aurora | 33fc61e81efa609df51277aef261623bb291e2dd5359362d50070f7a441df0ad

Analysis

max time kernel
57s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30-08-2024 09:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Aurora.exe
Size

25.2MB
MD5

1504c863a05885816d2c8874137ae7a7
SHA1

5b16d440a7e9b5887886549f016f252900b5c0ac
SHA256

33fc61e81efa609df51277aef261623bb291e2dd5359362d50070f7a441df0ad
SHA512

055d2650ac996443130c05a742bcaabc576dbde29cc21ea956f66132f7e6da8a5771beb9cd51ff2384b2230ebe68990b35d8b14611613db2b8d2764846a487f9
SSDEEP

196608:olxc7zJltMVP1nQf6CmuZdgh7vq5esz6xSle:WqzFANQf6CmuEh7vqvz6xSs

Score

10^/10

aurora shurk discovery infostealer stealer

Malware Config

Signatures

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora
Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
infostealer shurk

Shurk Stealer payload 3 IoCs

resource	yara_rule
behavioral2/memory/1148-26-0x00007FF6B8010000-0x00007FF6B98DF000-memory.dmp	shurk_stealer
behavioral2/memory/5000-67-0x00007FF6B8010000-0x00007FF6B98DF000-memory.dmp	shurk_stealer
behavioral2/memory/1148-86-0x00007FF6B8010000-0x00007FF6B98DF000-memory.dmp	shurk_stealer

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133694846508794494"	chrome.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Aurora.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Aurora.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Aurora.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2976	chrome.exe
2976	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 800	2976	chrome.exe	96
PID 2976 wrote to memory of 800	2976	chrome.exe	96
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 396	2976	chrome.exe	98
PID 2976 wrote to memory of 3952	2976	chrome.exe	99
PID 2976 wrote to memory of 3952	2976	chrome.exe	99
PID 2976 wrote to memory of 1192	2976	chrome.exe	100
PID 2976 wrote to memory of 1192	2976	chrome.exe	100
PID 2976 wrote to memory of 1192	2976	chrome.exe	100
PID 2976 wrote to memory of 1192	2976	chrome.exe	100
PID 2976 wrote to memory of 1192	2976	chrome.exe	100
PID 2976 wrote to memory of 1192	2976	chrome.exe	100
PID 2976 wrote to memory of 1192	2976	chrome.exe	100
PID 2976 wrote to memory of 1192	2976	chrome.exe	100
PID 2976 wrote to memory of 1192	2976	chrome.exe	100
PID 2976 wrote to memory of 1192	2976	chrome.exe	100
PID 2976 wrote to memory of 1192	2976	chrome.exe	100
PID 2976 wrote to memory of 1192	2976	chrome.exe	100
PID 2976 wrote to memory of 1192	2976	chrome.exe	100
PID 2976 wrote to memory of 1192	2976	chrome.exe	100
PID 2976 wrote to memory of 1192	2976	chrome.exe	100
PID 2976 wrote to memory of 1192	2976	chrome.exe	100
PID 2976 wrote to memory of 1192	2976	chrome.exe	100
PID 2976 wrote to memory of 1192	2976	chrome.exe	100
PID 2976 wrote to memory of 1192	2976	chrome.exe	100
PID 2976 wrote to memory of 1192	2976	chrome.exe	100
PID 2976 wrote to memory of 1192	2976	chrome.exe	100
PID 2976 wrote to memory of 1192	2976	chrome.exe	100
PID 2976 wrote to memory of 1192	2976	chrome.exe	100
PID 2976 wrote to memory of 1192	2976	chrome.exe	100
PID 2976 wrote to memory of 1192	2976	chrome.exe	100
PID 2976 wrote to memory of 1192	2976	chrome.exe	100
PID 2976 wrote to memory of 1192	2976	chrome.exe	100
PID 2976 wrote to memory of 1192	2976	chrome.exe	100
PID 2976 wrote to memory of 1192	2976	chrome.exe	100
PID 2976 wrote to memory of 1192	2976	chrome.exe	100

C:\Users\Admin\AppData\Local\Temp\Aurora.exe
"C:\Users\Admin\AppData\Local\Temp\Aurora.exe"
1⤵
PID:1148

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffff3e6cc40,0x7ffff3e6cc4c,0x7ffff3e6cc58
  2⤵
  PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2152,i,15789868041281780167,9153039986786868855,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1948,i,15789868041281780167,9153039986786868855,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  PID:3952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2236,i,15789868041281780167,9153039986786868855,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,15789868041281780167,9153039986786868855,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3196,i,15789868041281780167,9153039986786868855,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4440,i,15789868041281780167,9153039986786868855,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4472 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4856,i,15789868041281780167,9153039986786868855,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4892 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4940,i,15789868041281780167,9153039986786868855,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  PID:244

