Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
23/08/2024, 04:10
Behavioral task
behavioral1
Sample
Mercurial.exe
Resource
win7-20240705-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
Mercurial.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
19 signatures
150 seconds
General
- Target Mercurial.exe
- Size 41KB
- Sample240823-erwbasxbkl
- SHA256 b6888dd4fee5c165225fe1006560b751d769d0debe65e14e98f4d8cabe3e4bcf
- MD5 5daca407a5b174f5f5cbb3ea04dd8a3b
- SHA1 7b25bf3474a4d78514a7df04b0a3c6cc453f7763
- SHA512 1a436d1005c45117e67d1600da88a77db0b54587c18aa49551c0707ace6373e8cf390dd0c7d3dc17a2997152f6710091ee486854d5bdcc0c55559682813c309d
- SSDEEP 768:nscGoA9WvMcldwwuZtejWTj6KZKfgm3EhDl:sc/McUejWT2F7Ell
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
mercurialgrabber
C2
-
https://discord.com/api/webhooks/898068237718261761/KniB9I7FAGbgiwGV6ub2_uE7GuQWTm94T_kcHonylqs73StuEGI3OqzKwT56iONTU2oh
Signatures
- Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions Mercurial.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools Mercurial.exe - Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Mercurial.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 3 discord.com 4 discord.com - Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Mercurial.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 Mercurial.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF chrome.exe File created \??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF chrome.exe - Checks SCSI registry key(s) 3 TTPs 1 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S Mercurial.exe - Enumerates system info in registry 2 TTPs 7 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation Mercurial.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer Mercurial.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName Mercurial.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0 Mercurial.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133688599028081955" chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2144 chrome.exe 2144 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3868 Mercurial.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2144 wrote to memory of 3720 2144 chrome.exe 101 PID 2144 wrote to memory of 3720 2144 chrome.exe 101 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 4144 2144 chrome.exe 102 PID 2144 wrote to memory of 8 2144 chrome.exe 103 PID 2144 wrote to memory of 8 2144 chrome.exe 103 PID 2144 wrote to memory of 208 2144 chrome.exe 104 PID 2144 wrote to memory of 208 2144 chrome.exe 104 PID 2144 wrote to memory of 208 2144 chrome.exe 104 PID 2144 wrote to memory of 208 2144 chrome.exe 104 PID 2144 wrote to memory of 208 2144 chrome.exe 104 PID 2144 wrote to memory of 208 2144 chrome.exe 104 PID 2144 wrote to memory of 208 2144 chrome.exe 104 PID 2144 wrote to memory of 208 2144 chrome.exe 104 PID 2144 wrote to memory of 208 2144 chrome.exe 104 PID 2144 wrote to memory of 208 2144 chrome.exe 104 PID 2144 wrote to memory of 208 2144 chrome.exe 104 PID 2144 wrote to memory of 208 2144 chrome.exe 104 PID 2144 wrote to memory of 208 2144 chrome.exe 104 PID 2144 wrote to memory of 208 2144 chrome.exe 104 PID 2144 wrote to memory of 208 2144 chrome.exe 104 PID 2144 wrote to memory of 208 2144 chrome.exe 104 PID 2144 wrote to memory of 208 2144 chrome.exe 104 PID 2144 wrote to memory of 208 2144 chrome.exe 104 PID 2144 wrote to memory of 208 2144 chrome.exe 104 PID 2144 wrote to memory of 208 2144 chrome.exe 104 PID 2144 wrote to memory of 208 2144 chrome.exe 104 PID 2144 wrote to memory of 208 2144 chrome.exe 104 PID 2144 wrote to memory of 208 2144 chrome.exe 104 PID 2144 wrote to memory of 208 2144 chrome.exe 104 PID 2144 wrote to memory of 208 2144 chrome.exe 104 PID 2144 wrote to memory of 208 2144 chrome.exe 104 PID 2144 wrote to memory of 208 2144 chrome.exe 104 PID 2144 wrote to memory of 208 2144 chrome.exe 104 PID 2144 wrote to memory of 208 2144 chrome.exe 104 PID 2144 wrote to memory of 208 2144 chrome.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:3868
