5e6edc4ca5ca7c9d65541f41660a42b9e40f13d4d116b350bc751b42109081f2

Analysis

max time kernel
95s
max time network
109s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
15/11/2024, 01:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1/FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe
Size 36.9MB
Sample241115-bm46vsvrew
SHA256 6c5f832f15e5d66550db02742f3c577c8eceaba5e930de2de1d7cdab6bd54633
MD5 0025186a5f70ccf42f95d76a52337882
SHA1 1000ca9e414264dd09b1e9f5a13029e2e418ead0
SHA512 479b45f5ef22251d592e1e878d4e88ac280923e15fd5aedc1f75202f528b082ff7abd0205590f11e54bedbc7650371dd25b754f4c0a854df2afd7c08c94645cf
SSDEEP 786432:ptMiaVCQZpSs+Gfho1kUp6gQgOmgpTzi:P6VCQZpIJpf4
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

credential_access defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
848	powershell.exe
1296	powershell.exe
1852	powershell.exe
2712	powershell.exe
3428	powershell.exe
3076	powershell.exe

Uses browser remote debugging 2 TTPs 3 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
1132	chrome.exe
4396	chrome.exe
3320	chrome.exe

Executes dropped EXE 1 IoCs

pid	Process
768	chromedriver.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Hide Artifacts: Hidden Window 1 TTPs 3 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
4508	cmd.exe
3176	cmd.exe
3936	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	discord.com
43	discord.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ipinfo.io
4	ipinfo.io
30	ipinfo.io
42	ipinfo.io

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
1040	tasklist.exe
3784	tasklist.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chromedriver.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3936	cmd.exe
4508	cmd.exe
3176	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chromedriver.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2128	WMIC.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3428	powershell.exe
3428	powershell.exe
3428	powershell.exe
3076	powershell.exe
3076	powershell.exe
3076	powershell.exe
1852	powershell.exe
1852	powershell.exe
1852	powershell.exe
2712	powershell.exe
2712	powershell.exe
2712	powershell.exe
848	powershell.exe
848	powershell.exe
1296	powershell.exe
1296	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2128	WMIC.exe
Token: SeSecurityPrivilege	2128	WMIC.exe
Token: SeTakeOwnershipPrivilege	2128	WMIC.exe
Token: SeLoadDriverPrivilege	2128	WMIC.exe
Token: SeSystemProfilePrivilege	2128	WMIC.exe
Token: SeSystemtimePrivilege	2128	WMIC.exe
Token: SeProfSingleProcessPrivilege	2128	WMIC.exe
Token: SeIncBasePriorityPrivilege	2128	WMIC.exe
Token: SeCreatePagefilePrivilege	2128	WMIC.exe
Token: SeBackupPrivilege	2128	WMIC.exe
Token: SeRestorePrivilege	2128	WMIC.exe
Token: SeShutdownPrivilege	2128	WMIC.exe
Token: SeDebugPrivilege	2128	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2128	WMIC.exe
Token: SeRemoteShutdownPrivilege	2128	WMIC.exe
Token: SeUndockPrivilege	2128	WMIC.exe
Token: SeManageVolumePrivilege	2128	WMIC.exe
Token: 33	2128	WMIC.exe
Token: 34	2128	WMIC.exe
Token: 35	2128	WMIC.exe
Token: 36	2128	WMIC.exe
Token: SeDebugPrivilege	1040	tasklist.exe
Token: SeIncreaseQuotaPrivilege	1056	WMIC.exe
Token: SeSecurityPrivilege	1056	WMIC.exe
Token: SeTakeOwnershipPrivilege	1056	WMIC.exe
Token: SeLoadDriverPrivilege	1056	WMIC.exe
Token: SeSystemProfilePrivilege	1056	WMIC.exe
Token: SeSystemtimePrivilege	1056	WMIC.exe
Token: SeProfSingleProcessPrivilege	1056	WMIC.exe
Token: SeIncBasePriorityPrivilege	1056	WMIC.exe
Token: SeCreatePagefilePrivilege	1056	WMIC.exe
Token: SeBackupPrivilege	1056	WMIC.exe
Token: SeRestorePrivilege	1056	WMIC.exe
Token: SeShutdownPrivilege	1056	WMIC.exe
Token: SeDebugPrivilege	1056	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1056	WMIC.exe
Token: SeRemoteShutdownPrivilege	1056	WMIC.exe
Token: SeUndockPrivilege	1056	WMIC.exe
Token: SeManageVolumePrivilege	1056	WMIC.exe
Token: 33	1056	WMIC.exe
Token: 34	1056	WMIC.exe
Token: 35	1056	WMIC.exe
Token: 36	1056	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2128	WMIC.exe
Token: SeSecurityPrivilege	2128	WMIC.exe
Token: SeTakeOwnershipPrivilege	2128	WMIC.exe
Token: SeLoadDriverPrivilege	2128	WMIC.exe
Token: SeSystemProfilePrivilege	2128	WMIC.exe
Token: SeSystemtimePrivilege	2128	WMIC.exe
Token: SeProfSingleProcessPrivilege	2128	WMIC.exe
Token: SeIncBasePriorityPrivilege	2128	WMIC.exe
Token: SeCreatePagefilePrivilege	2128	WMIC.exe
Token: SeBackupPrivilege	2128	WMIC.exe
Token: SeRestorePrivilege	2128	WMIC.exe
Token: SeShutdownPrivilege	2128	WMIC.exe
Token: SeDebugPrivilege	2128	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2128	WMIC.exe
Token: SeRemoteShutdownPrivilege	2128	WMIC.exe
Token: SeUndockPrivilege	2128	WMIC.exe
Token: SeManageVolumePrivilege	2128	WMIC.exe
Token: 33	2128	WMIC.exe
Token: 34	2128	WMIC.exe
Token: 35	2128	WMIC.exe
Token: 36	2128	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 3248	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	79
PID 3780 wrote to memory of 3248	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	79
PID 3780 wrote to memory of 3656	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	81
PID 3780 wrote to memory of 3656	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	81
PID 3780 wrote to memory of 3296	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	82
PID 3780 wrote to memory of 3296	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	82
PID 3780 wrote to memory of 1264	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	83
PID 3780 wrote to memory of 1264	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	83
PID 3248 wrote to memory of 2128	3248	cmd.exe	87
PID 3248 wrote to memory of 2128	3248	cmd.exe	87
PID 3656 wrote to memory of 1056	3656	cmd.exe	88
PID 3656 wrote to memory of 1056	3656	cmd.exe	88
PID 1264 wrote to memory of 1040	1264	cmd.exe	89
PID 1264 wrote to memory of 1040	1264	cmd.exe	89
PID 3780 wrote to memory of 416	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	91
PID 3780 wrote to memory of 416	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	91
PID 416 wrote to memory of 412	416	cmd.exe	93
PID 416 wrote to memory of 412	416	cmd.exe	93
PID 3780 wrote to memory of 3268	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	94
PID 3780 wrote to memory of 3268	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	94
PID 3780 wrote to memory of 1008	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	95
PID 3780 wrote to memory of 1008	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	95
PID 1008 wrote to memory of 3784	1008	cmd.exe	98
PID 1008 wrote to memory of 3784	1008	cmd.exe	98
PID 3268 wrote to memory of 2312	3268	cmd.exe	99
PID 3268 wrote to memory of 2312	3268	cmd.exe	99
PID 3780 wrote to memory of 3936	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	100
PID 3780 wrote to memory of 3936	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	100
PID 3936 wrote to memory of 3428	3936	cmd.exe	102
PID 3936 wrote to memory of 3428	3936	cmd.exe	102
PID 3780 wrote to memory of 4508	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	103
PID 3780 wrote to memory of 4508	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	103
PID 4508 wrote to memory of 3076	4508	cmd.exe	105
PID 4508 wrote to memory of 3076	4508	cmd.exe	105
PID 3780 wrote to memory of 3176	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	106
PID 3780 wrote to memory of 3176	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	106
PID 3176 wrote to memory of 1852	3176	cmd.exe	108
PID 3176 wrote to memory of 1852	3176	cmd.exe	108
PID 3780 wrote to memory of 2712	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	109
PID 3780 wrote to memory of 2712	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	109
PID 3780 wrote to memory of 2076	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	111
PID 3780 wrote to memory of 2076	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	111
PID 3780 wrote to memory of 4928	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	113
PID 3780 wrote to memory of 4928	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	113
PID 4928 wrote to memory of 1400	4928	cmd.exe	115
PID 4928 wrote to memory of 1400	4928	cmd.exe	115
PID 4928 wrote to memory of 4920	4928	cmd.exe	116
PID 4928 wrote to memory of 4920	4928	cmd.exe	116
PID 3780 wrote to memory of 3064	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	117
PID 3780 wrote to memory of 3064	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	117
PID 3064 wrote to memory of 1524	3064	cmd.exe	119
PID 3064 wrote to memory of 1524	3064	cmd.exe	119
PID 3064 wrote to memory of 2768	3064	cmd.exe	120
PID 3064 wrote to memory of 2768	3064	cmd.exe	120
PID 3780 wrote to memory of 4964	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	121
PID 3780 wrote to memory of 4964	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	121
PID 4964 wrote to memory of 3652	4964	cmd.exe	123
PID 4964 wrote to memory of 3652	4964	cmd.exe	123
PID 4964 wrote to memory of 4780	4964	cmd.exe	124
PID 4964 wrote to memory of 4780	4964	cmd.exe	124
PID 3780 wrote to memory of 3964	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	125
PID 3780 wrote to memory of 3964	3780	FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe	125
PID 3964 wrote to memory of 4908	3964	cmd.exe	127
PID 3964 wrote to memory of 4908	3964	cmd.exe	127

C:\Users\Admin\AppData\Local\Temp\FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1\FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe
"C:\Users\Admin\AppData\Local\Temp\FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1\FreeCA_1.0.0RC2-conda-Windows-x86_64-installer-1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious use of AdjustPrivilegeToken
    PID:2128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get Manufacturer
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "gdb --version"
  2⤵
  PID:3296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1264
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:416
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path Win32_ComputerSystem get Manufacturer
    3⤵
    PID:412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:2312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell.exe -WindowStyle Hidden -Command "Stop-Process -Name 'chrome' -Force -ErrorAction SilentlyContinue""
  2⤵
  - Hide Artifacts: Hidden Window
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Stop-Process -Name 'chrome' -Force -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell.exe -WindowStyle Hidden -Command "Stop-Process -Name 'browser' -Force -ErrorAction SilentlyContinue""
  2⤵
  - Hide Artifacts: Hidden Window
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Stop-Process -Name 'browser' -Force -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell.exe -WindowStyle Hidden -Command "Stop-Process -Name 'msedge' -Force -ErrorAction SilentlyContinue""
  2⤵
  - Hide Artifacts: Hidden Window
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Stop-Process -Name 'msedge' -Force -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -Command "Stop-Process -Name chrome -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:2076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "(dir 2>&1 *`|echo CMD);&<# rem #>echo powershell"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir *` 2>&1"
    3⤵
    PID:1400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo CMD"
    3⤵
    PID:4920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "(dir 2>&1 *`|echo CMD);&<# rem #>echo powershell"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir *` 2>&1"
    3⤵
    PID:1524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo CMD"
    3⤵
    PID:2768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "(dir 2>&1 *`|echo CMD);&<# rem #>echo powershell"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir *` 2>&1"
    3⤵
    PID:3652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo CMD"
    3⤵
    PID:4780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "(dir 2>&1 *`|echo CMD);&<# rem #>echo powershell"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir *` 2>&1"
    3⤵
    PID:4908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo CMD"
    3⤵
    PID:3468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "(dir 2>&1 *`|echo CMD);&<# rem #>echo powershell"
  2⤵
  PID:2944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir *` 2>&1"
    3⤵
    PID:3544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo CMD"
    3⤵
    PID:2212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -NoProfile "$ErrorActionPreference='silentlycontinue'; $tmp = (Get-Item -Path "$env:PROGRAMFILES\Google\Chrome\Application\chrome.exe").VersionInfo.FileVersion; if ($tmp) {echo $tmp; Exit;}; $tmp = (Get-Item -Path "$env:PROGRAMFILES (x86)\Google\Chrome\Application\chrome.exe").VersionInfo.FileVersion; if ($tmp) {echo $tmp; Exit;}; $tmp = (Get-Item -Path "$env:LOCALAPPDATA\Google\Chrome\Application\chrome.exe").VersionInfo.FileVersion; if ($tmp) {echo $tmp; Exit;}; $tmp = (Get-ItemProperty -Path Registry::"HKCU\SOFTWARE\Google\Chrome\BLBeacon").version; if ($tmp) {echo $tmp; Exit;}; $tmp = (Get-ItemProperty -Path Registry::"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome").version; if ($tmp) {echo $tmp; Exit;};""
  2⤵
  PID:4888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile "$ErrorActionPreference='silentlycontinue'; $tmp = (Get-Item -Path "$env:PROGRAMFILES\Google\Chrome\Application\chrome.exe").VersionInfo.FileVersion; if ($tmp) {echo $tmp; Exit;}; $tmp = (Get-Item -Path "$env:PROGRAMFILES (x86)\Google\Chrome\Application\chrome.exe").VersionInfo.FileVersion; if ($tmp) {echo $tmp; Exit;}; $tmp = (Get-Item -Path "$env:LOCALAPPDATA\Google\Chrome\Application\chrome.exe").VersionInfo.FileVersion; if ($tmp) {echo $tmp; Exit;}; $tmp = (Get-ItemProperty -Path Registry::"HKCU\SOFTWARE\Google\Chrome\BLBeacon").version; if ($tmp) {echo $tmp; Exit;}; $tmp = (Get-ItemProperty -Path Registry::"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome").version; if ($tmp) {echo $tmp; Exit;};"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "(dir 2>&1 *`|echo CMD);&<# rem #>echo powershell"
  2⤵
  PID:2132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir *` 2>&1"
    3⤵
    PID:1452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo CMD"
    3⤵
    PID:1100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "(dir 2>&1 *`|echo CMD);&<# rem #>echo powershell"
  2⤵
  PID:3248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir *` 2>&1"
    3⤵
    PID:1056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo CMD"
    3⤵
    PID:3588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "(dir 2>&1 *`|echo CMD);&<# rem #>echo powershell"
  2⤵
  PID:3316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir *` 2>&1"
    3⤵
    PID:4228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo CMD"
    3⤵
    PID:124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "(dir 2>&1 *`|echo CMD);&<# rem #>echo powershell"
  2⤵
  PID:416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir *` 2>&1"
    3⤵
    PID:3444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo CMD"
    3⤵
    PID:1932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "(dir 2>&1 *`|echo CMD);&<# rem #>echo powershell"
  2⤵
  PID:3580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir *` 2>&1"
    3⤵
    PID:2596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo CMD"
    3⤵
    PID:1892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -NoProfile "$ErrorActionPreference='silentlycontinue'; $tmp = (Get-Item -Path "$env:PROGRAMFILES\Google\Chrome\Application\chrome.exe").VersionInfo.FileVersion; if ($tmp) {echo $tmp; Exit;}; $tmp = (Get-Item -Path "$env:PROGRAMFILES (x86)\Google\Chrome\Application\chrome.exe").VersionInfo.FileVersion; if ($tmp) {echo $tmp; Exit;}; $tmp = (Get-Item -Path "$env:LOCALAPPDATA\Google\Chrome\Application\chrome.exe").VersionInfo.FileVersion; if ($tmp) {echo $tmp; Exit;}; $tmp = (Get-ItemProperty -Path Registry::"HKCU\SOFTWARE\Google\Chrome\BLBeacon").version; if ($tmp) {echo $tmp; Exit;}; $tmp = (Get-ItemProperty -Path Registry::"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome").version; if ($tmp) {echo $tmp; Exit;};""
  2⤵
  PID:3352
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile "$ErrorActionPreference='silentlycontinue'; $tmp = (Get-Item -Path "$env:PROGRAMFILES\Google\Chrome\Application\chrome.exe").VersionInfo.FileVersion; if ($tmp) {echo $tmp; Exit;}; $tmp = (Get-Item -Path "$env:PROGRAMFILES (x86)\Google\Chrome\Application\chrome.exe").VersionInfo.FileVersion; if ($tmp) {echo $tmp; Exit;}; $tmp = (Get-Item -Path "$env:LOCALAPPDATA\Google\Chrome\Application\chrome.exe").VersionInfo.FileVersion; if ($tmp) {echo $tmp; Exit;}; $tmp = (Get-ItemProperty -Path Registry::"HKCU\SOFTWARE\Google\Chrome\BLBeacon").version; if ($tmp) {echo $tmp; Exit;}; $tmp = (Get-ItemProperty -Path Registry::"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome").version; if ($tmp) {echo $tmp; Exit;};"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1296
- C:\Users\Admin\.wdm\drivers\chromedriver\win64\123.0.6312.122\chromedriver-win32\chromedriver.exe
  C:\Users\Admin\.wdm\drivers\chromedriver\win64\123.0.6312.122\chromedriver-win32/chromedriver.exe --port=49826
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-gpu --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-logging --headless --log-level=3 --no-first-run --no-sandbox --no-service-autorun --password-store=basic --profile-directory=Default --remote-debugging-port=9222 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --window-position=-2400,-2400 --window-size=1920x1080 data:,
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    PID:1132
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffae751cc40,0x7ffae751cc4c,0x7ffae751cc58
      4⤵
      PID:3104
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --enable-logging --headless --log-level=3 --use-angle=swiftshader-webgl --headless --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --enable-logging --log-level=3 --field-trial-handle=1448,i,5080143190531319085,6875080752460952404,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1428 /prefetch:2
      4⤵
      PID:2820
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --enable-logging --log-level=3 --use-angle=swiftshader-webgl --use-gl=angle --headless --enable-logging --log-level=3 --field-trial-handle=1648,i,5080143190531319085,6875080752460952404,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1644 /prefetch:3
      4⤵
      PID:4684
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --headless --no-sandbox --enable-automation --enable-logging --log-level=3 --remote-debugging-port=9222 --test-type=webdriver --allow-pre-commit-input --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1848,i,5080143190531319085,6875080752460952404,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1844 /prefetch:1
      4⤵
      Uses browser remote debugging
      Drops file in Program Files directory
      PID:4396
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --headless --no-sandbox --enable-automation --enable-logging --log-level=3 --remote-debugging-port=9222 --test-type=webdriver --allow-pre-commit-input --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2568,i,5080143190531319085,6875080752460952404,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:1
      4⤵
      Uses browser remote debugging
      Drops file in Program Files directory
      PID:3320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Ignore Process Interrupts

T1564.011

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

debug.log

Path C:\Program Files\Google\Chrome\Application\debug.log
Size 426B
SHA256 8220c4483ac00e4ab7e41a42861736248dfca3d0af35a30929b9b50f38edad9d
MD5 455e7f59ba19250e2743736fd1a9641a
SHA1 d14bd6636ba38ca84b6ba5e0ea343309b7a80a8c
SHA512 3b05ab7a2320b33678d421d7fb318e49e4d3209249f158c78df7e8eab409e5952be234f66713a99fcc0e13f3b33b3faa00a3b7bd729b2d42e795391fb36c783e
MD5 SHA1 SHA512

Submit Download

chromedriver.exe

Path C:\Users\Admin\.wdm\drivers\chromedriver\win64\123.0.6312.122\chromedriver-win32\chromedriver.exe
Size 14.5MB
SHA256 d73ee39cabd3838af6d68e35fef9131362d990868c3bcc060106597f3400efce
MD5 3b4eb1fdc25b1d0722ea2568eba0439a
SHA1 067ff3e03339cbaa179fb2b0743c44b43a7a3a78
SHA512 30949a7489040a6d4b96103f105a5b1b92e39876b8e1ae243184b0438b2c51d9cbac76f90693ac6f7b68a3fe700eb29611bb2f50ba87d5d300b1f8f5527cb0e3
SSDEEP 393216:eH9TRqP9uonkwEARhPJyh8p9EQDry/l15H1c2BFJ7yOHdd4179M7AAttP5O0umzf:rP9sFARhwSTu7HY1m7imAiWDKVKCJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 888B
SHA256 7065b8c96a45de12a17d96bbe0c77084ff1993775aabfc912be6b7499551cca6
MD5 57673e854cc825fd31204a3d3f566bc1
SHA1 469829cfe7dacc30b672c66a71c6ea5be03f9a47
SHA512 f4da2c56aabe075d7388059d0f341ac9a6bccf4a358b57b812782c54854c8c7942672456b8b831db503e80c6962c9339cb75a9adc3122d34f3dfff9fd397001d
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 228KB
SHA256 6e4d1789508c42ed580550eb93a2bda8772c938cb6388d2b0ec468f54b124188
MD5 6a04caa9b4bfd98e2916ea436f87c9b2
SHA1 428bb41c8e7f96c4e360c7a06bd252f43832449a
SHA512 61d1f83a5ce94e70f53d960a5634605bc639838ddc22d45aa0eb3faabe2b2b2f1dd8fcd32f61b9e8f9faa1c3fc7ce319c59f988553b6b79e3c8febea1ee53088
SSDEEP 6144:Yze+CAC6EE1zX9uKNUZt46Jlxse6HWNj6YHgta9eG:oigx9uKNY46Jwen6qgtaD
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
MD5 d8b9a260789a22d72263ef3bb119108c
SHA1 376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA512 550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 19c786a0d1be5f808940dfb0bfcdf3e78a1e4881cb326fabe044b9c7c2970466
MD5 71de3d4e6a902c41e5d87b031a5a1910
SHA1 38da8e3af858eb6ad51af0aca573ed73c244cb21
SHA512 c3811686eead6874ad81483349e693e1ba89ef4c38d001cfdc5e49c5085d13649940a623a2e3cfd12d3ff887e6d12c11b3a832b09e00577d623cf4d7c03f7554
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_lxj2djta.psv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lxj2djta.psv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

chrome_profile_0_cookies.txt

Path C:\Users\Public\Gmtykxru\cookies\chrome_profile_0_cookies.txt
Size 1KB
SHA256 8bfb509f6817dfc5d0fdadcd42bb28b2b480963c5e5af95edbaf551fb9924d45
MD5 7d8d43d4ec87651d44965cde17958d2b
SHA1 b41cb33927b32c327ba606406b31d26e1ce88e94
SHA512 b9025c4f0581de7e1d9cf89e89601747a12f2aef85cc4ade6b7488cb0766325dedea43cef2805aba56e2e09161862a26dd201c880670db2d141fd009b798db4d
MD5 SHA1 SHA512

Submit Download

memory/3428-10-0x000002059B050000-0x000002059B072000-memory.dmp

Download