socelars | 3673f09e36c44e87ce76082c900906e8abf001a9e3459ab1cf995cdf9c1de54f

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
31-08-2024 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Size

1.4MB
MD5

6ed21f7aa1df0769e185b6dba72084f9
SHA1

0cb7edceb3b79b6e723144789b4c6549daa57f05
SHA256

34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1
SHA512

bbfb5f5660b185ef5cf3ff141d36f0f88c427eca9fe4996b82fbc0f340944bbb3fc2dccce45da1445e76b3f63ecdacfa73ed932d444dcb13abb256073c815737
SSDEEP

24576:axpXPaR2J33o3S7P5zuHHOF26ufehMHsGKzOYffEMSXkdOZ1w6:apy+VDr8rCHSXuOZu6

Score

10^/10

socelars credential_access discovery spyware stealer

Malware Config

Signatures

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops Chrome extension 1 IoCs

Processes:

34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\manifest.json	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
28	iplogger.org
29	iplogger.org

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Drops file in System32 directory 2 IoCs

Processes:

chrome.exe

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exetaskkill.exe34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

evasion

Processes:

taskkill.exe

pid	Process
2896	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133695807317901031"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

chrome.exechrome.exe

pid	Process
1988	chrome.exe
1988	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid	Process
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exetaskkill.exechrome.exe

description	pid	Process
Token: SeCreateTokenPrivilege	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: SeAssignPrimaryTokenPrivilege	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: SeLockMemoryPrivilege	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: SeIncreaseQuotaPrivilege	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: SeMachineAccountPrivilege	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: SeTcbPrivilege	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: SeSecurityPrivilege	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: SeTakeOwnershipPrivilege	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: SeLoadDriverPrivilege	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: SeSystemProfilePrivilege	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: SeSystemtimePrivilege	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: SeProfSingleProcessPrivilege	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: SeIncBasePriorityPrivilege	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: SeCreatePagefilePrivilege	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: SeCreatePermanentPrivilege	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: SeBackupPrivilege	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: SeRestorePrivilege	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: SeShutdownPrivilege	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: SeDebugPrivilege	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: SeAuditPrivilege	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: SeSystemEnvironmentPrivilege	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: SeChangeNotifyPrivilege	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: SeRemoteShutdownPrivilege	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: SeUndockPrivilege	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: SeSyncAgentPrivilege	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: SeEnableDelegationPrivilege	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: SeManageVolumePrivilege	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: SeImpersonatePrivilege	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: SeCreateGlobalPrivilege	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: 31	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: 32	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: 33	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: 34	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: 35	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
Token: SeDebugPrivilege	2896	taskkill.exe
Token: SeShutdownPrivilege	1988	chrome.exe
Token: SeCreatePagefilePrivilege	1988	chrome.exe
Token: SeShutdownPrivilege	1988	chrome.exe
Token: SeCreatePagefilePrivilege	1988	chrome.exe
Token: SeShutdownPrivilege	1988	chrome.exe
Token: SeCreatePagefilePrivilege	1988	chrome.exe
Token: SeShutdownPrivilege	1988	chrome.exe
Token: SeCreatePagefilePrivilege	1988	chrome.exe
Token: SeShutdownPrivilege	1988	chrome.exe
Token: SeCreatePagefilePrivilege	1988	chrome.exe
Token: SeShutdownPrivilege	1988	chrome.exe
Token: SeCreatePagefilePrivilege	1988	chrome.exe
Token: SeShutdownPrivilege	1988	chrome.exe
Token: SeCreatePagefilePrivilege	1988	chrome.exe
Token: SeShutdownPrivilege	1988	chrome.exe
Token: SeCreatePagefilePrivilege	1988	chrome.exe
Token: SeShutdownPrivilege	1988	chrome.exe
Token: SeCreatePagefilePrivilege	1988	chrome.exe
Token: SeShutdownPrivilege	1988	chrome.exe
Token: SeCreatePagefilePrivilege	1988	chrome.exe
Token: SeShutdownPrivilege	1988	chrome.exe
Token: SeCreatePagefilePrivilege	1988	chrome.exe
Token: SeShutdownPrivilege	1988	chrome.exe
Token: SeCreatePagefilePrivilege	1988	chrome.exe
Token: SeShutdownPrivilege	1988	chrome.exe
Token: SeCreatePagefilePrivilege	1988	chrome.exe
Token: SeShutdownPrivilege	1988	chrome.exe
Token: SeCreatePagefilePrivilege	1988	chrome.exe
Token: SeShutdownPrivilege	1988	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	Process
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	Process
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.execmd.exechrome.exe

