Analysis
-
max time kernel
94s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-11-2024 12:02
Static task
static1
Behavioral task
behavioral1
Sample
8184a6dd62658bd0dd67d2dbc26b11a9488b6e1e3c68f635e70c3245d600ff8b.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8184a6dd62658bd0dd67d2dbc26b11a9488b6e1e3c68f635e70c3245d600ff8b.exe
Resource
win10v2004-20241007-en
General
-
Target
8184a6dd62658bd0dd67d2dbc26b11a9488b6e1e3c68f635e70c3245d600ff8b.exe
-
Size
6.2MB
-
MD5
1d8c2eb7cd03e559009ab6ef0f40d6c6
-
SHA1
157afa807448cfdecc3b68e0940cd253f7a368bd
-
SHA256
8184a6dd62658bd0dd67d2dbc26b11a9488b6e1e3c68f635e70c3245d600ff8b
-
SHA512
f64bc733501554e0e26d200b887ba6d92ba86e6ed4fbe755e1b25c707a399643f0ece7e3f61a0f33db0bcfb4e2afd8ea3a1fe97e067e3ec4caff45df4be20e74
-
SSDEEP
98304:cTiMEvjmzKewwsZ2XoCx7fR+Q6VCKrUka:iiMEaI24C1UQszrU1
Malware Config
Extracted
vidar
https://t.me/asg7rd
https://steamcommunity.com/profiles/76561199794498376
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6
Signatures
-
Detect Vidar Stealer 19 IoCs
resource yara_rule behavioral2/memory/1352-1-0x0000000000400000-0x0000000000700000-memory.dmp family_vidar_v7 behavioral2/memory/1352-2-0x0000000000400000-0x0000000000700000-memory.dmp family_vidar_v7 behavioral2/memory/1352-5-0x0000000000400000-0x0000000000700000-memory.dmp family_vidar_v7 behavioral2/memory/1352-21-0x0000000000400000-0x0000000000700000-memory.dmp family_vidar_v7 behavioral2/memory/1352-22-0x0000000000400000-0x0000000000700000-memory.dmp family_vidar_v7 behavioral2/memory/1352-66-0x0000000000400000-0x0000000000700000-memory.dmp family_vidar_v7 behavioral2/memory/1352-461-0x0000000000400000-0x0000000000700000-memory.dmp family_vidar_v7 behavioral2/memory/1352-462-0x0000000000400000-0x0000000000700000-memory.dmp family_vidar_v7 behavioral2/memory/1352-468-0x0000000000400000-0x0000000000700000-memory.dmp family_vidar_v7 behavioral2/memory/1352-469-0x0000000000400000-0x0000000000700000-memory.dmp family_vidar_v7 behavioral2/memory/1352-537-0x0000000000400000-0x0000000000700000-memory.dmp family_vidar_v7 behavioral2/memory/1352-574-0x0000000000400000-0x0000000000700000-memory.dmp family_vidar_v7 behavioral2/memory/1352-580-0x0000000000400000-0x0000000000700000-memory.dmp family_vidar_v7 behavioral2/memory/1352-581-0x0000000000400000-0x0000000000700000-memory.dmp family_vidar_v7 behavioral2/memory/1352-603-0x0000000000400000-0x0000000000700000-memory.dmp family_vidar_v7 behavioral2/memory/1352-604-0x0000000000400000-0x0000000000700000-memory.dmp family_vidar_v7 behavioral2/memory/1352-611-0x0000000000400000-0x0000000000700000-memory.dmp family_vidar_v7 behavioral2/memory/1352-612-0x0000000000400000-0x0000000000700000-memory.dmp family_vidar_v7 behavioral2/memory/1352-613-0x0000000000400000-0x0000000000700000-memory.dmp family_vidar_v7 -
Vidar family
-
Downloads MZ/PE file
-
Uses browser remote debugging 2 TTPs 10 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 1396 msedge.exe 3332 msedge.exe 3716 msedge.exe 2940 msedge.exe 3264 chrome.exe 952 chrome.exe 2760 chrome.exe 3260 chrome.exe 4632 chrome.exe 2364 msedge.exe -
Loads dropped DLL 3 IoCs
pid Process 1352 BitLockerToGo.exe 1352 BitLockerToGo.exe 1352 BitLockerToGo.exe -
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3152 set thread context of 1352 3152 8184a6dd62658bd0dd67d2dbc26b11a9488b6e1e3c68f635e70c3245d600ff8b.exe 99 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8184a6dd62658bd0dd67d2dbc26b11a9488b6e1e3c68f635e70c3245d600ff8b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BitLockerToGo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 BitLockerToGo.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString BitLockerToGo.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 536 timeout.exe -
Enumerates system info in registry 2 TTPs 8 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133758002120861956" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 1352 BitLockerToGo.exe 1352 BitLockerToGo.exe 1352 BitLockerToGo.exe 1352 BitLockerToGo.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 1352 BitLockerToGo.exe 1352 BitLockerToGo.exe 1352 BitLockerToGo.exe 1352 BitLockerToGo.exe 2200 msedge.exe 2200 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 1396 msedge.exe 1396 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 1352 BitLockerToGo.exe 1352 BitLockerToGo.exe 1352 BitLockerToGo.exe 1352 BitLockerToGo.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe -
Suspicious use of FindShellTrayWindow 51 IoCs
pid Process 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3152 wrote to memory of 1352 3152 8184a6dd62658bd0dd67d2dbc26b11a9488b6e1e3c68f635e70c3245d600ff8b.exe 99 PID 3152 wrote to memory of 1352 3152 8184a6dd62658bd0dd67d2dbc26b11a9488b6e1e3c68f635e70c3245d600ff8b.exe 99 PID 3152 wrote to memory of 1352 3152 8184a6dd62658bd0dd67d2dbc26b11a9488b6e1e3c68f635e70c3245d600ff8b.exe 99 PID 3152 wrote to memory of 1352 3152 8184a6dd62658bd0dd67d2dbc26b11a9488b6e1e3c68f635e70c3245d600ff8b.exe 99 PID 3152 wrote to memory of 1352 3152 8184a6dd62658bd0dd67d2dbc26b11a9488b6e1e3c68f635e70c3245d600ff8b.exe 99 PID 3152 wrote to memory of 1352 3152 8184a6dd62658bd0dd67d2dbc26b11a9488b6e1e3c68f635e70c3245d600ff8b.exe 99 PID 3152 wrote to memory of 1352 3152 8184a6dd62658bd0dd67d2dbc26b11a9488b6e1e3c68f635e70c3245d600ff8b.exe 99 PID 3152 wrote to memory of 1352 3152 8184a6dd62658bd0dd67d2dbc26b11a9488b6e1e3c68f635e70c3245d600ff8b.exe 99 PID 3152 wrote to memory of 1352 3152 8184a6dd62658bd0dd67d2dbc26b11a9488b6e1e3c68f635e70c3245d600ff8b.exe 99 PID 3152 wrote to memory of 1352 3152 8184a6dd62658bd0dd67d2dbc26b11a9488b6e1e3c68f635e70c3245d600ff8b.exe 99 PID 1352 wrote to memory of 3264 1352 BitLockerToGo.exe 101 PID 1352 wrote to memory of 3264 1352 BitLockerToGo.exe 101 PID 3264 wrote to memory of 4236 3264 chrome.exe 102 PID 3264 wrote to memory of 4236 3264 chrome.exe 102 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4636 3264 chrome.exe 103 PID 3264 wrote to memory of 4912 3264 chrome.exe 104 PID 3264 wrote to memory of 4912 3264 chrome.exe 104 PID 3264 wrote to memory of 2468 3264 chrome.exe 105 PID 3264 wrote to memory of 2468 3264 chrome.exe 105 PID 3264 wrote to memory of 2468 3264 chrome.exe 105 PID 3264 wrote to memory of 2468 3264 chrome.exe 105 PID 3264 wrote to memory of 2468 3264 chrome.exe 105 PID 3264 wrote to memory of 2468 3264 chrome.exe 105 PID 3264 wrote to memory of 2468 3264 chrome.exe 105 PID 3264 wrote to memory of 2468 3264 chrome.exe 105 PID 3264 wrote to memory of 2468 3264 chrome.exe 105 PID 3264 wrote to memory of 2468 3264 chrome.exe 105 PID 3264 wrote to memory of 2468 3264 chrome.exe 105 PID 3264 wrote to memory of 2468 3264 chrome.exe 105 PID 3264 wrote to memory of 2468 3264 chrome.exe 105 PID 3264 wrote to memory of 2468 3264 chrome.exe 105 PID 3264 wrote to memory of 2468 3264 chrome.exe 105 PID 3264 wrote to memory of 2468 3264 chrome.exe 105 PID 3264 wrote to memory of 2468 3264 chrome.exe 105 PID 3264 wrote to memory of 2468 3264 chrome.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\8184a6dd62658bd0dd67d2dbc26b11a9488b6e1e3c68f635e70c3245d600ff8b.exe"C:\Users\Admin\AppData\Local\Temp\8184a6dd62658bd0dd67d2dbc26b11a9488b6e1e3c68f635e70c3245d600ff8b.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"3⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffef058cc40,0x7ffef058cc4c,0x7ffef058cc584⤵PID:4236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2104,i,6675519714347572349,7313821161347181481,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2100 /prefetch:24⤵PID:4636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1904,i,6675519714347572349,7313821161347181481,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2136 /prefetch:34⤵PID:4912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2248,i,6675519714347572349,7313821161347181481,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2324 /prefetch:84⤵PID:2468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3164,i,6675519714347572349,7313821161347181481,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3184 /prefetch:14⤵
- Uses browser remote debugging
PID:3260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3192,i,6675519714347572349,7313821161347181481,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3216 /prefetch:14⤵
- Uses browser remote debugging
PID:952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4336,i,6675519714347572349,7313821161347181481,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4448 /prefetch:14⤵
- Uses browser remote debugging
PID:4632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4692,i,6675519714347572349,7313821161347181481,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4740 /prefetch:84⤵PID:2284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3648,i,6675519714347572349,7313821161347181481,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4624 /prefetch:84⤵PID:3572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4860,i,6675519714347572349,7313821161347181481,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4688 /prefetch:84⤵PID:4300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4648,i,6675519714347572349,7313821161347181481,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4664 /prefetch:84⤵PID:1656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4776,i,6675519714347572349,7313821161347181481,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4924 /prefetch:84⤵PID:4900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4912,i,6675519714347572349,7313821161347181481,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5124 /prefetch:84⤵PID:4400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4656,i,6675519714347572349,7313821161347181481,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4920 /prefetch:84⤵PID:3472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4488,i,6675519714347572349,7313821161347181481,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4796 /prefetch:84⤵PID:1072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4760,i,6675519714347572349,7313821161347181481,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5260 /prefetch:24⤵
- Uses browser remote debugging
PID:2760
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"3⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:1396 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffef05946f8,0x7ffef0594708,0x7ffef05947184⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16334666101642253907,13732287671013241354,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:24⤵PID:5032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,16334666101642253907,13732287671013241354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:2200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,16334666101642253907,13732287671013241354,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:84⤵PID:4900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2084,16334666101642253907,13732287671013241354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:14⤵
- Uses browser remote debugging
PID:3332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2084,16334666101642253907,13732287671013241354,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:14⤵
- Uses browser remote debugging
PID:2364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2084,16334666101642253907,13732287671013241354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2264 /prefetch:14⤵
- Uses browser remote debugging
PID:3716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2084,16334666101642253907,13732287671013241354,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:14⤵
- Uses browser remote debugging
PID:2940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16334666101642253907,13732287671013241354,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:24⤵PID:1788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16334666101642253907,13732287671013241354,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:24⤵PID:2116
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\FIECFBAAAFHI" & exit3⤵
- System Location Discovery: System Language Discovery
PID:4828 -
C:\Windows\SysWOW64\timeout.exetimeout /t 104⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:536
-
-
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:3296
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5076
Network
MITRE ATT&CK Enterprise v15
Credential Access
Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
676KB
MD5eda18948a989176f4eebb175ce806255
SHA1ff22a3d5f5fb705137f233c36622c79eab995897
SHA25681a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4
SHA512160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
649B
MD551e42196ef5906066879c0dbecffae98
SHA1a5b95d52dcb6499255de0805b11320f0419c608d
SHA25668b7289a4be8225787dc4f3d4bf8606b354833246d073d83d2fa0693654ba070
SHA512ba37e66992494c8c05359cbeae3000f6658b7166ecfd3fa692bcb67fe8c226cedbdbfc9ac5473310d72e3584b1fdfe4a0010097578e2adc701e9fec779e36a83
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json
Filesize851B
MD507ffbe5f24ca348723ff8c6c488abfb8
SHA16dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA2566895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA5127ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json
Filesize854B
MD54ec1df2da46182103d2ffc3b92d20ca5
SHA1fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA2566c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
150B
MD563bb1480314eae4c40aaf92d5004366d
SHA128b948625a8b69e649ce6ffdd9510513b4cfc110
SHA256a5d96941179558a4baf86c669082ff64fa18dd974092d26853d918a7658a84ff
SHA512605ec57ce5bdc005a7e232c29471aea96f6c8c7a0aa5fd84c354e52cf3669167cb0c6693bdbc161262fa90b338cdf4fda0cf99d61f5cd5ea025aa4286c1a4722
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\38681b1d-967e-44c6-88ca-1eb9823ee37b.dmp
Filesize826KB
MD592eccd03a91ef6df1bc5b5cab2689308
SHA1327cfeb8ddb0418960c1690850edb6eb38aa5653
SHA256c6a34218d9a4ac531c9086bb506f65c3d4dca618869e7eeff618ec90d27e9d73
SHA5125df2c4e02f05a24dcfb594538749342026b92e3000f9397fcef473bc809715fa0671e86bb9e1bb1ed194ba08b0799c9288bd228d4009162f415ff866ba918db4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\6df0a50c-2847-4b8e-9738-3c3b5ea08d20.dmp
Filesize826KB
MD5556fe61b5ccbbc5dac9648fb620f3b69
SHA1525655805ee497b35451eb609a234f158fe1bc14
SHA256fd1ef296e642b342148b916ec885b8ff6fefce8a183eb9df818cd083f9d87117
SHA51265b75d78fa8b34011625fb0978f1d5e09d7bef1779d07bd2617e8b809ad3a879a122e1cc6178dd22d4aa5646246b3d20a75430635ba61e204a6cf81ce53dae40
-
Filesize
152B
MD537f660dd4b6ddf23bc37f5c823d1c33a
SHA11c35538aa307a3e09d15519df6ace99674ae428b
SHA2564e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8
SHA512807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d
-
Filesize
152B
MD5d7cb450b1315c63b1d5d89d98ba22da5
SHA1694005cd9e1a4c54e0b83d0598a8a0c089df1556
SHA25638355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031
SHA512df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8
-
Filesize
152B
MD55e04f4bd371581b65dc3ee6ab5d5bf60
SHA1abcc6c856a8b9b13341959d0eecb4125a572db0d
SHA256bb13ccc817556d38849dd8979895961e086d654bff4324fb01e5d43c54bd2953
SHA512a4150bb900736b710a7e9905e3fe7a6b88c76fb5046fb8e359fb61f37f38afab74f632c0e1b316653e7901c7d8a9ad57d07cd2a17358734a93374cce5d58eb98
-
Filesize
152B
MD5bbd874af557ec90040bf228b499e5ee7
SHA1356bde957e274478958021692403c9fce56cb9fe
SHA25658db903e49ea0321e9a2aed44d4a3262078e289185fbb7e8c487d94aa8b01020
SHA51245a2df7833976cd7a604e2b7a49ff7ffc6f3660931661dd1e6fb8c6cb779c9741856aac66bb7f98246b6669700d19b20ba6022ea8e09f1acf11fd4ea2e3619d9
-
Filesize
5KB
MD5cec9af39c18b3fe1743e2808a11cabba
SHA1838ec78b38b6046383d960d597fa7dbfc3e2a1c9
SHA2563fd0f34e426ec708cf2bd2a6eaa5f036b676d9166ae62dd91e85b2e216d75dac
SHA512305a3e841f0b857c25c7b5ba5dfa000915197f7b4348fdcb23b7a8fbdaf5a0c8fcf00ee7ebed4539b7d4e421fe419699dbbe9c373797785f2038b9aa433a60f5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f1583d85-8e02-45ba-8a2d-e9860540848b.tmp
Filesize1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
Filesize
132KB
MD5da75bb05d10acc967eecaac040d3d733
SHA195c08e067df713af8992db113f7e9aec84f17181
SHA25633ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2
SHA51256533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef
-
Filesize
711B
MD5558659936250e03cc14b60ebf648aa09
SHA132f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA2562445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA5121632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727