Analysis
-
max time kernel
53s -
max time network
61s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29-10-2024 13:18
Static task
static1
Behavioral task
behavioral1
Sample
tp3host.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
tp3host.exe
Resource
win10v2004-20241007-en
General
-
Target
tp3host.exe
-
Size
5.0MB
-
MD5
fb08f2cb20523c34a7c01e2f565774a1
-
SHA1
212f6bb39ab33ea61abaf69e35da3449db39d1d8
-
SHA256
9a42637e8c5229a0b84c28892e030c5b9d07cd32ccb5bdc0cc6f0633113c8fe2
-
SHA512
c7e650e8b7d4f1ece36f1dd1427ee200ed824a032ea6b3452a5f3f68edca4605f5f94c5ee2730dcc9016c8d8fea355fddf2d47aecdf23e574cd431307d0d143d
-
SSDEEP
98304:Uj/lHucccKPaU8XiVvC+0NZFaQCATWzEBBP+mGB6:UblVchPIXiVKPPa0BBGmGB6
Malware Config
Extracted
vidar
https://t.me/fun88rockskek
https://t.me/asg7rd
https://steamcommunity.com/profiles/76561199794498376
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6
Extracted
vidar
8
Signatures
-
Detect Vidar Stealer 15 IoCs
Processes:
resource yara_rule behavioral2/memory/2524-19-0x0000000000920000-0x0000000000C20000-memory.dmp family_vidar_v7 behavioral2/memory/1276-10-0x0000000000400000-0x000000000091F000-memory.dmp family_vidar_v7 behavioral2/memory/1276-9-0x0000000000400000-0x000000000091F000-memory.dmp family_vidar_v7 behavioral2/memory/2524-7-0x0000000000920000-0x0000000000C20000-memory.dmp family_vidar_v7 behavioral2/memory/1276-8-0x0000000000400000-0x000000000091F000-memory.dmp family_vidar_v7 behavioral2/memory/2524-32-0x0000000000920000-0x0000000000C20000-memory.dmp family_vidar_v7 behavioral2/memory/2524-85-0x0000000000920000-0x0000000000C20000-memory.dmp family_vidar_v7 behavioral2/memory/2524-91-0x0000000000920000-0x0000000000C20000-memory.dmp family_vidar_v7 behavioral2/memory/2524-92-0x0000000000920000-0x0000000000C20000-memory.dmp family_vidar_v7 behavioral2/memory/2524-93-0x0000000000920000-0x0000000000C20000-memory.dmp family_vidar_v7 behavioral2/memory/2524-161-0x0000000000920000-0x0000000000C20000-memory.dmp family_vidar_v7 behavioral2/memory/2524-162-0x0000000000920000-0x0000000000C20000-memory.dmp family_vidar_v7 behavioral2/memory/2524-168-0x0000000000920000-0x0000000000C20000-memory.dmp family_vidar_v7 behavioral2/memory/2524-169-0x0000000000920000-0x0000000000C20000-memory.dmp family_vidar_v7 behavioral2/memory/2524-179-0x0000000000920000-0x0000000000C20000-memory.dmp family_vidar_v7 -
Vidar family
-
Downloads MZ/PE file
-
Uses browser remote debugging 2 TTPs 9 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
Processes:
msedge.exemsedge.exechrome.exechrome.exemsedge.exemsedge.exechrome.exechrome.exemsedge.exepid process 2880 msedge.exe 3172 msedge.exe 2352 chrome.exe 3468 chrome.exe 3392 msedge.exe 368 msedge.exe 2356 chrome.exe 4744 chrome.exe 4804 msedge.exe -
Loads dropped DLL 1 IoCs
Processes:
tp3host.exepid process 2524 tp3host.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
tp3host.exetp3host.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tp3host.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tp3host.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
tp3host.exemsedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 tp3host.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString tp3host.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msedge.exe -
Enumerates system info in registry 2 TTPs 8 IoCs
Processes:
chrome.exemsedge.exemsedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133746815828958049" chrome.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
tp3host.exechrome.exemsedge.exemsedge.exemsedge.exepid process 2524 tp3host.exe 2524 tp3host.exe 2524 tp3host.exe 2524 tp3host.exe 2352 chrome.exe 2352 chrome.exe 2524 tp3host.exe 2524 tp3host.exe 2524 tp3host.exe 2524 tp3host.exe 3696 msedge.exe 3696 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 3392 msedge.exe 3392 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 2524 tp3host.exe 2524 tp3host.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
chrome.exemsedge.exepid process 2352 chrome.exe 2352 chrome.exe 2352 chrome.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2352 chrome.exe Token: SeCreatePagefilePrivilege 2352 chrome.exe Token: SeShutdownPrivilege 2352 chrome.exe Token: SeCreatePagefilePrivilege 2352 chrome.exe Token: SeShutdownPrivilege 2352 chrome.exe Token: SeCreatePagefilePrivilege 2352 chrome.exe Token: SeShutdownPrivilege 2352 chrome.exe Token: SeCreatePagefilePrivilege 2352 chrome.exe Token: SeShutdownPrivilege 2352 chrome.exe Token: SeCreatePagefilePrivilege 2352 chrome.exe Token: SeShutdownPrivilege 2352 chrome.exe Token: SeCreatePagefilePrivilege 2352 chrome.exe Token: SeShutdownPrivilege 2352 chrome.exe Token: SeCreatePagefilePrivilege 2352 chrome.exe Token: SeShutdownPrivilege 2352 chrome.exe Token: SeCreatePagefilePrivilege 2352 chrome.exe Token: SeShutdownPrivilege 2352 chrome.exe Token: SeCreatePagefilePrivilege 2352 chrome.exe -