description	pid	Process	procid_target
PID 4392 wrote to memory of 688	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe	87
PID 4392 wrote to memory of 688	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe	87
PID 4392 wrote to memory of 688	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe	87
PID 688 wrote to memory of 2896	688	cmd.exe	89
PID 688 wrote to memory of 2896	688	cmd.exe	89
PID 688 wrote to memory of 2896	688	cmd.exe	89
PID 4392 wrote to memory of 1988	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe	95
PID 4392 wrote to memory of 1988	4392	34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe	95
PID 1988 wrote to memory of 4200	1988	chrome.exe	96
PID 1988 wrote to memory of 4200	1988	chrome.exe	96
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 2468	1988	chrome.exe	97
PID 1988 wrote to memory of 3632	1988	chrome.exe	98
PID 1988 wrote to memory of 3632	1988	chrome.exe	98
PID 1988 wrote to memory of 1872	1988	chrome.exe	99
PID 1988 wrote to memory of 1872	1988	chrome.exe	99
PID 1988 wrote to memory of 1872	1988	chrome.exe	99
PID 1988 wrote to memory of 1872	1988	chrome.exe	99
PID 1988 wrote to memory of 1872	1988	chrome.exe	99
PID 1988 wrote to memory of 1872	1988	chrome.exe	99
PID 1988 wrote to memory of 1872	1988	chrome.exe	99
PID 1988 wrote to memory of 1872	1988	chrome.exe	99
PID 1988 wrote to memory of 1872	1988	chrome.exe	99
PID 1988 wrote to memory of 1872	1988	chrome.exe	99
PID 1988 wrote to memory of 1872	1988	chrome.exe	99
PID 1988 wrote to memory of 1872	1988	chrome.exe	99
PID 1988 wrote to memory of 1872	1988	chrome.exe	99
PID 1988 wrote to memory of 1872	1988	chrome.exe	99
PID 1988 wrote to memory of 1872	1988	chrome.exe	99
PID 1988 wrote to memory of 1872	1988	chrome.exe	99
PID 1988 wrote to memory of 1872	1988	chrome.exe	99
PID 1988 wrote to memory of 1872	1988	chrome.exe	99
PID 1988 wrote to memory of 1872	1988	chrome.exe	99
PID 1988 wrote to memory of 1872	1988	chrome.exe	99
PID 1988 wrote to memory of 1872	1988	chrome.exe	99
PID 1988 wrote to memory of 1872	1988	chrome.exe	99

C:\Users\Admin\AppData\Local\Temp\34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe
"C:\Users\Admin\AppData\Local\Temp\34c3f1bc4872912b7fcc4ca0c0b4825fcee90df86d9218c8c7d557f852ed3af1.exe"
1⤵
- Drops Chrome extension
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:688
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffda2e1cc40,0x7ffda2e1cc4c,0x7ffda2e1cc58
    3⤵
    PID:4200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1636,i,11191744852220879216,3933418243000187186,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1776 /prefetch:2
    3⤵
    PID:2468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2176,i,11191744852220879216,3933418243000187186,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2208 /prefetch:3
    3⤵
    PID:3632
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2272,i,11191744852220879216,3933418243000187186,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2320 /prefetch:8
    3⤵
    PID:1872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3120,i,11191744852220879216,3933418243000187186,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3140 /prefetch:1
    3⤵
    PID:4572
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3164,i,11191744852220879216,3933418243000187186,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3184 /prefetch:1
    3⤵
    PID:1496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4544,i,11191744852220879216,3933418243000187186,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3848 /prefetch:1
    3⤵
    PID:4988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4684,i,11191744852220879216,3933418243000187186,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4868 /prefetch:8
    3⤵
    PID:2928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4664,i,11191744852220879216,3933418243000187186,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4656 /prefetch:8
    3⤵
    PID:3224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4876,i,11191744852220879216,3933418243000187186,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4900 /prefetch:8
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    PID:3752

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
33aded33131ca25664bb6aab04a27d6a

SHA1
ef2372eb75a5bda5b7a35b7787e9b32e71ac574c

SHA256
5d9941acd254a83568a1850b2b98e72f768240dc92b71b0a67e2bf618705da65

SHA512
e4422e1b109aac9eadf869bb4f7fc59ae7a88bbd8afdd25ba3411427bed28a0a029965c19ceb9f2cc65953ffb4695977b70b6c64d57237e4e3bff9bf3f788618

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
98fd5598c9a1375f04a88299178be91f

SHA1
8ce35ef7b0836c389c77e66c39486a7fe3bdba92

SHA256
031da8b3f3156d1dc63bbb7ab6aca44d204d1244f856ec4b57a06a01c33ab6bf

SHA512
efdcf62bb86fdcb90bf6f428beea70ca34c5aa88208e0cd206abe08958f8d11eca5c7b5bfaa52fdce6ba12bd7efdd7e4972b36a57e856db86ff58ebdf2459fd7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
4817c31315b4f22bf3683c588c8bed10

SHA1
7fee066a90fa43f1ca94e7ccb186ea1d379a6bbe

SHA256
7e614ba3b5cecadfb5346bdab9dc487a27fb0feda8d0d9075709de6984dbc478

SHA512
d833277ed961e30df9104f5b334997f83b66eb34f8ac00141773c1c9c19fa98458b87f52fdc3eaf0b1b9164a73fa0d688596f434f161d7b8346bac25b2e901c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
58f2316984d0c51309023adab47257f5

