Analysis
-
max time kernel
177s -
max time network
205s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
10-11-2024 09:55
Static task
static1
Behavioral task
behavioral1
Sample
Unlock_Tool_v2.5.6.rar
Resource
win11-20241007-en
General
-
Target
Unlock_Tool_v2.5.6.rar
-
Size
49.7MB
-
MD5
720f68e1a57f1881b0dcbfecdfc0b3bf
-
SHA1
7662d996406bbd32ea2baa20ae469321bc87ee2d
-
SHA256
edf2f2b1325eff120bef7a2414e367cd60efcc8d4256ba884d753cda39b1f381
-
SHA512
9e58a26de7fffe731bba8625529b811475a03b60860e705e4cbb51eb9ba7fa060731e93d8fee271adda12e6d7a370277ede27dd7afaf449f06d99795d3a46cd1
-
SSDEEP
1572864:7aM2esxP+a3sRkaLwu/0WBJAZ229eBddBe7EDfNMAG:eMna8Pwa0m222Sd26vG
Malware Config
Extracted
vidar
https://t.me/gos90t
https://steamcommunity.com/profiles/76561199800374635
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6
Signatures
-
Detect Vidar Stealer 21 IoCs
resource yara_rule behavioral1/memory/1308-626-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/1308-627-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/1308-629-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/1308-649-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/1308-650-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/1308-657-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/1308-658-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/1308-1085-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/1308-1086-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/1308-1093-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/1308-1100-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/1308-1101-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/1308-1102-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/1308-1156-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/1308-1157-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/1308-1164-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/1308-1170-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/1308-1188-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/1308-1189-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/1308-1196-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/1308-1197-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 -
Vidar family
-
Downloads MZ/PE file
-
Uses browser remote debugging 2 TTPs 10 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 432 chrome.exe 4324 chrome.exe 3252 chrome.exe 3396 chrome.exe 2120 msedge.exe 1696 msedge.exe 3468 msedge.exe 3436 msedge.exe 2692 msedge.exe 236 chrome.exe -
Executes dropped EXE 3 IoCs
pid Process 1708 Unlock_Tool_v2.5.6.exe 4292 Unlock_Tool_v2.5.6.exe 1308 Unlock_Tool_v2.5.6.exe -
Loads dropped DLL 2 IoCs
pid Process 1308 Unlock_Tool_v2.5.6.exe 1308 Unlock_Tool_v2.5.6.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1708 set thread context of 1308 1708 Unlock_Tool_v2.5.6.exe 84 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1044 1708 WerFault.exe 79 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unlock_Tool_v2.5.6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unlock_Tool_v2.5.6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Unlock_Tool_v2.5.6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Unlock_Tool_v2.5.6.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2840 timeout.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133757062716909784" chrome.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ 7zFM.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ 7zFM.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 1308 Unlock_Tool_v2.5.6.exe 1308 Unlock_Tool_v2.5.6.exe 1308 Unlock_Tool_v2.5.6.exe 1308 Unlock_Tool_v2.5.6.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 1308 Unlock_Tool_v2.5.6.exe 1308 Unlock_Tool_v2.5.6.exe 1308 Unlock_Tool_v2.5.6.exe 1308 Unlock_Tool_v2.5.6.exe 3772 msedge.exe 3772 msedge.exe 2120 msedge.exe 2120 msedge.exe 1308 Unlock_Tool_v2.5.6.exe 1308 Unlock_Tool_v2.5.6.exe 1308 Unlock_Tool_v2.5.6.exe 1308 Unlock_Tool_v2.5.6.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2312 7zFM.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeRestorePrivilege 2312 7zFM.exe Token: 35 2312 7zFM.exe Token: SeSecurityPrivilege 2312 7zFM.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe -
Suspicious use of FindShellTrayWindow 53 IoCs
pid Process 2312 7zFM.exe 2312 7zFM.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1708 wrote to memory of 4292 1708 Unlock_Tool_v2.5.6.exe 83 PID 1708 wrote to memory of 4292 1708 Unlock_Tool_v2.5.6.exe 83 PID 1708 wrote to memory of 4292 1708 Unlock_Tool_v2.5.6.exe 83 PID 1708 wrote to memory of 1308 1708 Unlock_Tool_v2.5.6.exe 84 PID 1708 wrote to memory of 1308 1708 Unlock_Tool_v2.5.6.exe 84 PID 1708 wrote to memory of 1308 1708 Unlock_Tool_v2.5.6.exe 84 PID 1708 wrote to memory of 1308 1708 Unlock_Tool_v2.5.6.exe 84 PID 1708 wrote to memory of 1308 1708 Unlock_Tool_v2.5.6.exe 84 PID 1708 wrote to memory of 1308 1708 Unlock_Tool_v2.5.6.exe 84 PID 1708 wrote to memory of 1308 1708 Unlock_Tool_v2.5.6.exe 84 PID 1708 wrote to memory of 1308 1708 Unlock_Tool_v2.5.6.exe 84 PID 1708 wrote to memory of 1308 1708 Unlock_Tool_v2.5.6.exe 84 PID 1708 wrote to memory of 1308 1708 Unlock_Tool_v2.5.6.exe 84 PID 1308 wrote to memory of 3252 1308 Unlock_Tool_v2.5.6.exe 