18f4e82898557ba7f23f5b58e181793aee6b9ee066258ce0b8fdba63a714c4f8

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-12-2024 02:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18f4e82898557ba7f23f5b58e181793aee6b9ee066258ce0b8fdba63a714c4f8.exe
Size

240KB
MD5

89ad45b4a0e2d547c1e09d0a1ea94df6
SHA1

ca32c2e492bb6d0753aab59993380db79b080740
SHA256

18f4e82898557ba7f23f5b58e181793aee6b9ee066258ce0b8fdba63a714c4f8
SHA512

22c575d47780046d845e0c383bf02aded47d2813173ea6f07180f8726be42084336ef5009c34c5c8295d0deddb3f19f6e5fee1902d62ac9499a117e7de59c4ff
SSDEEP

3072:skv0eu6ZJlctXwLISyqlsxfKPkAck1gD1l567pGDUJ42pUvp85lmv6RReHeP3Kqc:/MeNRFLIu5ckeHgFGD+jpUvwzzeot+

Score

8^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2468	chrome.exe
2636	chrome.exe
2688	chrome.exe
1852	chrome.exe
2744	chrome.exe
896	chrome.exe
1780	chrome.exe
1272	chrome.exe

Loads dropped DLL 2 IoCs

pid	Process
548	18f4e82898557ba7f23f5b58e181793aee6b9ee066258ce0b8fdba63a714c4f8.exe
548	18f4e82898557ba7f23f5b58e181793aee6b9ee066258ce0b8fdba63a714c4f8.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	18f4e82898557ba7f23f5b58e181793aee6b9ee066258ce0b8fdba63a714c4f8.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	18f4e82898557ba7f23f5b58e181793aee6b9ee066258ce0b8fdba63a714c4f8.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	18f4e82898557ba7f23f5b58e181793aee6b9ee066258ce0b8fdba63a714c4f8.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
548	18f4e82898557ba7f23f5b58e181793aee6b9ee066258ce0b8fdba63a714c4f8.exe
548	18f4e82898557ba7f23f5b58e181793aee6b9ee066258ce0b8fdba63a714c4f8.exe
2744	chrome.exe
2744	chrome.exe
548	18f4e82898557ba7f23f5b58e181793aee6b9ee066258ce0b8fdba63a714c4f8.exe
548	18f4e82898557ba7f23f5b58e181793aee6b9ee066258ce0b8fdba63a714c4f8.exe
2468	chrome.exe
2468	chrome.exe
548	18f4e82898557ba7f23f5b58e181793aee6b9ee066258ce0b8fdba63a714c4f8.exe
548	18f4e82898557ba7f23f5b58e181793aee6b9ee066258ce0b8fdba63a714c4f8.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2744	chrome.exe
2468	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 2744	548	18f4e82898557ba7f23f5b58e181793aee6b9ee066258ce0b8fdba63a714c4f8.exe	32
PID 548 wrote to memory of 2744	548	18f4e82898557ba7f23f5b58e181793aee6b9ee066258ce0b8fdba63a714c4f8.exe	32
PID 548 wrote to memory of 2744	548	18f4e82898557ba7f23f5b58e181793aee6b9ee066258ce0b8fdba63a714c4f8.exe	32
PID 548 wrote to memory of 2744	548	18f4e82898557ba7f23f5b58e181793aee6b9ee066258ce0b8fdba63a714c4f8.exe	32
PID 2744 wrote to memory of 2792	2744	chrome.exe	33
PID 2744 wrote to memory of 2792	2744	chrome.exe	33
PID 2744 wrote to memory of 2792	2744	chrome.exe	33
PID 2744 wrote to memory of 2860	2744	chrome.exe	34
PID 2744 wrote to memory of 2860	2744	chrome.exe	34
PID 2744 wrote to memory of 2860	2744	chrome.exe	34
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 2596	2744	chrome.exe	36
PID 2744 wrote to memory of 532	2744	chrome.exe	37
PID 2744 wrote to memory of 532	2744	chrome.exe	37
PID 2744 wrote to memory of 532	2744	chrome.exe	37
PID 2744 wrote to memory of 652	2744	chrome.exe	38
PID 2744 wrote to memory of 652	2744	chrome.exe	38
PID 2744 wrote to memory of 652	2744	chrome.exe	38
PID 2744 wrote to memory of 652	2744	chrome.exe	38
PID 2744 wrote to memory of 652	2744	chrome.exe	38
PID 2744 wrote to memory of 652	2744	chrome.exe	38
PID 2744 wrote to memory of 652	2744	chrome.exe	38
PID 2744 wrote to memory of 652	2744	chrome.exe	38
PID 2744 wrote to memory of 652	2744	chrome.exe	38
PID 2744 wrote to memory of 652	2744	chrome.exe	38
PID 2744 wrote to memory of 652	2744	chrome.exe	38
PID 2744 wrote to memory of 652	2744	chrome.exe	38

C:\Users\Admin\AppData\Local\Temp\18f4e82898557ba7f23f5b58e181793aee6b9ee066258ce0b8fdba63a714c4f8.exe
"C:\Users\Admin\AppData\Local\Temp\18f4e82898557ba7f23f5b58e181793aee6b9ee066258ce0b8fdba63a714c4f8.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7059758,0x7fef7059768,0x7fef7059778
    3⤵
    PID:2792
- - C:\Windows\system32\ctfmon.exe
    ctfmon.exe
    3⤵
    PID:2860
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1104 --field-trial-handle=1272,i,3797828775315931129,10152759985609263803,131072 /prefetch:2
    3⤵
    PID:2596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1512 --field-trial-handle=1272,i,3797828775315931129,10152759985609263803,131072 /prefetch:8
    3⤵
    PID:532
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1620 --field-trial-handle=1272,i,3797828775315931129,10152759985609263803,131072 /prefetch:8
    3⤵
    PID:652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1992 --field-trial-handle=1272,i,3797828775315931129,10152759985609263803,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:896
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2476 --field-trial-handle=1272,i,3797828775315931129,10152759985609263803,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1272
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2492 --field-trial-handle=1272,i,3797828775315931129,10152759985609263803,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1292 --field-trial-handle=1272,i,3797828775315931129,10152759985609263803,131072 /prefetch:2
    3⤵
    PID:2628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7059758,0x7fef7059768,0x7fef7059778
    3⤵
    PID:900
- - C:\Windows\system32\ctfmon.exe
    ctfmon.exe
    3⤵
    PID:2144
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1228,i,1754917251647833308,9120073039425548626,131072 /prefetch:2
    3⤵
    PID:1624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1512 --field-trial-handle=1228,i,1754917251647833308,9120073039425548626,131072 /prefetch:8
    3⤵
    PID:2540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1492 --field-trial-handle=1228,i,1754917251647833308,9120073039425548626,131072 /prefetch:8
    3⤵
    PID:2776
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2368 --field-trial-handle=1228,i,1754917251647833308,9120073039425548626,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1852
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2660 --field-trial-handle=1228,i,1754917251647833308,9120073039425548626,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2668 --field-trial-handle=1228,i,1754917251647833308,9120073039425548626,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1252 --field-trial-handle=1228,i,1754917251647833308,9120073039425548626,131072 /prefetch:2
    3⤵
    PID:2820
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3800 --field-trial-handle=1228,i,1754917251647833308,9120073039425548626,131072 /prefetch:8
    3⤵
    PID:2288

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2856

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\GDHCGDGI

Filesize
92KB

MD5
c60eeaeed7335179c4f79cf79d071376

SHA1
8e78eda78300965c3815418ecb0214c4c48d7e9e

SHA256
b66b4540a615966e5de7dd8317528d2797bc347c3c8278bf3217cb103f499365

SHA512
e5b106aad5675a50a12d6187636c6f2994e8660323e915ffdeac3e6c00cd169160643e697d59e4a866c9869bc198ef39ec67e73c691529bbffa71d007272136e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
c71a70ef46590ef0016a755286ca78ea

SHA1
f333ef55abb71212507b4796cb0e39940dd9280f

SHA256
36315c353e2802a76481df39dfd6b80bdc993f3db521aef716a1f927990decf3

SHA512
333e0c4300fd0baf59072bbf7c363c62e11d7b2351ec9e84125dec4c1047dd29bedaf99fd1c3bcc3fa43353a51f2b006030829b8c5615a7b29ffb9ed3a903295

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000009.dbtmp

Filesize
16B

MD5
979c29c2917bed63ccf520ece1d18cda

SHA1
65cd81cdce0be04c74222b54d0881d3fdfe4736c

SHA256
b3524365a633ee6d1fa9953638d2867946c515218c497a5ec2dbef7dc44a7c53

SHA512
e38f694fd6ab9f678ae156528230d7a8bfb7b59a13b227f59f9c38ab5617db11ebb6be1276323a905d09c4066a3fe820cf58077ab48bf201f3c467a98516ee7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000010.dbtmp

Filesize
16B

MD5
60e3f691077715586b918375dd23c6b0

SHA1
476d3eab15649c40c6aebfb6ac2366db50283d1b

SHA256
e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee

SHA512
d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Affiliation Database

Filesize
32KB

MD5
69e3a8ecda716584cbd765e6a3ab429e

SHA1
f0897f3fa98f6e4863b84f007092ab843a645803

SHA256
e0c9f1494a417f356b611ec769b975a4552c4065b0bc2181954fcbb4b3dfa487

SHA512
bb78069c17196da2ce8546046d2c9d9f3796f39b9868b749ecada89445da7a03c9b54a00fcf34a23eb0514c871e026ac368795d2891bbf37e1dc5046c29beaaa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Extension Scripts\LOG

Filesize
192B

MD5
ebf38673bf3d943c4e045fe41663b413

SHA1
8d73351bd98891f8ca2d2b850050fd29e58bd159

SHA256
6cc88cbf45b96a3fd3f49949803908d01c4bc77cba41dc193dd641cf47c92d49

SHA512
ba0f044f4d8f83dfa3afc00a984a1f47c17a1ad07e21a9b659561284c07d0f02f2b49fb6797a80f3f6ea07de4e6d9a34f89a61f0cb6160e8c544ba502a9ebe6f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Login Data

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\LOG

Filesize
204B

MD5
5964a33a35e51abaa60a0924e126bc64

SHA1
4ef5b8c2ef0c9fbbe76cd520fb95ca5cfda9bd47

SHA256
93834825cd9dd5497e0435b50aac2f940e9f7521310e79a02d8d5ac88237ec03

SHA512
93108ebc2c04df80a73290a7f016bc2406f80891281e444df4791128de6074797e67993c370560c109d09145059e295a53ded6328c02759e1f54b536d1c33ae3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\000003.log

Filesize
46B

MD5
90881c9c26f29fca29815a08ba858544

SHA1
06fee974987b91d82c2839a4bb12991fa99e1bdd

SHA256
a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a

SHA512
15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\LOG

Filesize
192B

MD5
0baefdbd4cf25e400fc3b32abee00b69

SHA1
9a561b9f32016ed2f990446a515103223778d193

SHA256
8cd3ae2a9ee4de00cc6eccf6b6c2a5cbbe26d2eace15b7b725381b5799b8a08e

SHA512
49ca817185c5b712e957ca6c475a828438cef95b03c49caeecf7b04c415d9a1b2c7cd41d159534621de3ff045a0909f7cc0b9882e0f17d4126c54f9e6561fc1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Visited Links

Filesize
128KB

MD5
d0326688a6960273de89e952152bf435

SHA1
e16d0515bd7811030875b9741cddfff420d51526

SHA256
0d63fb399981b0b9ab56512496c1e84a48bd2f50f29f668ab0022b0c67300e2f

SHA512
fc2a04c1617395d840e17528bb02c558d265e615e0d6c08d39475cd4d118efa72604b644d7a1661385cf9fbcbcdc5727bd565545ccd015dd84248f0d4de28a68

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\shared_proto_db\000003.log

Filesize
19B

MD5
0407b455f23e3655661ba46a574cfca4

SHA1
855cb7cc8eac30458b4207614d046cb09ee3a591

SHA256
ab5c71347d95f319781df230012713c7819ac0d69373e8c9a7302cae3f9a04b7

SHA512
3020f7c87dc5201589fa43e03b1591ed8beb64523b37eb3736557f3ab7d654980fb42284115a69d91de44204cefab751b60466c0ef677608467de43d41bfb939

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\shared_proto_db\LOG

Filesize
190B

MD5
55d4c8794731aa241e19a75658fde220

SHA1
09d9b54711f3ccce597c1a170af4a45e643e827f

SHA256
b19cd52925d1f379b1c70f4b1c9f2784da835c92cbc0a328f0bfcc9e12debf50

SHA512
03ca406096fa438bdf785c8adb1ef85e27433d92763cb7f51f52de616153bb2b3294a1176de7a74d781ab445df4d2cca5da2bdb833e645e226a3df6e95dca13d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\shared_proto_db\metadata\000003.log

Filesize
184B

MD5
ef1ad94d12e3c67f516d3a0c49596056

SHA1
9767dcdf6ff8471fdebec419fdb1b94e387f0fba

SHA256
d47b06c9062c95f26d242b6e3b95e881f30380f31e7152e2113a513421fc6dd9

SHA512
a52d07aa6e8d856e2acdce31d0fcfc91cdf8080eb644a5797140ea73180a315033e6026a044a3de2caac1b3c52c636f40bc66091b515c914c5eae4a00abf8f5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\shared_proto_db\metadata\LOG

Filesize
199B

MD5
9332646866b4ad4a0ea4bbc5ff48a216

SHA1
228ba07802adf8ef11ef85087e86ed550291f5b9

SHA256
6f127744849651529dc480b7c776712020c9fd6b3ca81c868f66db5fc5d12c96

SHA512
67cb4b0e322b8b590a277a6911986df21ae2b824ff8d75b3b21ddc4de1cb962a8313d6a13cc8154c4930e04c03604eda0ba113c5163d9ccf2da78acd467d5ee5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
9eae63c7a967fc314dd311d9f46a45b7

SHA1
caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

SHA256
4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

SHA512
bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\000003.log

Filesize
76B

MD5
cc4a8cff19abf3dd35d63cff1503aa5f

SHA1
52af41b0d9c78afcc8e308db846c2b52a636be38

SHA256
cc5dacf370f324b77b50dddf5d995fd3c7b7a587cb2f55ac9f24c929d0cd531a

SHA512
0e9559cda992aa2174a7465745884f73b96755008384d21a0685941acf099c89c8203b13551de72a87b8e23cdaae3fa513bc700b38e1bf3b9026955d97920320

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\LOG

Filesize
193B

MD5
d81a38198c2fcd736154c480610979fa

SHA1
11faf0649c25840941feacdd0867d3a79af74eb3

SHA256
41b1c614b5383d68e19cf5f9a49f3c264acf365c8a511605dfe316a2de8ffe98

SHA512
978ce7154b751ae077aea18966f7dd6f4aa1fd54cd8dc1d9077fef23a0b5088973fd3508995a9c71e684bc038af84b71ab61784c38750c7a3e1e0a8e4ab1644a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Favicons