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc3aa7cc40,0x7ffc3aa7cc4c,0x7ffc3aa7cc582⤵PID:3720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,9986175938091764923,17595608211108504884,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1912 /prefetch:22⤵PID:4144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2196,i,9986175938091764923,17595608211108504884,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2344 /prefetch:32⤵PID:8
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2228,i,9986175938091764923,17595608211108504884,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2384 /prefetch:82⤵PID:208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,9986175938091764923,17595608211108504884,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3184 /prefetch:12⤵PID:3432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3260,i,9986175938091764923,17595608211108504884,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:2656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4552,i,9986175938091764923,17595608211108504884,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4596 /prefetch:12⤵PID:3472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2948,i,9986175938091764923,17595608211108504884,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4760 /prefetch:82⤵PID:5080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5016,i,9986175938091764923,17595608211108504884,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5032 /prefetch:82⤵PID:2884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4848,i,9986175938091764923,17595608211108504884,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5168 /prefetch:12⤵PID:588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3340,i,9986175938091764923,17595608211108504884,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3492 /prefetch:12⤵PID:4288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5112,i,9986175938091764923,17595608211108504884,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4620 /prefetch:12⤵PID:2432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4672,i,9986175938091764923,17595608211108504884,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4712 /prefetch:12⤵PID:4056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5296,i,9986175938091764923,17595608211108504884,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5172 /prefetch:12⤵PID:3152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5052,i,9986175938091764923,17595608211108504884,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3508 /prefetch:12⤵PID:3384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5012,i,9986175938091764923,17595608211108504884,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4976 /prefetch:82⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4904
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:2264
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3568
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5104
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 649B
- SHA256 e20343c83e0b3cc55080d80188a3025c086e1f1e9eafdf48e190b479b5bd6e37
- MD5 16e91fb59b500bb53a51ff37cf1cb909
- SHA1 d38254b5299dd5dddc77fba1667e8e81065acb2f
- SHA512 3ae6aa6d9769d83c7ce6c79e65a3ad9e8baf14d7b3df22aed4b091afcc0fc91438d09be2233be24e8cc35b26d1d55ae7bd505399bb2e51f9e809190b4a1f62e8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001
- Size 212KB
- SHA256 af23860fb3a448f2cc6107680078402555a345eb45bc5efb750f541fe5d7c174
- MD5 2257803a7e34c3abd90ec6d41fd76a5a
- SHA1 f7a32e6635d8513f74bd225f55d867ea56ae4803
- SHA512 e9f4dc90d0829885f08879e868aa62041150b500f62682fc108da258eee26ad9509dcbf6e8a55f2d0bdba7aa9118dd149a70a7d851820d4ea683db7808c48540
- SSDEEP 6144:Vx/FFLxc6Jo8OPkxKcTfIaIWotgJKCS6gC6FF5:Vx9FL68OcxKcTLotaKrhF5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002
- Size 24KB
- SHA256 e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610
- MD5 c594a826934b9505d591d0f7a7df80b7
- SHA1 c04b8637e686f71f3fc46a29a86346ba9b04ae18
- SHA512 04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961
- SSDEEP 384:WVO9Au5n8w8JCE3z7e7Ttbu5+Esl5fnOPoOj53OqYRotc+44:fWkn0RSdu59s3nOPo8NOqdtX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 216B
- SHA256 7be2e816aa77bc10e3f5c5a32896521f667e708edaf59630e4df9f9ad84020cd
- MD5 e572e9edf75c963e9625c0f4b10b7de6
- SHA1 d32950a43d0824babcb14da3bd9ea27e7a78b2d3
- SHA512 3216817aeb95b736e28aa8a09a184264b6a4686e05491edb8678c0db443342523d768f8cd6725e765463a11a085781bee6e6c45feecd6bba101dddcedbc81e36
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 192B
- SHA256 9d10c7e8ce170a169b6c744733754444e629e69329e4a78c35b84aa94158eb26
- MD5 72e464181b8f82dbb277840f0050e452
- SHA1 92df4649ebcd9f3bec3bc78fcf80a11293ff102b
- SHA512 2bcdbc9888b524e2b85efaffe5688fb94967d7f595dedbbdccad6e091379c5bbbfa81bd975bdbe11bdea0ff09d61df27502ac6ca8448e68783d4c158a7bd1570
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\848fb3c3-b9f3-4dbb-b12e-ef42ba95decb.tmp
- Size 356B
- SHA256 c9659abd8bf0fcaf1b20d7c704031fd1b4baa57519d4377c7a664cd8bda4ea4a
- MD5 78694a24a703b1775622e6f53718bd09
- SHA1 529eae6f993cb52c5f9ed4d5646d10770a6dd805
- SHA512 c73599c7ac42c311bc12e6e8bc69a5a29be31b24e7e7065c2413f21e32ded8a2895b1c03a78919cca39d5460b71e487ad6897304ce535091898a5a32e2528951
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 c9982a33dd06ebcf8529541daaa4c00ac5e0a10a23fd2ce58d9956ff9aaf2eb1
- MD5 bbbe8d135c215460911e9fd6386c1faa
- SHA1 31c05bb82dcb654629039e4a767ddac2b249e403
- SHA512 e633fab441e05f8e5e5885fd3c3ecdee751b4ba013c35a20c2363db747ab03e31aac641f33252c4f35caf5d93672f18fb1857d04c928d6bca5477fdff0bdf442
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 356B
- SHA256 aa9c3d226406c462d32f29e1cb97af31c5b34f56539d8c23ed543a8e075fbc82
- MD5 2858bcff4de3cbc24790202b6b888712
- SHA1 a7f28a92c14edbba10496019e0e9a9239a5a6885
- SHA512 723552650849e5220df8405e01bfb00319335f70d86506d95bd32725c779b73fefb83802702e1f4468fd8381f5b3a2990f6fc16cd4977ab26c8a4022367d883d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 356B
- SHA256 0844665d0fd41b628c9a97df8bdbadf1f74ba4e6d0a3007eb147b29942edc82b
- MD5 42588df3786e1229deb82503d291119c
- SHA1 36b045d78503fdb2e7c34bd628d41a8c491ac7a4
- SHA512 cce18739f1dc3a86872db6018a98ecfbcdc3fa7b0f1036c9d8278fb220c7c273135125525c09e7cd36c22faeb5b3c711c707da9029c279ab4db79138eaa39255
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 9KB
- SHA256 d1d54e8928407b9451bb5164120727dfdbe8f8b4b625526322c83deaa6ea9c33
- MD5 bd987e317fc905a9ed053b92ed60223a
- SHA1 12a023368e9625095b33e367e223181d7a756cee
- SHA512 bcd64c23e1f30d3663c99754c913b327573293c2acbfb377340d460b61b5be8f20b6d039414aa1fa5723a0018e2b0e1ad94f434945745f62eb837e4fc55e477e
- SSDEEP 192:3HWVKiz4EeEJHV+Fdzk72Le46zhPo6yIsnVdg4:3HW5zxRG1k72Gzj4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 9KB
- SHA256 152d2ba27b8770678d0b6d0fb65b2a7d36fcd930be72e9d5db8594b74b671dec
- MD5 a7b6249dbf72282390b2c62b5068077f
- SHA1 72cc6bf3a99d2af05ea0fbcb2f44c526e0cbc7a3
- SHA512 14418155013c9c7a337903e522493d7d9f290958d6f238481da666f83faa364befef6238e0d774ced4851466abc04ef744fd7d666d65bbbdb52b0623ff66cbcd
- SSDEEP 192:oHWVKiz4Te5JHV+F/sEd2Le4mzhPo6yIsnVdg4:oHW5zXRGkEd2izj4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 9KB
- SHA256 29b889625a8e92f24b96e5dd7695fb01c410ba6866ec657b7d5961f5e4ec7d0a
- MD5 b5440e641bbdaa54d1381390e59b59aa
