hxxp://steamtools[.]net

Resubmissions

15-11-2024 21:46

241115-1m1acawqal 8

15-11-2024 21:44

241115-1ljafawpgl 8

Analysis

max time kernel
77s
max time network
70s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
15-11-2024 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://steamtools.net

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
3980	SteamtoolsSetup.exe
2536	SteamtoolsSetup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133761807077770383"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5304	chrome.exe
5304	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5304 wrote to memory of 5476	5304	chrome.exe	83
PID 5304 wrote to memory of 5476	5304	chrome.exe	83
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 3472	5304	chrome.exe	84
PID 5304 wrote to memory of 5340	5304	chrome.exe	85
PID 5304 wrote to memory of 5340	5304	chrome.exe	85
PID 5304 wrote to memory of 816	5304	chrome.exe	86
PID 5304 wrote to memory of 816	5304	chrome.exe	86
PID 5304 wrote to memory of 816	5304	chrome.exe	86
PID 5304 wrote to memory of 816	5304	chrome.exe	86
PID 5304 wrote to memory of 816	5304	chrome.exe	86
PID 5304 wrote to memory of 816	5304	chrome.exe	86
PID 5304 wrote to memory of 816	5304	chrome.exe	86
PID 5304 wrote to memory of 816	5304	chrome.exe	86
PID 5304 wrote to memory of 816	5304	chrome.exe	86
PID 5304 wrote to memory of 816	5304	chrome.exe	86
PID 5304 wrote to memory of 816	5304	chrome.exe	86
PID 5304 wrote to memory of 816	5304	chrome.exe	86
PID 5304 wrote to memory of 816	5304	chrome.exe	86
PID 5304 wrote to memory of 816	5304	chrome.exe	86
PID 5304 wrote to memory of 816	5304	chrome.exe	86
PID 5304 wrote to memory of 816	5304	chrome.exe	86
PID 5304 wrote to memory of 816	5304	chrome.exe	86
PID 5304 wrote to memory of 816	5304	chrome.exe	86
PID 5304 wrote to memory of 816	5304	chrome.exe	86
PID 5304 wrote to memory of 816	5304	chrome.exe	86
PID 5304 wrote to memory of 816	5304	chrome.exe	86
PID 5304 wrote to memory of 816	5304	chrome.exe	86
PID 5304 wrote to memory of 816	5304	chrome.exe	86
PID 5304 wrote to memory of 816	5304	chrome.exe	86
PID 5304 wrote to memory of 816	5304	chrome.exe	86
PID 5304 wrote to memory of 816	5304	chrome.exe	86
PID 5304 wrote to memory of 816	5304	chrome.exe	86
PID 5304 wrote to memory of 816	5304	chrome.exe	86
PID 5304 wrote to memory of 816	5304	chrome.exe	86
PID 5304 wrote to memory of 816	5304	chrome.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://steamtools.net
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffbec82cc40,0x7ffbec82cc4c,0x7ffbec82cc58
  2⤵
  PID:5476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1924,i,14043114702268809427,8664395391278378345,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2108,i,14043114702268809427,8664395391278378345,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  PID:5340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2244,i,14043114702268809427,8664395391278378345,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2192 /prefetch:8
  2⤵
  PID:816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3048,i,14043114702268809427,8664395391278378345,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3084 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3052,i,14043114702268809427,8664395391278378345,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3736,i,14043114702268809427,8664395391278378345,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4028,i,14043114702268809427,8664395391278378345,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3792,i,14043114702268809427,8664395391278378345,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4224,i,14043114702268809427,8664395391278378345,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5824,i,14043114702268809427,8664395391278378345,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5840,i,14043114702268809427,8664395391278378345,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5660,i,14043114702268809427,8664395391278378345,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5688,i,14043114702268809427,8664395391278378345,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6212,i,14043114702268809427,8664395391278378345,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5420,i,14043114702268809427,8664395391278378345,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  PID:6092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5920,i,14043114702268809427,8664395391278378345,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6536,i,14043114702268809427,8664395391278378345,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3396 /prefetch:8
  2⤵
  PID:5564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5036,i,14043114702268809427,8664395391278378345,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=500 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=3848,i,14043114702268809427,8664395391278378345,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5084,i,14043114702268809427,8664395391278378345,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:1520