Filesize
20KB

MD5
3eea0768ded221c9a6a17752a09c969b

SHA1
d17d8086ed76ec503f06ddd0ac03d915aec5cdc7

SHA256
6923fd51e36b8fe40d6d3dd132941c5a693b02f6ae4d4d22b32b5fedd0e7b512

SHA512
fb5c51adf5a5095a81532e3634f48f5aedb56b7724221f1bf1ccb626cab40f87a3b07a66158179e460f1d0e14eeb48f0283b5df6471dd7a6297af6e8f3efb1f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\History

Filesize
148KB

MD5
90a1d4b55edf36fa8b4cc6974ed7d4c4

SHA1
aba1b8d0e05421e7df5982899f626211c3c4b5c1

SHA256
7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

SHA512
ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\000003.log

Filesize
40B

MD5
148079685e25097536785f4536af014b

SHA1
c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

SHA256
f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

SHA512
c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\LOG

Filesize
205B

MD5
dd326cc9ea9860dfc08731d9915ba40a

SHA1
27672888263a08187a1c4e94d964de50a7c59e4d

SHA256
1ed09ef8aaa5a63be6d5b40b0f45662b6cd5f85752508a08d400ebd23f6a99e1

SHA512
9cde421c10a814cf399fead412c5d0755d19c42b769897e0f40ee277e79e73e147fbdccaef921dc2a75fe6637d0e581e75a4cdc705f4b236543a7874ec3d16f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\MANIFEST-000002

Filesize
50B

MD5
22bf0e81636b1b45051b138f48b3d148

SHA1
56755d203579ab356e5620ce7e85519ad69d614a

SHA256
e292f241daafc3df90f3e2d339c61c6e2787a0d0739aac764e1ea9bb8544ee97

SHA512
a4cf1f5c74e0df85dda8750be9070e24e19b8be15c6f22f0c234ef8423ef9ca3db22ba9ef777d64c33e8fd49fada6fcca26c1a14ba18e8472370533a1c65d8d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\CURRENT~RFf76eaad.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Visited Links

Filesize
128KB

MD5
41f1455c0da85aa52cb610d0a7e8a40d

SHA1
c7a8bad067c869666a9f96bf40e8502a8ee0abf6

SHA256
1846ba78577093245b34d2d00baef97cbbe33de8d95e44487a3f48ac3d9e64e4

SHA512
5813147ba107ad1d87c616da3119f5fbb395c9efb9efa23f282ee351bc3891dda0a44adce90721906c430ad235745a8dffb337e4de405cdb720e1468a3679175

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\shared_proto_db\LOG

Filesize
191B

MD5
2be3074bfc4d0c436d7b7217e9364c21

SHA1
5d0c3641c117984517a9f9ea7e2ceae13df94009

SHA256
903b00f5b2e51994176f0760ba8e0031bcbab3a920aa28f894009194294523c0

SHA512
24301714a2db29686bbf878174998b077d018b0bf947b6b5742de73df1cf2036aeddb21898c41fa10fc93a60c254aac059a6a40b3c65241ed01cea3292ae02b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\shared_proto_db\metadata\000003.log

Filesize
213B

MD5
e0a9d9b8577082ee49dcf776c3c7fc54

SHA1
ff844b114dbfdb376de15159be19fd122bae6176

SHA256
84b8e8ec59d84e4d09e07716d84a1a1b38dbdb4b3d4ef370d02803394c29a782

SHA512
ea4f65b37c90f1a6996229ff741923c5133c4766c61f1ccbf4c4ada0976c21ad2eeeb45addf58313bc4de4884f2461579572eb7adb4691ae6c65c26655d74dc6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\shared_proto_db\metadata\LOG

Filesize
200B

MD5
db5b170c624786e8634b7a575e87921c

SHA1
5ae31c92af96c0377a721ffbe6f14a7081b6604d

SHA256
9dc417198fee17d998767147258a3b8f60a08d077b580a70339fc251d7ca5a2e

SHA512
7998c8f1242966c6efd3d3e779e43268ca3db193b240a91220888cf97f666a243805efcddd5445ada252028c622190074e092b461cc7d9042e03e1a29b0d3345

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
memory/548-0-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download