Suspicious use of FindShellTrayWindow 51 IoCs
Processes:
chrome.exemsedge.exepid process 2352 chrome.exe 2352 chrome.exe 2352 chrome.exe 2352 chrome.exe 2352 chrome.exe 2352 chrome.exe 2352 chrome.exe 2352 chrome.exe 2352 chrome.exe 2352 chrome.exe 2352 chrome.exe 2352 chrome.exe 2352 chrome.exe 2352 chrome.exe 2352 chrome.exe 2352 chrome.exe 2352 chrome.exe 2352 chrome.exe 2352 chrome.exe 2352 chrome.exe 2352 chrome.exe 2352 chrome.exe 2352 chrome.exe 2352 chrome.exe 2352 chrome.exe 2352 chrome.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
tp3host.exetp3host.exechrome.exedescription pid process target process PID 1276 wrote to memory of 2524 1276 tp3host.exe tp3host.exe PID 1276 wrote to memory of 2524 1276 tp3host.exe tp3host.exe PID 1276 wrote to memory of 2524 1276 tp3host.exe tp3host.exe PID 1276 wrote to memory of 2524 1276 tp3host.exe tp3host.exe PID 1276 wrote to memory of 2524 1276 tp3host.exe tp3host.exe PID 2524 wrote to memory of 2352 2524 tp3host.exe chrome.exe PID 2524 wrote to memory of 2352 2524 tp3host.exe chrome.exe PID 2352 wrote to memory of 2264 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 2264 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 3172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 1004 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 1004 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 1172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 1172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 1172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 1172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 1172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 1172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 1172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 1172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 1172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 1172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 1172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 1172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 1172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 1172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 1172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 1172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 1172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 1172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 1172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 1172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 1172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 1172 2352 chrome.exe chrome.exe PID 2352 wrote to memory of 1172 2352 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tp3host.exe"C:\Users\Admin\AppData\Local\Temp\tp3host.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\tp3host.exe"C:\Users\Admin\AppData\Local\Temp\tp3host.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"3⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff98c67cc40,0x7ff98c67cc4c,0x7ff98c67cc584⤵PID:2264
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2092,i,11770962788729021661,2253466914917153176,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1988 /prefetch:24⤵PID:3172
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1684,i,11770962788729021661,2253466914917153176,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2132 /prefetch:34⤵PID:1004
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2284,i,11770962788729021661,2253466914917153176,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2260 /prefetch:84⤵PID:1172
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3180,i,11770962788729021661,2253466914917153176,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3188 /prefetch:14⤵
- Uses browser remote debugging
PID:4744 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3208,i,11770962788729021661,2253466914917153176,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3228 /prefetch:14⤵
- Uses browser remote debugging
PID:2356 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4484,i,11770962788729021661,2253466914917153176,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4560 /prefetch:14⤵
- Uses browser remote debugging
PID:3468 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4724,i,11770962788729021661,2253466914917153176,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4576 /prefetch:84⤵PID:2712
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4740,i,11770962788729021661,2253466914917153176,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4712 /prefetch:84⤵PID:848
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4596,i,11770962788729021661,2253466914917153176,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4756 /prefetch:84⤵PID:4860
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4956,i,11770962788729021661,2253466914917153176,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4964 /prefetch:84⤵PID:4608
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"3⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:3392 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98aba46f8,0x7ff98aba4708,0x7ff98aba47184⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4808 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,17061748386381612640,2938212720175107532,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:24⤵PID:664
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,17061748386381612640,2938212720175107532,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:3696 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,17061748386381612640,2938212720175107532,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:84⤵PID:4580
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2136,17061748386381612640,2938212720175107532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:14⤵
- Uses browser remote debugging
PID:4804 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2136,17061748386381612640,2938212720175107532,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:14⤵
- Uses browser remote debugging
PID:2880 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2136,17061748386381612640,2938212720175107532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:14⤵
- Uses browser remote debugging
PID:368 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2136,17061748386381612640,2938212720175107532,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:14⤵
- Uses browser remote debugging
PID:3172 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,17061748386381612640,2938212720175107532,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:24⤵PID:1732
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:436
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2680
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
676KB
MD5eda18948a989176f4eebb175ce806255
SHA1ff22a3d5f5fb705137f233c36622c79eab995897
SHA25681a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4
SHA512160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85
-
Filesize
649B
MD55aa6ca8de27686531a9bb62dd86601ce
SHA171b3966e8d3ddffac253608c5258146dc9b3c37e
SHA25660815b20a82d3d68eb535b5becc1962258906c677747f43adcea8c231b3cb05e
SHA5122b50ea6abfd72c0c4324251c9923b5f80e9d23cddfe3fa7e45e980c0416d9c87601aaf286ddafab30681ff003e550f85bc850b5a47fad4363abbc1a260b6f3b7
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\ca531c0b-28cb-409e-9c75-5a6a9ed16da4.dmp
Filesize826KB
MD5ac3dd13e680da30622068dd733d1caae
SHA1d3938f97b1ed7c4b61a3a508ede3944b7c2c7b7d
SHA256189aad4f6a977563511e9cdccf57b8277b92b7da5e7eb00e4a1a7fa53bca3673
SHA51217d07498d54773e6a7c19a0c3e31c8e6cb72779fe1434ee08c45b75e227b97aa96c39dc65427016932ac88ca8054a117f4ab94bf68322ed61e5b69a9f64f2f6e
-
Filesize
152B
MD534d2c4f40f47672ecdf6f66fea242f4a
SHA14bcad62542aeb44cae38a907d8b5a8604115ada2
SHA256b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33
SHA51250fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6
-
Filesize
152B
MD58749e21d9d0a17dac32d5aa2027f7a75
SHA1a5d555f8b035c7938a4a864e89218c0402ab7cde
SHA256915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304
SHA512c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a
-
Filesize
152B
MD55b8bd87dde0cc5415457ba5d8e779d94
SHA14c867f45cdfe9c3d341abb2cf0d3fb5e7e86b629
SHA2568c980457756804d913f2000b32be4afcfacd09feca652e3affec83471dd731f6
SHA512c269795f8ba5e891fab7cbf112b679b0a3501a3dae3f4fe5993de74c2a26375248ec8a95152d505bfd9499077d54bb0dd0e81b6818727b8a0ac02772dbbc0215
-
Filesize
5KB
MD5d9df06aee8a690713b4411784771f509
SHA1d9fcb99cf647a628138a06c97fa0e6cfb024546d
SHA2561b0fcf204b787947f9d73e940b21de91f5abd9c75315d238676bca75140c076c
SHA512f463305c85c1a138a359e0c4e88b1889facbef42881685d73053e6a4781958dda254b2611f92a5265b6cc7bbd8d5cf981be7b473e6da65ff59611929848af698
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e