8w3lagfa2
SHA256 55fc7e624b75a66d04ed1dfc8d6957ceb013db94e9be29e779280378011d1399
MD5 7908fc00709580c4e12534bcd7ef8aae
SHA1 616616595f65c8fdaf1c5f24a4569e6af04e898f
SHA512 0d5a72410d628d3bf6ff9188a69f378e04184ed603a620659f4084bd8a5a392577849c5aa895706eec5213b0036d24faafb8e153b458b5f53d8da7ce636b7a00
SSDEEP 24576:CxpXPaR2J33o3S7P5zuHHOF2CxfehMHsGKzOYCMEMfX4QZ1XSlqOR:ipy+VDi8rgHfX4QZhSnR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

socelars spyware stealer

Malware Config

Signatures

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\manifest.json	7908fc00709580c4e12534bcd7ef8aae.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3976	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133475159257663626"	chrome.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\151682F5218C0A511C28F4060A73B9CA78CE9A53	7908fc00709580c4e12534bcd7ef8aae.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\151682F5218C0A511C28F4060A73B9CA78CE9A53\Blob = 030000000100000014000000151682f5218c0a511c28f4060a73b9ca78ce9a531400000001000000140000007c4296aede4b483bfa92f89e8ccf6d8ba972379504000000010000001000000029f1c1b26d92e893b6e6852ab708cce10f00000001000000200000005aef843ffcf2ec7055f504a162f229f8391c370ff3a6163d2db3f3d604d622be19000000010000001000000070d4f0bec2078234214bd651643b02405c0000000100000004000000800100001800000001000000100000002fe1f70bb05d7c92335bc5e05b984da62000000001000000640400003082046030820248a0030201020210079e492886376fd40848c23fc631e463300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f742058323076301006072a8648ce3d020106052b8104002203620004cd9bd59f80830aec094af3164a3e5ccf77acde67050d1d07b6dc16fb5a8b14dbe27160c4ba459511898eea06dff72a161ca4b9c5c532e003e01e8218388bd745d80a6a6ee60077fb02517d22d80a6e9a5b77dff0fa41ec39dc75ca68070c1feaa381e53081e2300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604147c4296aede4b483bfa92f89e8ccf6d8ba9723795301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b050003820201001b7f252b907a0876007718e1c32e8a364c417ebf174be330d75b0c7e9c96986f7bb068c02444cce2f2fcd1eadbd29f01f9174d0c9d55fda5ad6dd22f3f4b72c02eae73c7251657c23e15ade031d10a84846c6278423122461aed7a40bf9716814477ca6c7b5d215c07f2119121bfe12fc2ef6efd0520e4b4f779f32dbb372af0c6b1acac51f51fb35a1e66ce580718387f71a93c83bad7bc829e9a760f9eb029fdcbf38907481bfeab932e14210d5faf8eb754ab5d0ed45b4c71d092ea3da3369b7c1fe03b55b9d85353cc8366bb4adc810600188bf4b3d748b11341b9c4b69ecf2c778e42200b807e9fc5ab48dbbc6f048d6c4629020d708a1df11273b64624429e2a1718e3acc798c272cc6d2d766ddd2c2b2696a5cf21081be5da2fcbef9f7393aef8365f478f9728ceabe29826988bfdee28322229ed4c9509c420fa07e1862c44f68147c0e46232ed1dd83c488896c35e91b6af7b59a4eee3869cc78858ca282a66559b8580b91dd8402bc91c133ca9ebde99c21640f6f5a4ae2a256c52bac7044cb432bbfc385ca00c617b57ec774e50cfaf06a20f378ce10ed2d32f1abd9c713ecce1f8d1a8a3bd04f619c0f986aff50e1aaa956befca47714b631c4d96db55230a9d0f8175a0e640f56446036ecefa6a7d06eca4340674da53d8b9b8c6237da9f82a2da482a62e2d11cae6cd31587985e6721ca79fd34cd066d0a7bb	7908fc00709580c4e12534bcd7ef8aae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	7908fc00709580c4e12534bcd7ef8aae.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	7908fc00709580c4e12534bcd7ef8aae.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	7908fc00709580c4e12534bcd7ef8aae.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4592	chrome.exe
4592	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: SeAssignPrimaryTokenPrivilege	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: SeLockMemoryPrivilege	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: SeIncreaseQuotaPrivilege	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: SeMachineAccountPrivilege	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: SeTcbPrivilege	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: SeSecurityPrivilege	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: SeTakeOwnershipPrivilege	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: SeLoadDriverPrivilege	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: SeSystemProfilePrivilege	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: SeSystemtimePrivilege	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: SeProfSingleProcessPrivilege	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: SeIncBasePriorityPrivilege	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: SeCreatePagefilePrivilege	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: SeCreatePermanentPrivilege	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: SeBackupPrivilege	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: SeRestorePrivilege	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: SeShutdownPrivilege	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: SeDebugPrivilege	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: SeAuditPrivilege	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: SeSystemEnvironmentPrivilege	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: SeChangeNotifyPrivilege	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: SeRemoteShutdownPrivilege	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: SeUndockPrivilege	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: SeSyncAgentPrivilege	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: SeEnableDelegationPrivilege	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: SeManageVolumePrivilege	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: SeImpersonatePrivilege	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: SeCreateGlobalPrivilege	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: 31	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: 32	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: 33	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: 34	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: 35	4180	7908fc00709580c4e12534bcd7ef8aae.exe
Token: SeDebugPrivilege	3976	taskkill.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 1916	4180	7908fc00709580c4e12534bcd7ef8aae.exe	91
PID 4180 wrote to memory of 1916	4180	7908fc00709580c4e12534bcd7ef8aae.exe	91
PID 4180 wrote to memory of 1916	4180	7908fc00709580c4e12534bcd7ef8aae.exe	91
PID 1916 wrote to memory of 3976	1916	cmd.exe	93
PID 1916 wrote to memory of 3976	1916	cmd.exe	93
PID 1916 wrote to memory of 3976	1916	cmd.exe	93
PID 4180 wrote to memory of 4360	4180	7908fc00709580c4e12534bcd7ef8aae.exe	98
PID 4180 wrote to memory of 4360	4180	7908fc00709580c4e12534bcd7ef8aae.exe	98
PID 4360 wrote to memory of 4072	4360	chrome.exe	97
PID 4360 wrote to memory of 4072	4360	chrome.exe	97
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1920	4360	chrome.exe	101
PID 4360 wrote to memory of 1072	4360	chrome.exe	100
PID 4360 wrote to memory of 1072	4360	chrome.exe	100
PID 4360 wrote to memory of 2292	4360	chrome.exe	99
PID 4360 wrote to memory of 2292	4360	chrome.exe	99
PID 4360 wrote to memory of 2292	4360	chrome.exe	99
PID 4360 wrote to memory of 2292	4360	chrome.exe	99
PID 4360 wrote to memory of 2292	4360	chrome.exe	99
PID 4360 wrote to memory of 2292	4360	chrome.exe	99
PID 4360 wrote to memory of 2292	4360	chrome.exe	99
PID 4360 wrote to memory of 2292	4360	chrome.exe	99
PID 4360 wrote to memory of 2292	4360	chrome.exe	99
PID 4360 wrote to memory of 2292	4360	chrome.exe	99
PID 4360 wrote to memory of 2292	4360	chrome.exe	99
PID 4360 wrote to memory of 2292	4360	chrome.exe	99
PID 4360 wrote to memory of 2292	4360	chrome.exe	99
PID 4360 wrote to memory of 2292	4360	chrome.exe	99

C:\Users\Admin\AppData\Local\Temp\7908fc00709580c4e12534bcd7ef8aae.exe
"C:\Users\Admin\AppData\Local\Temp\7908fc00709580c4e12534bcd7ef8aae.exe"
1⤵
- Drops Chrome extension
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2268 --field-trial-handle=2076,i,2110909978143459460,16329632189031928695,131072 /prefetch:8
    3⤵
    PID:2292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1900 --field-trial-handle=2076,i,2110909978143459460,16329632189031928695,131072 /prefetch:8
    3⤵
    PID:1072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=2076,i,2110909978143459460,16329632189031928695,131072 /prefetch:2
    3⤵
    PID:1920
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3236 --field-trial-handle=2076,i,2110909978143459460,16329632189031928695,131072 /prefetch:1
    3⤵
    PID:2032
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3200 --field-trial-handle=2076,i,2110909978143459460,16329632189031928695,131072 /prefetch:1
    3⤵
    PID:1456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4772 --field-trial-handle=2076,i,2110909978143459460,16329632189031928695,131072 /prefetch:1
    3⤵
    PID:4496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4600 --field-trial-handle=2076,i,2110909978143459460,16329632189031928695,131072 /prefetch:8
    3⤵
    PID:4060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4912 --field-trial-handle=2076,i,2110909978143459460,16329632189031928695,131072 /prefetch:8
    3⤵
    PID:3948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4912 --field-trial-handle=2076,i,2110909978143459460,16329632189031928695,131072 /prefetch:8
    3⤵
    PID:3692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5048 --field-trial-handle=2076,i,2110909978143459460,16329632189031928695,131072 /prefetch:8
    3⤵
    PID:228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 --field-trial-handle=2076,i,2110909978143459460,16329632189031928695,131072 /prefetch:8
    3⤵
    PID:440
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 --field-trial-handle=2076,i,2110909978143459460,16329632189031928695,131072 /prefetch:8
    3⤵
    PID:860
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5284 --field-trial-handle=2076,i,2110909978143459460,16329632189031928695,131072 /prefetch:8
    3⤵
    PID:3192
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 --field-trial-handle=2076,i,2110909978143459460,16329632189031928695,131072 /prefetch:8
    3⤵
    PID:4432
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 --field-trial-handle=2076,i,2110909978143459460,16329632189031928695,131072 /prefetch:8
    3⤵
    PID:3008
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3900 --field-trial-handle=2076,i,2110909978143459460,16329632189031928695,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4592

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdeeec9758,0x7ffdeeec9768,0x7ffdeeec9778
1⤵
PID:4072

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 27f427efda7d22ac3699ad8754a46c0dcf72d61606d6264e39cc95f8bb626e6d
MD5 b1431bf43be20bbc7c4a17929af1df7d
SHA1 e3697b7d80228fd961f2cdeb9f97b4d332fcde5c
SHA512 8e3619c89f6bda22b30248ac6013e7907f700a8bded52d56c867b0bececf6c9d008493aeb0f79d9ba12bda6ef299da53d756e348eb27b35ccf5d3192deee82e5
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 371B
SHA256 db9ed1aed3386a656dee4d60d4f501e4895c59caa44ead9fde442884886bb73c
MD5 e825a30611df8d07cf25dff2f42d7d51
SHA1 fa92976c10b604775cc46c6ae5eb832976819a5b
SHA512 d2fcd2ebd1060e6215f36c3bd0995d64a514ab70c895e64236b1270aaf6b9e4b88254b0754578c7c643eb926e8825559f359ad9aec95c6a887c14763dedb0446
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 12b12e44337c4027a1026875ea39c46bb71ce2fbd729207cea78389d0e096665
MD5 e2c66d0f7787a73c0ea292951ddaae64
SHA1 84db0fcf5d2db0c32312955ff183aa94857f5618
SHA512 1e005aac8d355cc7175cbfc0f7a6223b2f7f51b77f0457de5b86640e74cdd4b783fa78872a4b448ddb878a0e3cc086ba221aeb0e05337c19c0649e94bfa7e013
SSDEEP 96:849O6XcK7nvhwmKIC9i8iZRy7Di+6MsmdeihIOGrqQjVhYtjEsXt0/cg2Vup:8F6MIhwmEA8syy+FAotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 658e89d00e17daff0d8f88a2c86dcc1405c97efd9f7eb9d950632d538713972d
MD5 5d7eef489895dd4710940492546223b2
SHA1 28e39c3f690c6b57a20054b358221f86017d124a
SHA512 406a2c0746a1ee4bf4ee64de20bd56fb24f360e2359ea7ebddb2be7a0c1141687f3437f6b7bececf8b43bcb21d62ae436ca26613c665e11790d28554065459e4
SSDEEP 96:849O6XcK7nvhwmKIC9i8iZRy7Di+6Msmdei8IOGrqQjVhYtjEsXt0/cg2Vup:8F6MIhwmEA8syy+FgCotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 18KB
SHA256 d84d7b16ce4a1e8689f3d24aa44452016b19d3608f9ae7caa3eebcc5af814fbd
MD5 af8046dad8114e5def7f4ccb545b5791
SHA1 bac42f42b4ce089d63a38f6c10e435b6f4ca1767
SHA512 a4c54f0e699008525d9bed8447a10505eac4dedfb98923d4ea31dbe65e92447930cb1fe5180e84cdc825dc9f0b34db45dbe284b3386cb98b2fd321859027f143
SSDEEP 384:q2LPLeDcd82EBAHXs1kXqKf/pUZNCgVLH2HfkPrUlHGoDTuatW:XLPLmcdT3s1kXqKf/pUZNCgVLH2HfkrJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 18KB
SHA256 7067af8aabb46c1800019ec45af2499bb1d7d9909a7604d9652d1c3f3f5ca8ae
MD5 e33d8e526bd9af936681638a13c8fcb3
SHA1 f1f9294340b9c7d1f381c78567b5be6f8ef34806
SHA512 510973fa4f9127982da2840475f55ad1d4cb4bc52c9219839c3992d6f2fc052ebdb65d9e78d155ed640f8a570e3f83f39b35d8bf0b7a543568fdc8e5cc282a87
SSDEEP 384:qhLPLeDzl82EBAUXs1kXqKf/pUZNCgVLH2HfkPrUaHG3FTuatw:ILPLmzlTGs1kXqKf/pUZNCgVLH2HfkrX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 226KB
SHA256 101651c1a6062e6b65aee8eb065ebe68cbb0c6071aecf146a078e71201952335
MD5 38fb0649bb0a733a7fb761af58454a7a
SHA1 6da3d21d96c1ee1d8ab4736c98bc0db8906ef047
SHA512 e5a6eeccd4285e6386eddf88e79932b7d8feed648fa07895069960319f2540d052fda63c44c2c7309746a8cdc033e99eb8669bd382f5e385b4c78af832a74df9
SSDEEP 6144:hHbJtQDGVG1fyE4+VqiQfgcB+70xBmboJnf9/ToA9:pdtQD6G1fyE4CWgMxBOinf9b59
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 6338aac1feb439e1e88024584023092bf340e0f7d01cfeca65c29721a6f81e5a
MD5 825e45fdbbc07e60e78ec9300bed69da
SHA1 8378486155e8ee7e83e0531e83a8ead27308ab59
SHA512 6eced7960ccc8883cf7cf52cbab2afa6b4b50d277a2256deee17244cf5ac310fca8e36698ae19b96224c46c240017d412e352c9faee575aa97d275987bd45d74
SSDEEP 3072:dpjl+RZ3ExBmTyNAccce6M1OvEOnf5SD2A0hea11o9MCQLX:/B+70xBmboJnf9/ToWLX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 245KB
SHA256 c45ab77c713a9b76b6b4c25d0634221f3b93090f59f9defc808e06c9948efc7d
MD5 b59f38b12d5ad8d2e94e930fddab2d51
SHA1 d9b6870bb36af1ca330c9826dc27cab68e3339d9
SHA512 def9aa9dd0ab4af28ea6a8d18b4809a8ac5b869407ed994d39969a2262ec30fdb27ea945c7863e30fb78d31f86ea2d7ec95b144c8926cdad26d0cdab3409505c
SSDEEP 6144:/XpOHbJtQDGVG1fyE4+VqiQfgcB+70xBmboJnf9/ToA9:/cdtQD6G1fyE4CWgMxBOinf9b59
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 226KB
SHA256 af3c573eedc44d7481d82cd8e2364c56b3d5b7772162a8afdda68341f49a6309
MD5 3ec7086a7d0457743d4eb165beaae4e0
SHA1 236bc8369b57fb78b92e6a39a1ca12126104ab81
SHA512 de7ecfe5c18aa843f94f9524e590bd996835295b707037dca9379e1837a1c5cea9525d33dbfd6d0dd363c903e41b714371391be5c340db5d5d09279264ef27e9
SSDEEP 6144:Z+HbJtQDGVG1fyE4+VqiQfgcB+70xBmboJnf9/ToA9:wdtQD6G1fyE4CWgMxBOinf9b59
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download