89 PID 1308 wrote to memory of 3252 1308 Unlock_Tool_v2.5.6.exe 89 PID 3252 wrote to memory of 5004 3252 chrome.exe 90 PID 3252 wrote to memory of 5004 3252 chrome.exe 90 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2664 3252 chrome.exe 91 PID 3252 wrote to memory of 2692 3252 chrome.exe 92 PID 3252 wrote to memory of 2692 3252 chrome.exe 92 PID 3252 wrote to memory of 4732 3252 chrome.exe 93 PID 3252 wrote to memory of 4732 3252 chrome.exe 93 PID 3252 wrote to memory of 4732 3252 chrome.exe 93 PID 3252 wrote to memory of 4732 3252 chrome.exe 93 PID 3252 wrote to memory of 4732 3252 chrome.exe 93 PID 3252 wrote to memory of 4732 3252 chrome.exe 93 PID 3252 wrote to memory of 4732 3252 chrome.exe 93 PID 3252 wrote to memory of 4732 3252 chrome.exe 93 PID 3252 wrote to memory of 4732 3252 chrome.exe 93 PID 3252 wrote to memory of 4732 3252 chrome.exe 93 PID 3252 wrote to memory of 4732 3252 chrome.exe 93 PID 3252 wrote to memory of 4732 3252 chrome.exe 93 PID 3252 wrote to memory of 4732 3252 chrome.exe 93 PID 3252 wrote to memory of 4732 3252 chrome.exe 93 PID 3252 wrote to memory of 4732 3252 chrome.exe 93
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_v2.5.6.rar"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2312
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2608
-
C:\Users\Admin\Downloads\Unlock_Tool_v2.5.6.exe"C:\Users\Admin\Downloads\Unlock_Tool_v2.5.6.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\Downloads\Unlock_Tool_v2.5.6.exe"C:\Users\Admin\Downloads\Unlock_Tool_v2.5.6.exe"2⤵
- Executes dropped EXE
PID:4292
-
-
C:\Users\Admin\Downloads\Unlock_Tool_v2.5.6.exe"C:\Users\Admin\Downloads\Unlock_Tool_v2.5.6.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"3⤵
- Uses browser remote debugging
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffa26acc40,0x7fffa26acc4c,0x7fffa26acc584⤵PID:5004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1816,i,16977295942449136077,16651642680265418126,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1808 /prefetch:24⤵PID:2664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2080,i,16977295942449136077,16651642680265418126,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2348 /prefetch:34⤵PID:2692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2112,i,16977295942449136077,16651642680265418126,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2384 /prefetch:84⤵PID:4732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3172,i,16977295942449136077,16651642680265418126,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3192 /prefetch:14⤵
- Uses browser remote debugging
PID:236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3224,i,16977295942449136077,16651642680265418126,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3232 /prefetch:14⤵
- Uses browser remote debugging
PID:432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3812,i,16977295942449136077,16651642680265418126,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4512 /prefetch:14⤵
- Uses browser remote debugging
PID:3396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4636,i,16977295942449136077,16651642680265418126,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4544 /prefetch:84⤵PID:2736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4780,i,16977295942449136077,16651642680265418126,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4796 /prefetch:84⤵PID:4588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4668,i,16977295942449136077,16651642680265418126,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4632 /prefetch:84⤵PID:2068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4652,i,16977295942449136077,16651642680265418126,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4720 /prefetch:84⤵PID:4592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4716,i,16977295942449136077,16651642680265418126,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5108 /prefetch:84⤵PID:4144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4736,i,16977295942449136077,16651642680265418126,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4728 /prefetch:84⤵PID:1428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5152,i,16977295942449136077,16651642680265418126,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4996 /prefetch:84⤵PID:1776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4984,i,16977295942449136077,16651642680265418126,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5148 /prefetch:84⤵PID:3420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5196,i,16977295942449136077,16651642680265418126,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4996 /prefetch:24⤵
- Uses browser remote debugging
PID:4324
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"3⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:2120 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7fffa26b3cb8,0x7fffa26b3cc8,0x7fffa26b3cd84⤵PID:4616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,137475633298304373,4181150585345424892,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1888 /prefetch:24⤵PID:4948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,137475633298304373,4181150585345424892,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:3772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,137475633298304373,4181150585345424892,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2552 /prefetch:84⤵PID:1452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1880,137475633298304373,4181150585345424892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:14⤵