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:5040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3424

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1256

C:\Users\Admin\AppData\Local\Temp\Aurora.exe
"C:\Users\Admin\AppData\Local\Temp\Aurora.exe"
1⤵
- Modifies system certificate store
PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
af6f13148129064a00e4dedd8429f731

SHA1
95f39dbcdc925d09fe824e10dcb823062a1bdf73

SHA256
776fbefbf98eb0edecb876b6562c49ecb3262757b10b5eca611af0efba502b7e

SHA512
18047d5ceb54c77696ed0c91507bf05f1e66090732f68f4fe1b62a305f011d4f19631316f4d2f4f8e2f9612ebfd4bc7fe399e65c4c2480b5b91151a24b0b02ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
7e8d2245b881be263bdaf19d5fb05ff0

SHA1
309ddc923e6da98a15a21f1ddb34f45b71fd239a

SHA256
40bf767613c4f2d34a7d4fe8b70870e685a6a97a5bfa581fbd7946b13ce6d668

SHA512
67ebe29110db3d38f3185541a736e1f89e786f55ca07f5a6c5b45072ed0e0c963f40e9de8b65a5b0eef2fa0df67bd5dcc7d52a8f41f34d40aac5b7566d93fdc1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
b12a985135e410611f1f66ba50096d6c

SHA1
cb6a223e04486287496d7c7a79b1f68f4c89e387

SHA256
0f3011bb4d619ea9785a67af92a0ab10f45197d41ef856ff524bbce3fe2c014d

SHA512
563e8962b85e8ee42119fa41c3ff78bf988eac3f0119be48e113591e014b984dd7fa8ce9d7e3882b02bcd892d37db04a2d2287bb27d34c42f95360b121837d88

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1e927eed50e3b3e41766ece235970ed4

SHA1
2b27b62494052532dca41a064ae9d944dfe85fae

SHA256
cc38840b930f5f18b3c8b7f7c34e2501f14db4a7094eed56bd85a9c6a7f214d4

SHA512
97ae99040f11427b072f9a3c117613c6a5dea498b0397547c1afc9afec80b7292f566f320cc627760039244dbda4b52fd2c1c725defa55f731078ea21aed257e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
515139af0940115fe00e3225f3992101

SHA1
e4f3872948c2f2ebecaa5087a4170e6e1ffdb31c

SHA256
d035ccd6d0a0d46bb2bb8ec0138d4f70a070ccbf4538beb5cc636edc6cec45de

SHA512
1482a2c07935e492566ee39430ca953f09b218d9aed33d4dfd50c333f92db7b8d68c57c8cc8ad203c291f886ce0789a5bbb62b8d012e7296f1ace0e9c75bd0f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
513ae1676744c46033d544122014e1df

SHA1
dfcdc9e5b3969bf9114ad50e039d6bd423903d34

SHA256
052a39637f6b016729fd48b9bc7d3a1f6214db59d79ce9edf1c6089e41800998

SHA512
d6e3f591497942dd3be6a341e193c9947e702cf1b892f13bfe8f7131653d3a4343846e630dffe73f2c0e8456dbe30e3d8bca276eb5e99026047c22786fe2faf0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
204KB

MD5
dac7a204606ab5727f3a728f7cd8a1df

SHA1
c7cd15ef5549f5a331167f9d19f8ee4dc945ae25

SHA256
f0304590bc493956a76abbfa47dd781a44ef8c676870ae31f43fc326bf8a4f9a

SHA512
bf7f9b357d6a99bcfdc82a655605b1519cb169c290ed349fe93fd60968a526f57b3ebd34c7e6fefed49c1975d5b497d11ed17c698e9142655f044f1f92bc6deb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
204KB

MD5
86ddf4b81f18fef69a833e5fd0fb15a4

SHA1
a9bffa410f6655541f7f0f2f8c7bf5d9b8641fab

SHA256
6e51cb378414695ef9d8a8c80aee765058018e566023c9a2c885cf4fab5cbc42

SHA512
51b9bbc13766362aa037ddec2bdf519d2b4814c5380c68a7a4a732177a32089cdb912bb5b142ddb18b96662e00aa7810045593327ef47601d1bee938b8377a5f

Download Submit
memory/1148-26-0x00007FF6B8010000-0x00007FF6B98DF000-memory.dmp

Filesize
24.8MB

Download
memory/1148-86-0x00007FF6B8010000-0x00007FF6B98DF000-memory.dmp

Filesize
24.8MB

Download
memory/5000-67-0x00007FF6B8010000-0x00007FF6B98DF000-memory.dmp

Filesize
24.8MB

Download