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2452

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:640

C:\Users\Admin\Downloads\SteamtoolsSetup.exe
"C:\Users\Admin\Downloads\SteamtoolsSetup.exe"
1⤵
- Executes dropped EXE
PID:3980

C:\Users\Admin\Downloads\SteamtoolsSetup.exe
"C:\Users\Admin\Downloads\SteamtoolsSetup.exe"
1⤵
- Executes dropped EXE
PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
5f1fad2b0389157711de0d8d699201e7

SHA1
4639d91e106f3cb21217a56fc718025d97cdb04c

SHA256
d0399b3df9ff22207fd29e001a0dddfb776486dda53eb212001b0cbf9fe663ed

SHA512
bb9053679d73dff76433ab8ffeac656a6f60da5777adb4915bca466988055a76b5a841beb70a547dde4a105ac46b61047cc5e9f8a67aea17e6e88b75b0be14fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d

Filesize
978KB

MD5
bbf15e65d4e3c3580fc54adf1be95201

SHA1
79091be8f7f7a6e66669b6a38e494cf7a62b5117

SHA256
c9f2e2abb046ff2535537182edf9a9b748aa10a22e98a1d8c948d874f4ffb304

SHA512
9bb261b4ed84af846e07ffb6352960687e59428fd497faa0a37d70b57a1a7430d48ac350fbb0c3f0f11e4231a98ebca4d6923deba0949fdd7a247a3c02737355

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
795908a0bc27c2c967c53cb062bf614d

SHA1
528394aad9a30967e4dffd30b0d8ceb7ce3fc31d

SHA256
d58bee1ef62cc3d8a98fe3c0a8ceb0977d7f47105236a5c909a95a70495b50b2

SHA512
1bc069de459fc05c35a9e616aae1afaef8d80ab75ebd6d116a042c272c4b970240a9f49cdf9af656e8917bb537a5b9e3d223dd0af2047b0b78bf3ab0c827346e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
59f6eefbae5f825996c28a96c1744846

SHA1
2892310ed37d5b68539a56efa1f7e349c8807fa5

SHA256
dd351d42b85a215925033cc5c066adf2d89f2c6e2869d7521bfa91cd84667b34

SHA512
a20be17da185df0e251541b368e8018ed799ef2e98ce3abc1ca53ad6a609a76694556c88962ea95db360373005ef8044a4560ba6264b0aaf531c99383adea0fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
9KB

MD5
c2c1da02b7b422cf7bb77fcb050047de

SHA1
8bdb7801aad51ee8d4af8f665cea4c9c0e7d128d

SHA256
64cb203695e36935fc4956dadedcb8b5e7323377ebe758d84dc1992258f8daae

SHA512
f556e49b05428965f03a5bab9d56d948b16229b59607470b6f99347c0d327288d356a3eb96e45ab2a64a86fa3dd6de5566d356f37d57960895397fa6713e2d9d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
23c367208cd6fca8cc17ebf7d89fa227

SHA1
cf1c97be176403622fdf686b5c4b904de558ebc7

SHA256
59501a84f7f0a80f7b7d27d568594f6b30c1053e9ecd121f1293fa1dd4f387d8

SHA512
229f8fbc1fab34ed141aa9dd3e3eb2a46676bec5ef392aa19fe8751ea9c58d60e09ff92ff0141c350fa75fe8d0a14589558272d54d8850ac5d2e5c2d2e9e52d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
40cbeaffa34864ae5989f79aa41ee47d

SHA1
b7b41c3136368c45c01d9320b6c4c33f3ac3dbbc

SHA256
99dbf219456a0e7955b3ce0d660bc798194fc481689bd0c638b8687b19e54b8d

SHA512
e0628807fdb041e797ec4869a8383e02bf6b23c07fab831f644bec3a524022876324e3f2b47ce7e322fe96496bf8285b7e9d2171a06461f1be0ec5a111c690ad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7a1baa5aed64e31ea311a99bf730b90f