SHA1
751bd5dbc979275b6f235aa5ff60c9b7b70ec761

SHA256
68999308c11fbaf947573c36eab5da35cae5fd9b97881d1909a133ed904a1d5a

SHA512
64c34783b8fc3974650326aa2817b37b1169c47b032701c399860aa26f482ecd519bc55111e75ed61f3d16b331826657b7d2d00ae41dbe668d49f45174d0ee08

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7096f64b55eeb39ae6cde9425549f18c

SHA1
25730ce4c512bc69ff9d57a827b7d03391fb9373

SHA256
1d85c4f52334a59ea81318df50f6257efef553664cda9684a3e1c03cd1ea4c71

SHA512
559cce244b144a7349d23c90b52dc5e3f9da4b7f7c1370bef6eebe9962737f591d5cb9d2bf6364585e8c07813249c812f3f0d46a88c78cb767173cda0bacbf5f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
0ff0c9e148cb9520d0b23757cb15a83b

SHA1
1d880c1aa2c034cffe5e983f810975386d6fee3e

SHA256
9258de244aecb76e5227728ca76697cc7a53ec4e0bd40703c15e842eb954e180

SHA512
bb8a1b797e621b9145c6173597d1776ca79105ca1309d54e0fc782780eff1117b095911e21e32a578c7e33c5cd1ddd6e0199c6338150b4b19f291bc16c272395

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b26d33a47c26516c205875c038aae5c8

SHA1
a80bf581dbb82b02985d1e7e3edf69cb6924d94b

SHA256
911327d6ca9dc19e1db731713cbbd076915c635fa9c2fc37537f0b867019add2

SHA512
9b7516129673d2ef06e0819e0a7ac05615d90795a10454ee93a943d4225ebc23a539979f4aab5ac0143dd873e98e88a438e2baaced8ecaaf69463cca872040a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e73577438b46f87b7f86a2520f42ba92

SHA1
b01a11b9c5154643c54402114f44833f075f1968

SHA256
e4c03c8ffdad58bec0b67767911da5f65f4102023597fd5050d470175be39658

SHA512
4be145a4759ca48660231e68e54efbd9a00358cb44acfbc04f2a05c7f2850482347432b65bafe365a8ece84ecb84583eef82ffa8582a9cc3f6a46ec7f7a9b3eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8ab095a6c38b7f0e00dd0001b4c031be

SHA1
13d8da7c7806c7064ca0ed63335fd8328ae0599a

SHA256
0ea77e24785a81358deb762f0a25a5447510939907d04793a253bc4c9da3d440

SHA512
c55a3c42f875dfcc262dec41c6b8fdd5d4fcd3cf167fa4c9c60a906ff5b4548efc51b01139d53497d28fc0157350bd2877168760d01537d902e1ae37535f3dba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
18KB

MD5
7474d47adf69d4781b7ed33242dbc4fa

SHA1
3ca4001ef5d9798bb315277a126bfd625b9d0da8

SHA256
cc99758ed278672db71a331d3ef0317395b85e456d9f474d6fcd6976707e835f

SHA512
47270240f2034fbbdc68f7cc75bc990f231abd7565f002f8ea99cde46485cf286c180a64b077f48d4837e226afaea983ffa2e4f9257610f0ba29d2639f81d7f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
19KB

MD5
864140d068a7d09f888c76715707a61b

SHA1
1061a4f7e9250e9d9bfaa6b2f455f96013bd0999

SHA256
62f1d9ae8e46eb83c903dd96aaa41c91f2f40ed41dc1dbb10fffe11cb5271601

SHA512
1809b9438f23eb2a9e60fd33772d06eea9fbeaa98acf70fdb7fdbd8a6d33f0f7eccf178fc3973eca04984e189699645757c290023e8f413119c13832f60b123c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
205KB

MD5
4d929bd50c2db1d6ec688adcff9241f3

SHA1
5f443014e507e58cd8dc780455af69b578274088

SHA256
082798681f1152fe9120fa022ef54690ebc73dfc71ab8e69ecd652f68a3030cd

SHA512
14fc7c65fbb5841dc945f3924dcb6176b84c6a9ed22861951812e0ad7fd658fac99ac342f11986082fec8810e7b327cc862a2a2ff9b52611c9bb29ce5f2eae96

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
205KB

MD5
6717a87152fdec504153e4e13b3a7080

SHA1
6a76e88704fbbd01643134c08493786b44380cb5

SHA256
d0ef0ae5374f380eebfaa1c1972013331ae46a2016700e2b3d7e5b080013bbbc

SHA512
d307397916fe88236d1db3c49045c2623e8e5da9dc67f9f8c9506077810016d4a1a5c714a972e8810b68c01f05b6f4927f04bc9414bfe77e2b2c6eabaa5ac41a

Download Submit
\??\pipe\crashpad_1988_SPWACBGCNABBYKER

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit