Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-11-2024 08:00
Static task
static1
Behavioral task
behavioral1
Sample
141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exe
Resource
win7-20240903-en
General
-
Target
141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exe
-
Size
9.4MB
-
MD5
3a08e3ef57c5ff6309e6424640579390
-
SHA1
b3d03e2c8ab69a60a358a87b746244a2bd12071f
-
SHA256
141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6
-
SHA512
ebc6a06278c298f309cd4c5bdb17aae1b900eec11240a6794206db9f8452de3cd528ac7f1a6adc90e9bf55bbbb5dfb7190b5f9f64129e34a8c674e1f7b931380
-
SSDEEP
98304:FMESvDLLjgVABcjwdJgnxygK4X7GtirH5RtXeZMOKIeF0qx6DW0JRa:FMEwn/6ABBJ6xygK4X636OKFF0G
Malware Config
Extracted
stealc
mainteam
http://31.58.137.238
-
url_path
/3392f30dc348fa7b.php
Signatures
-
Stealc family
-
Downloads MZ/PE file
-
Uses browser remote debugging 2 TTPs 10 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
Processes:
msedge.exechrome.exechrome.exechrome.exemsedge.exemsedge.exemsedge.exemsedge.exechrome.exechrome.exepid Process 700 msedge.exe 4404 chrome.exe 4784 chrome.exe 2428 chrome.exe 4492 msedge.exe 3008 msedge.exe 3432 msedge.exe 832 msedge.exe 4572 chrome.exe 3836 chrome.exe -
Loads dropped DLL 3 IoCs
Processes:
141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exepid Process 1488 141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exe 1488 141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exe 1488 141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
msedge.exe141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 msedge.exe -
Enumerates system info in registry 2 TTPs 8 IoCs
Processes:
msedge.exechrome.exemsedge.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133758720568983533" chrome.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exechrome.exemsedge.exemsedge.exemsedge.exepid Process 1488 141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exe 1488 141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exe 1488 141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exe 1488 141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exe 1488 141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exe 1488 141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exe 4572 chrome.exe 4572 chrome.exe 1488 141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exe 1488 141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exe 1488 141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exe 1488 141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 4720 msedge.exe 4720 msedge.exe 4492 msedge.exe 4492 msedge.exe 1488 141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exe 1488 141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exe 1488 141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exe 1488 141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
Processes:
chrome.exemsedge.exepid Process 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4492 msedge.exe 4492 msedge.exe 4492 msedge.exe 4492 msedge.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
Processes:
chrome.exedescription pid Process Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe -
Suspicious use of FindShellTrayWindow 51 IoCs
Processes:
chrome.exemsedge.exepid Process 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4492 msedge.exe 4492 msedge.exe 4492 msedge.exe 4492 msedge.exe 4492 msedge.exe 4492 msedge.exe 4492 msedge.exe 4492 msedge.exe 4492 msedge.exe 4492 msedge.exe 4492 msedge.exe 4492 msedge.exe 4492 msedge.exe 4492 msedge.exe 4492 msedge.exe 4492 msedge.exe 4492 msedge.exe 4492 msedge.exe 4492 msedge.exe 4492 msedge.exe 4492 msedge.exe 4492 msedge.exe 4492 msedge.exe 4492 msedge.exe 4492 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exechrome.exedescription pid Process procid_target PID 1488 wrote to memory of 4572 1488 141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exe 91 PID 1488 wrote to memory of 4572 1488 141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exe 91 PID 4572 wrote to memory of 1532 4572 chrome.exe 92 PID 4572 wrote to memory of 1532 4572 chrome.exe 92 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 4232 4572 chrome.exe 93 PID 4572 wrote to memory of 5004 4572 chrome.exe 94 PID 4572 wrote to memory of 5004 4572 chrome.exe 94 PID 4572 wrote to memory of 3196 4572 chrome.exe 95 PID 4572 wrote to memory of 3196 4572 chrome.exe 95 PID 4572 wrote to memory of 3196 4572 chrome.exe 95 PID 4572 wrote to memory of 3196 4572 chrome.exe 95 PID 4572 wrote to memory of 3196 4572 chrome.exe 95 PID 4572 wrote to memory of 3196 4572 chrome.exe 95 PID 4572 wrote to memory of 3196 4572 chrome.exe 95 PID 4572 wrote to memory of 3196 4572 chrome.exe 95 PID 4572 wrote to memory of 3196 4572 chrome.exe 95 PID 4572 wrote to memory of 3196 4572 chrome.exe 95 PID 4572 wrote to memory of 3196 4572 chrome.exe 95 PID 4572 wrote to memory of 3196 4572 chrome.exe 95 PID 4572 wrote to memory of 3196 4572 chrome.exe 95 PID 4572 wrote to memory of 3196 4572 chrome.exe 95 PID 4572 wrote to memory of 3196 4572 chrome.exe 95 PID 4572 wrote to memory of 3196 4572 chrome.exe 95 PID 4572 wrote to memory of 3196 4572 chrome.exe 95 PID 4572 wrote to memory of 3196 4572 chrome.exe 95 PID 4572 wrote to memory of 3196 4572 chrome.exe 95 PID 4572 wrote to memory of 3196 4572 chrome.exe 95 PID 4572 wrote to memory of 3196 4572 chrome.exe 95 PID 4572 wrote to memory of 3196 4572 chrome.exe 95 PID 4572 wrote to memory of 3196 4572 chrome.exe 95 PID 4572 wrote to memory of 3196 4572 chrome.exe 95 PID 4572 wrote to memory of 3196 4572 chrome.exe 95 PID 4572 wrote to memory of 3196 4572 chrome.exe 95 PID 4572 wrote to memory of 3196 4572 chrome.exe 95 PID 4572 wrote to memory of 3196 4572 chrome.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exe"C:\Users\Admin\AppData\Local\Temp\141e141c2bcbed80422f97517803e88f06ac22b6ecbc6a8b839d5c9ca303f7f6.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"2⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb84dfcc40,0x7ffb84dfcc4c,0x7ffb84dfcc583⤵PID:1532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1876,i,11040093987037911258,16675933028183013281,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1872 /prefetch:23⤵PID:4232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2120,i,11040093987037911258,16675933028183013281,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2192 /prefetch:33⤵PID:5004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2256,i,11040093987037911258,16675933028183013281,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2420 /prefetch:83⤵PID:3196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,11040093987037911258,16675933028183013281,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3168 /prefetch:13⤵
- Uses browser remote debugging
PID:4404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3188,i,11040093987037911258,16675933028183013281,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3216 /prefetch:13⤵
- Uses browser remote debugging
PID:4784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4560,i,11040093987037911258,16675933028183013281,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4520 /prefetch:13⤵
- Uses browser remote debugging
PID:3836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4700,i,11040093987037911258,16675933028183013281,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4668 /prefetch:83⤵PID:4720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4680,i,11040093987037911258,16675933028183013281,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4856 /prefetch:83⤵PID:4896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4912,i,11040093987037911258,16675933028183013281,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4708 /prefetch:83⤵PID:4600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4656,i,11040093987037911258,16675933028183013281,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4676 /prefetch:83⤵PID:2380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4524,i,11040093987037911258,16675933028183013281,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4764 /prefetch:83⤵PID:2360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4184,i,11040093987037911258,16675933028183013281,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4756 /prefetch:83⤵PID:4036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4516,i,11040093987037911258,16675933028183013281,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4708 /prefetch:83⤵PID:1472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4528,i,11040093987037911258,16675933028183013281,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5252 /prefetch:83⤵PID:3908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4980,i,11040093987037911258,16675933028183013281,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5260 /prefetch:23⤵
- Uses browser remote debugging
PID:2428
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"2⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:4492 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffb84e046f8,0x7ffb84e04708,0x7ffb84e047183⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,13093111080551214077,471947565557109375,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:23⤵PID:4652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,13093111080551214077,471947565557109375,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:4720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,13093111080551214077,471947565557109375,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:83⤵PID:4020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2056,13093111080551214077,471947565557109375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:13⤵
- Uses browser remote debugging
PID:3432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2056,13093111080551214077,471947565557109375,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:13⤵
- Uses browser remote debugging
PID:3008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2056,13093111080551214077,471947565557109375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4364 /prefetch:13⤵
- Uses browser remote debugging
PID:832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2056,13093111080551214077,471947565557109375,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4424 /prefetch:13⤵
- Uses browser remote debugging
PID:700
-
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:920
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1972
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
676KB
MD5eda18948a989176f4eebb175ce806255
SHA1ff22a3d5f5fb705137f233c36622c79eab995897
SHA25681a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4
SHA512160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
649B
MD5e3ff0a41a28d2e452b099cece832a66e
SHA1f7a10ebe1420d8382d3cf880bbac1061216048ad
SHA2560befacda4b4638ceff9dcba139d7e562319028fb982441875c9c6757b8129e35
SHA512e7d3a06ceadb380a30097e2be21999fb7c493f7f2327d69cf769af993414570ece5e7aec1b91a95984c2adbd658d81f12a06d12ab1fdc0641a48888f68ee3d19
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json
Filesize851B
MD507ffbe5f24ca348723ff8c6c488abfb8
SHA16dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA2566895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA5127ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json
Filesize854B
MD54ec1df2da46182103d2ffc3b92d20ca5
SHA1fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA2566c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
152B
MD5f426165d1e5f7df1b7a3758c306cd4ae
SHA159ef728fbbb5c4197600f61daec48556fec651c1
SHA256b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841
SHA5128d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6
-
Filesize
152B
MD56960857d16aadfa79d36df8ebbf0e423
SHA1e1db43bd478274366621a8c6497e270d46c6ed4f
SHA256f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32
SHA5126deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe
-
Filesize
5KB
MD591a3c9d4e6f6dcb5a2cac2a4c6d6f4d4
SHA1025be2e72d780ae11bed4615920f57fef8c6ec89
SHA2565a881bcc3892697874df6417581f62b3fd938ab29ea5b46b44b4fde4fcedae66
SHA512c0f7e7040ea5ace4bbbd4d69df98b28773c1a59c9d5156dc7470e2844e85cd0e2e96e16460a72eefd21c4b6e6b292e65bd8c881601df8095324a560213896911
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fb5f4600-c2af-4d05-8447-11a403aa7e9e.tmp
Filesize1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
Filesize
711B
MD5558659936250e03cc14b60ebf648aa09
SHA132f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA2562445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA5121632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
-
Filesize
132KB
MD5da75bb05d10acc967eecaac040d3d733
SHA195c08e067df713af8992db113f7e9aec84f17181
SHA25633ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2
SHA51256533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e