Analysis
-
max time kernel
39s -
max time network
41s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-11-2024 14:56
Static task
static1
Behavioral task
behavioral1
Sample
Unlock_Tool_v2.6.7.exe
Resource
win10v2004-20241007-en
General
-
Target
Unlock_Tool_v2.6.7.exe
-
Size
976KB
-
MD5
a8221418531cae557b8a39da95ce6997
-
SHA1
38b1c45753cf6bdca60403915ce54fdc672f56cb
-
SHA256
3fdc9301e70c0292761c668e731b38f1c66b4cad6ca81d4f1c56b917416a2364
-
SHA512
03ae7964ecc6a98b601b0eadcfd59e5d15095448b0687adca35151f1caa466422ccc001130bd33ef326afbe234acd19ff1f94f5e600e67180feb3abcead0b76e
-
SSDEEP
24576:kl7x9P6faKSfQXHDs+kig6+3flOXHDs+kig6+3flO+:kJ7P6CKSfQY+kPV3fwY+kPV3fw+
Malware Config
Extracted
vidar
11.8
68fa61169d8a1f0521b8a06aa1f33efb
https://t.me/fu4chmo
https://steamcommunity.com/profiles/76561199802540894
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6
Signatures
-
Detect Vidar Stealer 17 IoCs
resource yara_rule behavioral1/memory/2476-1-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/2476-3-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/2476-37-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/2476-38-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/2476-45-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/2476-46-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/2476-465-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/2476-466-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/2476-473-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/2476-477-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/2476-478-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/2476-480-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/2476-481-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/2476-482-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/2476-513-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/2476-514-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/2476-521-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 -
Stealc family
-
Vidar family
-
Downloads MZ/PE file
-
Uses browser remote debugging 2 TTPs 10 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 3680 chrome.exe 5404 msedge.exe 5788 msedge.exe 2012 chrome.exe 2944 chrome.exe 5284 msedge.exe 5412 msedge.exe 5776 msedge.exe 2108 chrome.exe 5580 chrome.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3020 set thread context of 2476 3020 Unlock_Tool_v2.6.7.exe 88 -
Program crash 1 IoCs
pid pid_target Process procid_target 4936 3020 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unlock_Tool_v2.6.7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unlock_Tool_v2.6.7.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Unlock_Tool_v2.6.7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Unlock_Tool_v2.6.7.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msedge.exe -
Enumerates system info in registry 2 TTPs 8 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133765018391251873" chrome.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 2476 Unlock_Tool_v2.6.7.exe 2476 Unlock_Tool_v2.6.7.exe 4480 taskmgr.exe 4480 taskmgr.exe 2476 Unlock_Tool_v2.6.7.exe 2476 Unlock_Tool_v2.6.7.exe 4480 taskmgr.exe 4480 taskmgr.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 2476 Unlock_Tool_v2.6.7.exe 2476 Unlock_Tool_v2.6.7.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 2476 Unlock_Tool_v2.6.7.exe 2476 Unlock_Tool_v2.6.7.exe 3232 msedge.exe 3232 msedge.exe 5268 msedge.exe 5268 msedge.exe 5268 msedge.exe 5268 msedge.exe 5284 msedge.exe 5284 msedge.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 2476 Unlock_Tool_v2.6.7.exe 2476 Unlock_Tool_v2.6.7.exe 4480 taskmgr.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 5284 msedge.exe 5284 msedge.exe 5284 msedge.exe 5284 msedge.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeDebugPrivilege 4480 taskmgr.exe Token: SeSystemProfilePrivilege 4480 taskmgr.exe Token: SeCreateGlobalPrivilege 4480 taskmgr.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe 4480 taskmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3020 wrote to memory of 2476 3020 Unlock_Tool_v2.6.7.exe 88 PID 3020 wrote to memory of 2476 3020 Unlock_Tool_v2.6.7.exe 88 PID 3020 wrote to memory of 2476 3020 Unlock_Tool_v2.6.7.exe 88 PID 3020 wrote to memory of 2476 3020 Unlock_Tool_v2.6.7.exe 88 PID 3020 wrote to memory of 2476 3020 Unlock_Tool_v2.6.7.exe 88 PID 3020 wrote to memory of 2476 3020 Unlock_Tool_v2.6.7.exe 88 PID 3020 wrote to memory of 2476 3020 Unlock_Tool_v2.6.7.exe 88 PID 3020 wrote to memory of 2476 3020 Unlock_Tool_v2.6.7.exe 88 PID 3020 wrote to memory of 2476 3020 Unlock_Tool_v2.6.7.exe 88 PID 3020 wrote to memory of 2476 3020 Unlock_Tool_v2.6.7.exe 88 PID 2476 wrote to memory of 2012 2476 Unlock_Tool_v2.6.7.exe 107 PID 2476 wrote to memory of 2012 2476 Unlock_Tool_v2.6.7.exe 107 PID 2012 wrote to memory of 3356 2012 chrome.exe 108 PID 2012 wrote to memory of 3356 2012 chrome.exe 108 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 2292 2012 chrome.exe 109 PID 2012 wrote to memory of 3000 2012 chrome.exe 110 PID 2012 wrote to memory of 3000 2012 chrome.exe 110 PID 2012 wrote to memory of 1928 2012 chrome.exe 111 PID 2012 wrote to memory of 1928 2012 chrome.exe 111 PID 2012 wrote to memory of 1928 2012 chrome.exe 111 PID 2012 wrote to memory of 1928 2012 chrome.exe 111 PID 2012 wrote to memory of 1928 2012 chrome.exe 111 PID 2012 wrote to memory of 1928 2012 chrome.exe 111 PID 2012 wrote to memory of 1928 2012 chrome.exe 111 PID 2012 wrote to memory of 1928 2012 chrome.exe 111 PID 2012 wrote to memory of 1928 2012 chrome.exe 111 PID 2012 wrote to memory of 1928 2012 chrome.exe 111 PID 2012 wrote to memory of 1928 2012 chrome.exe 111 PID 2012 wrote to memory of 1928 2012 chrome.exe 111 PID 2012 wrote to memory of 1928 2012 chrome.exe 111 PID 2012 wrote to memory of 1928 2012 chrome.exe 111 PID 2012 wrote to memory of 1928 2012 chrome.exe 111 PID 2012 wrote to memory of 1928 2012 chrome.exe 111 PID 2012 wrote to memory of 1928 2012 chrome.exe 111 PID 2012 wrote to memory of 1928 2012 chrome.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_v2.6.7.exe"C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_v2.6.7.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_v2.6.7.exe"C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_v2.6.7.exe"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"3⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffa522cc40,0x7fffa522cc4c,0x7fffa522cc584⤵PID:3356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1928,i,13835213900692453102,17111197433237535625,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1924 /prefetch:24⤵PID:2292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2184,i,13835213900692453102,17111197433237535625,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2208 /prefetch:34⤵PID:3000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2272,i,13835213900692453102,17111197433237535625,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2228 /prefetch:84⤵PID:1928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3200,i,13835213900692453102,17111197433237535625,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3208 /prefetch:14⤵