SHA1
15a30021e032d5d72ef252e0b80a9f6fc219d4b4

SHA256
9cb2f77af2df67b8c662261c8bba64e3ffc1a9479171bedc8afad6463fa9f6aa

SHA512
24bca238b0e5662c794ac72593d5b045ba8baddba100eba7674ad96e05abb38a1ebf347ed3f34ad1943cb72603d83a6e22dc6e15ab4bb100b71819dec95cac9b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e16898e113e24bcce08be13523ea1a0c

SHA1
643d901c66795a3e4116a87936a4d64b7bfe40ce

SHA256
467533e0c4b2b702eb4cdb69955393bbc44a76e168bfd2afdd908f989086d44a

SHA512
2f4b5e8dc78f4edfe240e5f6ed601e624bbe41a7e4549321fc332e1b4f483f9d6788ce7e9609b43e44a0625dd3aa1b9baca8ff1367f1f50c7cfeb09c8c78c892

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
3a136ed059af8a7a1f6e1ebe8684f52c

SHA1
db460023e9f1d34aa394cdc1c37089b3a57835e3

SHA256
ed1f1d9d6f74fbd3faa6f8e164d879d57fbd55c581d795c453a43392f6504472

SHA512
602bb1fa791663ae25722abd87e3dd0a20d2205d0a325355b53e8fdd7239dac579d7ee233a96dd327b7b439c0402e94c8009bdeb8158ac873f2c3a029782c012

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
03713a0841410aee2fb979aa69668e4d

SHA1
82f9fa3e6e98ab6ba27496609eb180de1f0577b3

SHA256
a6313e2d1f1f8027e1fb69c87d7e70db2a3e2ca36cdf758ae8049c9598661949

SHA512
e681d5aed57154987ee5847545c7dd49b8ecceacf1e059e2c434a75172a9339662850f067318fea6604bba6b8f784c325e30a9b37034da7c1eb2aa4b78cfcc39

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e0d5b0a951a89d82b4641e1a4b4a8433

SHA1
f7e42e0c018a0859557ba204b257018c01b3609c

SHA256
68db81d1975cb122b3d893724815a4f6e7106d23bf424660a65859a78274837d

SHA512
1553b1d0a46ab94d7755b92f3e09dd396234465f1f7a187a4d4fc8b246497e5776e644eef2f904a872f6c7764390517504a279c26520238d765bbb4bd2a97d39

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
711ed12053753a4dfec6a58cdb6f6bba

SHA1
747aaed7d5004cbe829db1ae6900e931747305e5

SHA256
1e75a7d78ca651b7f7e2083151ac07a6f29b51aab2cbf6d1bfabd348ab1528a4

SHA512
8ec62638491c4c3c5ba9f88b29ae44e21fbb8fd409ca7a68d34b159000e5f216143432dc7e98893e549830faa4d2d1659b113c7e1126e9863f9aff134d64c1cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
e8d7d82c0dc4c38edd56d8ee24feadc9

SHA1
692cc16ca075744a090c06f196174a15c7369472

SHA256
ee6bb23fc5012e222a3d066ba07349c2465399242b0493b9d6dc0895705b61d7

SHA512
b35884e97c8711cf4ad10909a704dd1c5de4f6c2141c487054a8385da1ebcde2b31b4d75ba35935e346bbc1172bfc70e0f5377d4e743dc8f386802c430379606

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
2939b1bc5257e80db037a885d7089de0

SHA1
8bfdbba0b11ad363d8f6a06c167d05862639a0f6

SHA256
c3007be9408b9a3d5e5db716cef69b4955a020818c963d2d8a9ffda465519bf1

SHA512
8fb2c03a8e1dc85fe800ba99c0a0f1bb93358102b67e8dc46fb98c25a63ab80f1df279b724878602e4f4ed3e0804df358d7dbb241360544d1e7fa033aab5394c

Download Submit