- Uses browser remote debugging
PID:1696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1880,137475633298304373,4181150585345424892,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:14⤵
- Uses browser remote debugging
PID:3468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,137475633298304373,4181150585345424892,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1876 /prefetch:24⤵PID:3516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,137475633298304373,4181150585345424892,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2288 /prefetch:24⤵PID:5052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,137475633298304373,4181150585345424892,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1948 /prefetch:24⤵PID:3372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,137475633298304373,4181150585345424892,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=4136 /prefetch:24⤵PID:2676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,137475633298304373,4181150585345424892,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=4952 /prefetch:24⤵PID:1508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1880,137475633298304373,4181150585345424892,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:14⤵
- Uses browser remote debugging
PID:3436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1880,137475633298304373,4181150585345424892,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:14⤵
- Uses browser remote debugging
PID:2692
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\DGIJDAFCFHIE" & exit3⤵
- System Location Discovery: System Language Discovery
PID:2152 -
C:\Windows\SysWOW64\timeout.exetimeout /t 104⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2840
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 3242⤵
- Program crash
PID:1044
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1708 -ip 17081⤵PID:2524
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:3492
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2032
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
649B
MD5e41c9299f3db1d84c30e7a1691e51366
SHA199a426e7627187010d4d2ab9e3cf7d58ed1bae39
SHA256e4e0e9669ace3248fec7fe77282d847539349cfbd34cf93ff549a7bbe51f3515
SHA5129672a0dfe579f5c19bd0464945647a11241d9ff9fbb17f943b8bd2ddc5244d7d3bdf201115e659123cf719a018a87c29cc375578aa9f1ddd8976e0a20cebcbc4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json
Filesize851B
MD507ffbe5f24ca348723ff8c6c488abfb8
SHA16dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA2566895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA5127ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json
Filesize854B
MD54ec1df2da46182103d2ffc3b92d20ca5
SHA1fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA2566c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
152B
MD5cb557349d7af9d6754aed39b4ace5bee
SHA104de2ac30defbb36508a41872ddb475effe2d793
SHA256cfc24ed7d1c2e2c6585f53db7b39aa2447bf9212487b0a3c8c2a7d8e7e5572ee
SHA512f0cf51f42d975d720d613d09f201435bf98c6283ae5bc033207f4ada93b15e49743a235a1cfb1b761bde268e2f7f8561aa57619b99bff67a36820bc1a4d0ec4a
-
Filesize
152B
MD5aad1d98ca9748cc4c31aa3b5abfe0fed
SHA132e8d4d9447b13bc00ec3eb15a88c55c29489495
SHA2562a07cac05ffcf140a9ad32e58ef51b32ecccf1e3ab5ef4e656770df813a8944e
SHA512150ebf7e37d20f88b21ab7ea0793afe1d40b00611ed36f0cf1ac1371b656d26f11b08a84dbb958891c79776fae04c9c616e45e2e211d292988a5709857a3bf72
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\16537f03-f56d-44c8-958b-53fd959ebf72.tmp
Filesize1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
Filesize
5KB
MD58ce3f348f44cc76cb68bcafe18166255
SHA1bfd31df75f8dd1bc142c07e98fa8b27fb8f675b4
SHA2561ac0f1db902c5a4b02d940b9aa27b6f31e8318e80cd563163595d0d77177da99
SHA5121cf273bb1da2c3a9cc18e980ef3094b2bc602877884b4e00a9ca5e1eba5b419a49e4c9ee8cf88e9b633506336cb02014481db24450017dcc847f4d9b170398ed
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
132KB
MD5da75bb05d10acc967eecaac040d3d733
SHA195c08e067df713af8992db113f7e9aec84f17181
SHA25633ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2
SHA51256533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef
-
Filesize
711B
MD5558659936250e03cc14b60ebf648aa09
SHA132f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA2562445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA5121632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
-
Filesize
1.1MB
MD5b067c29195a13494802f2eab3a9106d3
SHA1adca61f35491b5eb7d85daaa917f96d666e9d612
SHA25640592e02eec664b6c7358d2c44eaf1b019ff171755a9b824f0cf180e4f4251c9
SHA5125c49e56265ce8df8b89b783d8d1e5468abf50348376fabe290e00d766c9e1d72f05c46b78fec6506f3e55ebe7f19b3afe8381cf91de036aa200f124f9eb902ea
-
Filesize
128KB
MD564d183ad524dfcd10a7c816fbca3333d
SHA15a180d5c1f42a0deaf475b7390755b3c0ecc951c
SHA2565a666340f42f0f985772024d90a83d15c9a241a68d58205cd4afbb1a31f1621a
SHA5123cab59dff09981f49d1070fba06a781439bb1ea2dae0cfcb937d9875bbe9e866be2c951cfc6a3ca4a92aea79dd3e9c4792a765f5a06f230a57dabcab2f0b3c1e