- Uses browser remote debugging
PID:3680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3232,i,13835213900692453102,17111197433237535625,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3248 /prefetch:14⤵
- Uses browser remote debugging
PID:2944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4500,i,13835213900692453102,17111197433237535625,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4536 /prefetch:14⤵
- Uses browser remote debugging
PID:2108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4724,i,13835213900692453102,17111197433237535625,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4508 /prefetch:84⤵PID:4800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4792,i,13835213900692453102,17111197433237535625,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4944 /prefetch:84⤵PID:4628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4812,i,13835213900692453102,17111197433237535625,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4660 /prefetch:84⤵PID:1692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5056,i,13835213900692453102,17111197433237535625,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4976 /prefetch:84⤵PID:1820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4820,i,13835213900692453102,17111197433237535625,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4936 /prefetch:84⤵PID:5108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4948,i,13835213900692453102,17111197433237535625,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4960 /prefetch:84⤵PID:2624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5284,i,13835213900692453102,17111197433237535625,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5280 /prefetch:24⤵
- Uses browser remote debugging
PID:5580
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"3⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:5284 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa52346f8,0x7fffa5234708,0x7fffa52347184⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,9912822115637317515,7302527884784831610,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:24⤵PID:4196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,9912822115637317515,7302527884784831610,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:3232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,9912822115637317515,7302527884784831610,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:84⤵PID:4628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2168,9912822115637317515,7302527884784831610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:14⤵
- Uses browser remote debugging
PID:5404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2168,9912822115637317515,7302527884784831610,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:14⤵
- Uses browser remote debugging
PID:5412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2168,9912822115637317515,7302527884784831610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:14⤵
- Uses browser remote debugging
PID:5788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2168,9912822115637317515,7302527884784831610,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:14⤵
- Uses browser remote debugging
PID:5776
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 1962⤵
- Program crash
PID:4936
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3020 -ip 30201⤵PID:1480
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4480
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:2636
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2144
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD56b7f4d4d3da0bf9fc7fda5f134cdc035
SHA11dddc15136f8a8831c8478363a95b962761e9a66
SHA25627d8bf0c7b91bd9cd25053b139e24d6e0c5b62e72350bd1f3945c4891120b4a5
SHA512445c33a2f46f96eeb6804f0b7dd07396aff844f489a9e79f44f1f65fdd6e0ccad9e3eeb60cd18d11eb604989d0d8be14c60681b7f07e1c907418a26ca1052104
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json
Filesize851B
MD507ffbe5f24ca348723ff8c6c488abfb8
SHA16dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA2566895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA5127ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json
Filesize854B
MD54ec1df2da46182103d2ffc3b92d20ca5
SHA1fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA2566c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
152B
MD561cef8e38cd95bf003f5fdd1dc37dae1
SHA111f2f79ecb349344c143eea9a0fed41891a3467f
SHA256ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
SHA5126fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d
-
Filesize
152B
MD50a9dc42e4013fc47438e96d24beb8eff
SHA1806ab26d7eae031a58484188a7eb1adab06457fc
SHA25658d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
SHA512868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2e260c94-4612-4091-950e-309c4f211ba2.tmp
Filesize5KB
MD5bb033ab8fc47e3b2d6058b63562e6b46
SHA151129b184b048e5980f2e302ad85d2b806c186d9
SHA2566a717b5c9b4fe0a026b8774fb13b06fa50c20f96bcd2b955726418a254ac01d9
SHA512b1a15ac6c1a6fb15d4d69feae7bb25c6c5143f8bdd4d8d59e49f359dca77fb876d1dd08c1bc8032df90a27fdbcd3b767169787b576090ad3c44409f01f3cdc70
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7a52aba3-d87c-4d4c-8204-f86cfcd3d948.tmp
Filesize1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2012_1370641794\CRX_INSTALL\_locales\en_CA\messages.json
Filesize711B
MD5558659936250e03cc14b60ebf648aa09
SHA132f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA2562445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA5121632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2012_1370641794\d28b40f9-f822-443e-89ac-ec416b7c6600.tmp
Filesize132KB
MD5da75bb05d10acc967eecaac040d3d733
SHA195c08e067df713af8992db113f7e9aec84f17181
SHA25633ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2
SHA51256533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef