hxxps://google[.]com

Resubmissions

15/08/2024, 03:22

240815-dwxt9asbpc4

15/08/2024, 03:20

240815-dv9sesxbnr1

Analysis

max time kernel
91s
max time network
92s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
15/08/2024, 03:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://google.com
Sample240815-dwxt9asbpc

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133681658085773592"	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
3604	msedge.exe
3604	msedge.exe
4484	identity_helper.exe
4484	identity_helper.exe
4348	msedge.exe
4348	msedge.exe
4560	chrome.exe
4560	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 4332	3604	msedge.exe	78
PID 3604 wrote to memory of 4332	3604	msedge.exe	78
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 4204	3604	msedge.exe	79
PID 3604 wrote to memory of 2476	3604	msedge.exe	80
PID 3604 wrote to memory of 2476	3604	msedge.exe	80
PID 3604 wrote to memory of 4000	3604	msedge.exe	81
PID 3604 wrote to memory of 4000	3604	msedge.exe	81
PID 3604 wrote to memory of 4000	3604	msedge.exe	81
PID 3604 wrote to memory of 4000	3604	msedge.exe	81
PID 3604 wrote to memory of 4000	3604	msedge.exe	81
PID 3604 wrote to memory of 4000	3604	msedge.exe	81
PID 3604 wrote to memory of 4000	3604	msedge.exe	81
PID 3604 wrote to memory of 4000	3604	msedge.exe	81
PID 3604 wrote to memory of 4000	3604	msedge.exe	81
PID 3604 wrote to memory of 4000	3604	msedge.exe	81
PID 3604 wrote to memory of 4000	3604	msedge.exe	81
PID 3604 wrote to memory of 4000	3604	msedge.exe	81
PID 3604 wrote to memory of 4000	3604	msedge.exe	81
PID 3604 wrote to memory of 4000	3604	msedge.exe	81
PID 3604 wrote to memory of 4000	3604	msedge.exe	81
PID 3604 wrote to memory of 4000	3604	msedge.exe	81
PID 3604 wrote to memory of 4000	3604	msedge.exe	81
PID 3604 wrote to memory of 4000	3604	msedge.exe	81
PID 3604 wrote to memory of 4000	3604	msedge.exe	81
PID 3604 wrote to memory of 4000	3604	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xb8,0x10c,0x7ffb016e3cb8,0x7ffb016e3cc8,0x7ffb016e3cd8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,12641335632097370186,2815239143253716617,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,12641335632097370186,2815239143253716617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,12641335632097370186,2815239143253716617,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,12641335632097370186,2815239143253716617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,12641335632097370186,2815239143253716617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,12641335632097370186,2815239143253716617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,12641335632097370186,2815239143253716617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,12641335632097370186,2815239143253716617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,12641335632097370186,2815239143253716617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,12641335632097370186,2815239143253716617,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,12641335632097370186,2815239143253716617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,12641335632097370186,2815239143253716617,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:2964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xe8,0x108,0x7ffaecd6cc40,0x7ffaecd6cc4c,0x7ffaecd6cc58
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1892,i,14750301909037408217,7332828892418419160,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1812,i,14750301909037408217,7332828892418419160,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2076 /prefetch:3
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2224,i,14750301909037408217,7332828892418419160,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2192 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3112,i,14750301909037408217,7332828892418419160,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3268,i,14750301909037408217,7332828892418419160,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3548,i,14750301909037408217,7332828892418419160,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4408 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4728,i,14750301909037408217,7332828892418419160,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4736 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4928,i,14750301909037408217,7332828892418419160,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  - Drops file in Windows directory
  PID:3928
- - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff615d74698,0x7ff615d746a4,0x7ff615d746b0
    3⤵
    - Drops file in Windows directory
    PID:760

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 14adb8c869feb6a3016f003f07fdfd2bec658be981d6a5f94287f27a5ae5632e
MD5 92300b7e6a2ef0aeb5896c86a54d6f5f
SHA1 e8246bd4648c0ce8f9605c8762b7e69bb0844ce2
SHA512 e79999dd1665838fcf94f41b641060cb890d2a0343afbbf22181d4ca1ae63eb9813091a05d129d0881031ce66ca044644440d17e6b3ae667e807341e913bc6c8
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e70b239ed2564388dd321ff3caef0d1e18e974cf33fcf8cf96c9c497e2dac3e8
MD5 21d4c74be74d0328cd73589a694f62c0
SHA1 b44613629064537ece71381a32cfa8c402da7a8c
SHA512 ad4f43ecb920b6eef0304534aabd517d3a58d1187403fb26ad6595c01d1a3ead63757dfbe4d17e45fc142fbf153fe4f18037af836fed55e66aeb4681ce5661bd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 352B
SHA256 e9fbfa6205c55d25ff455eb24b9dad9838243f51730e9534c07ec5112190d956
MD5 d64b81a4fc79650b086fa554e4598be7
SHA1 7f7ce5ab44ac9671f6548097504414286a0f1c50
SHA512 163031fefcb2f6f23f6c46e0b174b0dd1d0444537fa717e439abfde78c1ccbc0e4f571f40ed0a688185d961a2b8273afae3cb57392cf31f2ca7fab3bec7a9ed1
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 0d7de773da2058ebd4c862acfec23296b689fb369877ff8d5451944d12fc3155
MD5 b7e6f5b4de46c1fdf1cd8ace25903815
SHA1 71869526e8b00965a7074601fea70679538b85a6
SHA512 9aaa9526fcf240c90dde456cb42b3cbff3cec93615e1435dab60098d673ba50635d1b280a59b49596a4a2d7d95d30203c6227e53ac0d44f12578f4d98a0352b5
SSDEEP 192:ixXepuAcTncRejLHV+FR8f4kw8NcnPo6yIsnVdg4:ixXuqYcjGRTcGl4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 7f292a4af122a404f26ebd46be7b9315dd7db2a48fb32f08f10df3102d60adf5
MD5 1c2f4dbff30b90c1d9c45cb7189b4329
SHA1 11b39381bccf027b60d9cd6c9e198c5863fb96f2
SHA512 ded4208fdb6a5201844c21449753152a4b85a7936245329cce77a6a5d33cc08a279ac08279fa0554aa55381833df83a07820089b5d949618108f832cf45686e2
SSDEEP 192:ixXepuAcTnHRejLHV+FRNf4kw8NcMado6yIsnVdg4:ixXuq7cjGRicGMU4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 7159bc68844cc1d768104aeb272cd51bdab4ec5c213526c236a11c16c8adf6d4
MD5 a692c396de324d0bbf0212f85296f696
SHA1 c2917bd5670e9523aba4982e4d0e007f2f69853f
SHA512 e99c370a516adfc1c4e73d8fbef1c054b0fcf76006dd05fd0d332791c961937687d1268809d07c06fa7dc6253ad61fdb1f1e1bc874cc89ab8b576234513ca695
SSDEEP 384:em0s7pLhLc+emvXlp1kXqKf/pUZNCgVLH2HfSGnrUPlHGEk3z:eDs7pLhLnx/lp1kXqKf/pUZNCgVLH2Hf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 95712f2c405e655203a212302552dc1f265000c4f42534d6fbf3635754752479
MD5 7f81c6869a364a3d4c38ca81779f415d
SHA1 b43b869ddd48dfaa9ed4277f56cf25e9b9a343a1
SHA512 f0e0b3236bfa6186e3ecc6c662ef73d3f78d9796e95528cf6408f96dcd73b4204c8be07f2f5567480f3ba28025870efaebb60f0e680dc25748cc953286914fad
SSDEEP 3072:1yZJJP0dpQRQlpMOuoBgp7WvB/QS3tKeSiDkFGiVcmjnvEBagWSptPvZ9CGq:AZkdFlXtXk0i68nvEBa0ptPvZ9O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 15e22ff58cf66a3c673be613cfb2ecd32fc9b5ed08dfa54cf4c2cb32c443912b
MD5 97dbcef693eeaf3b20d7a306e0b6aea8
SHA1 920c3c500a5dd1de68862ab4fcbd40c105c37318
SHA512 3c4e92fa726fe95c9523e806a845ce6b0d29e94dcb55b5c7afcd301883d2f7ebe8939aef2689a86f46e6b75dc0a4728075c0d6efd5612db43e07c0dabf4ca029
SSDEEP 3072:wyZJJP0dpQRQlpMOuoBgp7WvB/QS3tKeSiDkFGiVcmjnvEBagWSptPvZ9CGq:vZkdFlXtXk0i68nvEBa0ptPvZ9O
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

665dee3b-3c7d-4282-97cc-22b4e5bc6f91.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\665dee3b-3c7d-4282-97cc-22b4e5bc6f91.tmp
Size 11KB
SHA256 2a6709b5bbc356a60e5f390f911f495949a82893ef583069aa10e2f6d4a43d48
MD5 d2e02c192ddffc51e72bc7c769eb5b21
SHA1 cfe96c70f3a8d129bd75413751e56b962c8f0d90
SHA512 377efd8b49f113ac1ea8eadc9283c6f1c07e30793cd3b627bde8b8d9f3088c9974c0e84a425fb31a7dec39a75e51bc1e019b2ae37dfe062fe5e56cfd360c9ca0
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGgQe2RUhDRcQprELQQHO0L0Te:M9iIxuERzA83h09RZxASGlM20ELQV0LP
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a3d21f0fb6563a5c9d0f7a6e9c125ec3faaa86ff43f37cb85a8778abc87950f7
MD5 9828ffacf3deee7f4c1300366ec22fab
SHA1 9aff54b57502b0fc2be1b0b4b3380256fb785602
SHA512 2e73ea4d2fcd7c8d52487816110f5f4a808ed636ae87dd119702d1cd1ae315cbb25c8094a9dddf18f07472b4deaed3e7e26c9b499334b26bdb70d4fa7f84168d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b7f0d9ece2307bdc4f05a2d814c947451b007067ff8af977f77f06c3d5706942
MD5 6fdbe80e9fe20761b59e8f32398f4b14
SHA1 049b1f0c6fc4e93a4ba6b3c992f1d6cecf3ada1f
SHA512 cf25c7fd0d6eccc46e7b58949c16d17ebeefb7edd6c76aa62f7ab5da52d1c6fc88bde620be40396d336789bd0d62b2162209a947d7ab69389e8c03682e880234
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001
Size 209KB
SHA256 27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
MD5 3e552d017d45f8fd93b94cfc86f842f2
SHA1 dbeebe83854328e2575ff67259e3fb6704b17a47
SHA512 e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
SSDEEP 6144:ewpSHs6ljYg6trFqiSAprekukr20IgIgR:OHvhlo8XGus2oR
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 def2555f7156aaa137b53cb84009ab08aaaedee4513d0b192f141dc2b6e11741
MD5 3f6c7348aeec04cfbdc2290837569174
SHA1 fff22d8c40bfb9497bb688314a08b3876a507a45
SHA512 b61be813c8f22ade7a09660e20ffb310c56304bf1617f6948cdd3cb485aa6527b76cca8df0547bcfec015e24fb49fbe8bfd86fff61c77cdb98fb9c7138bf41ab
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1004B
SHA256 c7c797a159f82db1c2d1d27bec94ae8f99a9356c6f39235bf3acd2c646b84980
MD5 c25fe940c704d13f633bd6a83fef256e
SHA1 70243fef451c54ef9460d07dac363e0c39493004
SHA512 642eb2959232f41869699aee9e403cf847e612323f1c691813ab32e7b0fca4d14637e246f1356883b80d2bdf7a5f09993b7f187d0b1baad7ac4bfac5a44ac52d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 028012a2552451e7524fb7d3c1c57acc4237d9e9837d32322da12445a2c58bcf
MD5 5ba2ac46b2d89528ce31d85e00502485
SHA1 d9962a7aafa820d5ec7e7cf7fb04b3babbec5bdd
SHA512 2b6381f2fa0e119fa652138481715c16fb47ec32b29da7ff360c29ce8af96a335129760f8550134d07471ccfd862b2ccf314d081f3d749b5cea4a201628a859a
SSDEEP 96:nNk3Xj5/GkS5wSv0MoiVmdHIRJ30WQyV+VuziX3wI3:nNk3XRGkwv0MAIz3LM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 665e9894d8ceda8d4cdef12994fa98a83b1f073332c4e73f43c6f05858d62641
MD5 60a9c1ed40250561964ca287ccf1178b
SHA1 13d2ebc0cb694697b54237af0ee9ba6de3c4654a
SHA512 a1c128532a6f7f2b1ac1fe6acebb41aaf730e62f8571fd217e2252571b87ec5050cab66df7f72e6925d932d58d412bedefe0180c771555ad8a470ea822284664
SSDEEP 96:nNk3XR5/GkE5wSv0MoiVmdsuO1jIjJ30WQyV+VpAiX3wI3:nNk3XfGk+v0MJuOhIt3Le93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fff7f3ec37f28e8607d5427941e02fd90848f4c7ea4c9418aab8cdb462a2a1fe
MD5 491e1386d06610ff18a73a920f747258
SHA1 f47f7aaf3b9bfed2e2ea1c99f82cae89447d0b7e
SHA512 c80597a4083844c0a45b7da7395c6a45d313945b0f9520a93309e91750086ac1f36fb9b894498121d84cc7e45268fad2cce5bcc7bf8352cbe305c0eeffeb19fe
SSDEEP 96:nNk30R5/GkE5wSv0MoiVmdsuO1jIjJM0WQyV+VpAiX3wI3:nNk30fGk+v0MJuOhItMLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 72277e5ca9370bab681a3c9697438eac6da65c77b2862d3902509a00c2a1818f
MD5 9f92ad3dbd817114a8750a94a72a0740
SHA1 2905d0a16dd051a3ac82afe55f6a1d865f4b3cf0
SHA512 dd3e032b5c2343025c6b9bef9b482dd2b6679876fc333db1a733a6e184c57fb06b3647d5c4db65274c0e7e00672d2e637a66cb37a181aa6cc38ae97ff7429f88
SSDEEP 192:voCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGgQe2RUhDRcQprETQQHO0L0Te:X9iIxuERzA83h09RZxASGlM20ETQV0LP
MD5 SHA1 SHA512 SSDEEP

Submit Download