- SHA1 3e3394ae7aa4334c8c469d6a811f343ab2c23f3f
- SHA512 7c278061341d9750a830c35648197fa301a9411998efa45f2ab9d1bcb67b372be2541953d7337ae8b3494283776c007a096e4c094d80ba8d9047d2c5d53c652f
- SSDEEP 192:oHWVKiz4Ne5JHV+F/sEd2Le4mzhPo6yIsnVdg4:oHW5zpRGkEd2izj4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 9KB
- SHA256 ef6d086863613e802920889e094fb57646a3a1708c29b01ce74fc85c36378ded
- MD5 4196a440c8ee27e98d5566646c0693a2
- SHA1 b64c9754b50d7b3d27803e31ac93c0bfdda9b3ba
- SHA512 a0fd671fcce9de416883c7ca070dc14c385fe58ee6006f18020fbf98f5e9679ac5ce6ff284947b98aa6d52b262e034e10d63ba25a94c71c3c4945a973501e19a
- SSDEEP 192:3HWVKiz4ceEJHV+Fdzkc2Le4/zhPo6yIsnVdg4:3HW5z1RG1kc2rzj4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 8KB
- SHA256 5b3871d49cf8e0892d07f351642510e038389ee250b494913c7b5bb74547064e
- MD5 0275b85071a93c778c5a48dd3fc78a19
- SHA1 900b892e40506d18836bf48ff2565a37994dca31
- SHA512 9763d4e5cf8aba8ddc5eff6ceaa3f5a1ec40d5f3ca6ef98a391463bc41faba774cfb5dfef9f49092ededcb8a03d6b5077c2d6e2478db6e8dcd46428952833477
- SSDEEP 192:3HWVKiz4DejJHV+FRbY2Le4/zhPo6yIsnVdg4:3HW5zzRGR02rzj4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 9KB
- SHA256 8c9d33d23c4922b8d942ce31070eee1cc9010a981e5d9ab4ac5adc7fb93f8684
- MD5 b30996087d339c8b67141bda42ad9384
- SHA1 8fa9c06c31b585b56a9831b60e37129ff24ee67d
- SHA512 c3aedd35287be2256b49c19a7fbfc0b40e13e0b0808b038dc48e3c8ad34df1940db74816c8519182e57dfbe219f51cbf5b178c664a36528c208d3aa1da2dba99
- SSDEEP 192:oHWVKiz4Me5JHV+F/sEq2Le46zhPo6yIsnVdg4:oHW5zYRGkEq2Gzj4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 9KB
- SHA256 1e54ba4f5f3c801d9ab822955236617dacd8850cbcf94a432bb496e266cd8d3f
- MD5 a342850edc303952d691189f50a6602f
- SHA1 04712f183f68eb61f751711e09d07a736e7e0c64
- SHA512 e1bc367e02f04a7871f47914d74ad7644a4b3b0f4577dc9137421713ba6029536c2a6146a28f3621b462abb062f42f3e4e0fe62acb18ba8a928572f009cd6050
- SSDEEP 192:oHWVKiz4ke5JHV+F/sEd2Le4mzhPo6yIsnVdg4:oHW5zoRGkEd2izj4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 9KB
- SHA256 bc66f00f9633b64c523b41dacb617df1554df879d48656cd594c5193d27e232d
- MD5 f0719129b4abd514a9cfc0121278ff3a
- SHA1 a376c0caf8d85c091aa6065c47224fe509ce0f51
- SHA512 26b54de9162d42752093b9f1d97e9004e3e81cfbd71a99e9f28a882c34ce9d2377ea3c1f685da3743dc632267c259c09e92e603579cc3f7cc0be33e18efe0647
- SSDEEP 192:oHWVKiz4Pe5JHV+F/sEd2Le4mzhPo6yIsnVdg4:oHW5zrRGkEd2izj4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 15KB
- SHA256 1b458b3dd7616828529ea45762b08a38011ed80e63b07c8b2fbc966508a3799a
- MD5 85810830669e315abbac2d92c360a7b3
- SHA1 c78f86b7ef87da553d2b128f960295e17489e302
- SHA512 e40914fa9a15409698c3b48c566a80a7a248d17d2aceb9b3e1fdf8d23fbd0289b5ccf3fdb37be15f4e2f5b37e255954403b8129265375e3594eb5790735ed252
- SSDEEP 384:0s0c7pLhLc+ecFXvn1kXqKf/pUZNCgVLH2HfS8drUrRHGZT4Iba1x:0Zc7pLhLnDBvn1kXqKf/pUZNCgVLH2Hk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 201KB
- SHA256 acdde282e3de841ced12708dc14cee7bc042a78b8eece7bfc2cda3d402051868
- MD5 e146e52c035d5516b913f71558315166
- SHA1 200a6b3e59a24eace2684a80140dedf796c73147
- SHA512 7785bbb41a9aace315bf39b333b2c2e269619313e3d9648fe30b89e62601a9cc58795d4d1e4a00950dcfab5a8c22f544a72d3d08f29a89b802e100d92fbd3c1f
- SSDEEP 3072:ET7XQYfQcmzBm/NG/pNx0bYmcCTAfLWzGH03oe35YUG0TFrmf7lJaQodShMekK:EvXn4cmQlsO90f5U3o310MBdodSL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a5b2feaa-667a-48a1-b99b-cfcc8c3c4fdb.tmp
- Size 201KB
- SHA256 4930add73d2103f5ea579ef8eef1a8b23094d7a70bd02d2a137a0b4573143d12
- MD5 b39124cc78f1ea8ab69386176e4d10a2
- SHA1 0e5adfe29736a482d51eacb2119b66149d10f10f
- SHA512 340f709fb592003a6b80ef0c3444dcd87eca9724de006ea4c2aa51d4dfc7b78a8207bfd893aad334fcf05be037759415f7d2ba6d7fbdb773f56d445fe78aa5ec
- SSDEEP 3072:pT7XQYfQcmzBm/NG/pNx0bYmcCTAfLWzGH03oe35YUG0TFrmf7lJaQodShMekK:pvXn4cmQlsO90f5U3o310MBdodSL
- MD5 SHA1 SHA512 SSDEEP