vidar | 5233534a5ec895ebc0061424784dbd967f9eba299375e00db31e7d9f976c6ef7

Resubmissions

14-02-2025 20:12

250214-yyzrvaxphr 10

12-02-2025 14:07

250212-re517avlgt 10

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250207-en
resource tags

arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2025 14:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test.ps1
Size

1KB
MD5

6816f3334a46e8ff14edd35a88fbd2bf
SHA1

3680ed31cf3c03b9db142d2feefe0b4a546930e2
SHA256

5233534a5ec895ebc0061424784dbd967f9eba299375e00db31e7d9f976c6ef7
SHA512

66300062b53b298c6a58a2d793b3b47e5c0cd65aed06ed794ac6d1e4258390ee75b9ff5c9f245db7b689d6e2e1cba4980ebd6984df311d2c5df1d5e9ff8f1863

Score

10^/10

vidar credential_access discovery execution stealer

Malware Config

Extracted

Family

vidar

https://t.me/sok33tn

https://steamcommunity.com/profiles/76561199824159981

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0

Signatures

Detect Vidar Stealer 18 IoCs

stealer

resource	yara_rule
behavioral2/memory/4920-58-0x00000000006D0000-0x00000000006F2000-memory.dmp	family_vidar_v7
behavioral2/memory/4920-50-0x00000000006D0000-0x00000000006F2000-memory.dmp	family_vidar_v7
behavioral2/memory/4920-54-0x00000000006D0000-0x00000000006F2000-memory.dmp	family_vidar_v7
behavioral2/memory/4920-59-0x00000000006D0000-0x00000000006F2000-memory.dmp	family_vidar_v7
behavioral2/memory/4920-66-0x00000000006D0000-0x00000000006F2000-memory.dmp	family_vidar_v7
behavioral2/memory/4920-67-0x00000000006D0000-0x00000000006F2000-memory.dmp	family_vidar_v7
behavioral2/memory/4920-97-0x00000000006D0000-0x00000000006F2000-memory.dmp	family_vidar_v7
behavioral2/memory/4920-111-0x00000000006D0000-0x00000000006F2000-memory.dmp	family_vidar_v7
behavioral2/memory/4920-117-0x00000000006D0000-0x00000000006F2000-memory.dmp	family_vidar_v7
behavioral2/memory/4920-120-0x00000000006D0000-0x00000000006F2000-memory.dmp	family_vidar_v7
behavioral2/memory/4920-125-0x00000000006D0000-0x00000000006F2000-memory.dmp	family_vidar_v7
behavioral2/memory/4920-129-0x00000000006D0000-0x00000000006F2000-memory.dmp	family_vidar_v7
behavioral2/memory/4920-130-0x00000000006D0000-0x00000000006F2000-memory.dmp	family_vidar_v7
behavioral2/memory/4920-132-0x00000000006D0000-0x00000000006F2000-memory.dmp	family_vidar_v7
behavioral2/memory/4920-133-0x00000000006D0000-0x00000000006F2000-memory.dmp	family_vidar_v7
behavioral2/memory/4920-160-0x00000000006D0000-0x00000000006F2000-memory.dmp	family_vidar_v7
behavioral2/memory/4920-166-0x00000000006D0000-0x00000000006F2000-memory.dmp	family_vidar_v7
behavioral2/memory/4920-169-0x00000000006D0000-0x00000000006F2000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	3444	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
2	3444	powershell.exe
33	3416	Process not Found

Uses browser remote debugging 2 TTPs 9 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3016	msedge.exe
1196	msedge.exe
4736	msedge.exe
1996	msedge.exe
4996	chrome.exe
1632	chrome.exe
1912	chrome.exe
2828	msedge.exe
1544	chrome.exe

Executes dropped EXE 1 IoCs

pid	Process
2856	updater.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2856 set thread context of 4920	2856	updater.exe	97

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3444	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3560	MicrosoftEdgeUpdate.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	BitLockerToGo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133838429650047534"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	powershell.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3444	powershell.exe
3444	powershell.exe
4920	BitLockerToGo.exe
4920	BitLockerToGo.exe
4920	BitLockerToGo.exe
4920	BitLockerToGo.exe
1544	chrome.exe
1544	chrome.exe
4920	BitLockerToGo.exe
4920	BitLockerToGo.exe
4920	BitLockerToGo.exe
4920	BitLockerToGo.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
3796	msedge.exe
3796	msedge.exe
3016	msedge.exe
3016	msedge.exe
4920	BitLockerToGo.exe
4920	BitLockerToGo.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	3444	powershell.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 2856	3444	powershell.exe	96
PID 3444 wrote to memory of 2856	3444	powershell.exe	96
PID 3444 wrote to memory of 2856	3444	powershell.exe	96
PID 2856 wrote to memory of 4920	2856	updater.exe	97
PID 2856 wrote to memory of 4920	2856	updater.exe	97
PID 2856 wrote to memory of 4920	2856	updater.exe	97
PID 2856 wrote to memory of 4920	2856	updater.exe	97
PID 2856 wrote to memory of 4920	2856	updater.exe	97
PID 2856 wrote to memory of 4920	2856	updater.exe	97
PID 2856 wrote to memory of 4920	2856	updater.exe	97
PID 2856 wrote to memory of 4920	2856	updater.exe	97
PID 2856 wrote to memory of 4920	2856	updater.exe	97
PID 2856 wrote to memory of 4920	2856	updater.exe	97
PID 2856 wrote to memory of 4920	2856	updater.exe	97
PID 4920 wrote to memory of 1544	4920	BitLockerToGo.exe	98
PID 4920 wrote to memory of 1544	4920	BitLockerToGo.exe	98
PID 1544 wrote to memory of 960	1544	chrome.exe	99
PID 1544 wrote to memory of 960	1544	chrome.exe	99
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2192	1544	chrome.exe	100
PID 1544 wrote to memory of 2536	1544	chrome.exe	101
PID 1544 wrote to memory of 2536	1544	chrome.exe	101
PID 1544 wrote to memory of 1540	1544	chrome.exe	102
PID 1544 wrote to memory of 1540	1544	chrome.exe	102
PID 1544 wrote to memory of 1540	1544	chrome.exe	102
PID 1544 wrote to memory of 1540	1544	chrome.exe	102
PID 1544 wrote to memory of 1540	1544	chrome.exe	102
PID 1544 wrote to memory of 1540	1544	chrome.exe	102
PID 1544 wrote to memory of 1540	1544	chrome.exe	102
PID 1544 wrote to memory of 1540	1544	chrome.exe	102
PID 1544 wrote to memory of 1540	1544	chrome.exe	102
PID 1544 wrote to memory of 1540	1544	chrome.exe	102
PID 1544 wrote to memory of 1540	1544	chrome.exe	102
PID 1544 wrote to memory of 1540	1544	chrome.exe	102
PID 1544 wrote to memory of 1540	1544	chrome.exe	102
PID 1544 wrote to memory of 1540	1544	chrome.exe	102

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\test.ps1
1⤵
- Blocklisted process makes network request
- Downloads MZ/PE file
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Users\Admin\AppData\Local\e0093100-0a8a-42b4-8042-f2dd3a1477a9\updater.exe
  "C:\Users\Admin\AppData\Local\e0093100-0a8a-42b4-8042-f2dd3a1477a9\updater.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4920
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1544
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb8d7fcc40,0x7ffb8d7fcc4c,0x7ffb8d7fcc58
        5⤵
        
        PID:960
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1932,i,10451332277375189475,11136558125181680723,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=1928 /prefetch:2
        5⤵
        
        PID:2192
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1516,i,10451332277375189475,11136558125181680723,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=2460 /prefetch:3
        5⤵
        
        PID:2536
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2172,i,10451332277375189475,11136558125181680723,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=2600 /prefetch:8
        5⤵
        
        PID:1540
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3172,i,10451332277375189475,11136558125181680723,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=3192 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4996
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3200,i,10451332277375189475,11136558125181680723,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=3240 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1632
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3932,i,10451332277375189475,11136558125181680723,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=4596 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1912
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3656,i,10451332277375189475,11136558125181680723,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=4620 /prefetch:8
        5⤵
        
        PID:4992
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4572,i,10451332277375189475,11136558125181680723,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=4660 /prefetch:8
        5⤵
        
        PID:636
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4516,i,10451332277375189475,11136558125181680723,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=4568 /prefetch:8
        5⤵
        
        PID:4604
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4888,i,10451332277375189475,11136558125181680723,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=4932 /prefetch:8
        5⤵
        
        PID:3796
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4556,i,10451332277375189475,11136558125181680723,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=4460 /prefetch:8
        5⤵
        
        PID:1892
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4932,i,10451332277375189475,11136558125181680723,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=4740 /prefetch:8
        5⤵
        
        PID:4584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:3016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb8d9246f8,0x7ffb8d924708,0x7ffb8d924718
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:1140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,14217512883538802219,3065823905192625404,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
        5⤵
        
        PID:4712
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,14217512883538802219,3065823905192625404,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2532 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,14217512883538802219,3065823905192625404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
        5⤵
        
        PID:4972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2140,14217512883538802219,3065823905192625404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2140,14217512883538802219,3065823905192625404,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2140,14217512883538802219,3065823905192625404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2140,14217512883538802219,3065823905192625404,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1996

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Qjg0RTQyMUUtMUNEQy00ODA1LTgxQUItNDM0Qzc0NzQ4NjI5fSIgdXNlcmlkPSJ7NDZENUIwMzgtN0Y1Qy00ODlELUI0MEItM0Y1NENBNDkyQ0FCfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7N0QxRDczMUEtNDREQS00MEExLUI2OTMtNTVDNTQ1MjgzMkU1fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI0IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDcxNzgiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxOTY4MDM3MTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTYxMzI3MzA3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:3560

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
246KB

MD5
625f86721c1c5bd64da920ed03fc7d2c

SHA1
ac3fe44bcb8763a7244729ac2e93e36a645884a1

SHA256
efcc83fd3fa8a3a75ad3b6821407c98f869932ee37fb45fbcf33c050ea242a85

SHA512
394cc75c7aaa71b0dabf4bed1027e1a64d658661e504aabcbaab0d9e3e1fa84ca022142054b3498e96a9570287ddf25c243d508b7e764577ca3ebd5ddade66bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d44f6d6e7efe70fab6c852bb5b7455a0

SHA1
0e10115d677f55f7cb4b5721e1275df5c01ea842

SHA256
aa26ea90b867a3f439ee88c55f31b5a7890b3503ab814fea2d27f0149c9aafc4

SHA512
ee5f719de53d37e809361d56039002e974f0cf1561079ada1f5cd2ea2db310cb80226ba8b9bca687c2ddf9696b71abcfffd8d5dba4a07198e1e4d3b4e2e0c3e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb0cb9bc9bc47b241cea8a15930aaf18

SHA1
bea4efbadb649764c8c0dde5ffb550e2a5f91a26

SHA256
7ba3da7afec53ca47958b26551707592ea453b1af13688f37fe0e1ef411a8b8a

SHA512
9eccc1a158c23dc034e4676ee071414bf9c67912b5e2ab6181d325167ce008e13c916967be62c845d4c7f637c03cca9676af0c41ec5e946925050090d0b49e1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4ffe98a53125d91e61148666a25adbf3

SHA1
b91dac96ec3a7e52b3619aa8f35803d3a3d67ca5

SHA256
3ebac406253400a0e53ca594f3da654c19ab7b9485e38f3c272b59eba2cdf577

SHA512
3d499d373124f66de027f7f9e3d901fae4a78e2155f97d476dd701d16ecaab22840494dc745da80dc71a93b4c00bb3e9efd7d8a4653e577fc7e0687727ded80c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mko0rs40.vnh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\e0093100-0a8a-42b4-8042-f2dd3a1477a9\updater.exe

Filesize
5.0MB

MD5
0eb5d5bc68a30d4fa858a260c0607e20

SHA1
edec0acf854acbce18471c2b6789cc503a0f0171

SHA256
964ff006219ac3c428ecd794a7727c3d6e67e28b32380bf60ad9aaecaccbb496

SHA512
74e810cc4efd231542654a2ce8c6cb9a1ce994c639ed53b5549ee58eed391652e8fe9b0c490651e2a45dc72f7bd8e835de119e5a061bd5651abdc4833ad52867

Download Submit
memory/3444-11-0x00007FFB93EA0000-0x00007FFB94961000-memory.dmp

Filesize
10.8MB

Download
memory/3444-0-0x00007FFB93EA3000-0x00007FFB93EA5000-memory.dmp

Filesize
8KB

Download
memory/3444-14-0x00007FFB93EA0000-0x00007FFB94961000-memory.dmp

Filesize
10.8MB

Download
memory/3444-13-0x00007FFB93EA3000-0x00007FFB93EA5000-memory.dmp

Filesize
8KB

Download
memory/3444-12-0x00007FFB93EA0000-0x00007FFB94961000-memory.dmp

Filesize
10.8MB

Download
memory/3444-10-0x0000018D29B10000-0x0000018D29B32000-memory.dmp

Filesize
136KB

Download
memory/4920-58-0x00000000006D0000-0x00000000006F2000-memory.dmp

Filesize
136KB

Download
memory/4920-129-0x00000000006D0000-0x00000000006F2000-memory.dmp

Filesize
136KB

Download
memory/4920-66-0x00000000006D0000-0x00000000006F2000-memory.dmp

Filesize
136KB

Download
memory/4920-59-0x00000000006D0000-0x00000000006F2000-memory.dmp

Filesize
136KB

Download
memory/4920-97-0x00000000006D0000-0x00000000006F2000-memory.dmp

Filesize
136KB

Download
memory/4920-111-0x00000000006D0000-0x00000000006F2000-memory.dmp

Filesize
136KB

Download
memory/4920-117-0x00000000006D0000-0x00000000006F2000-memory.dmp

Filesize
136KB

Download
memory/4920-120-0x00000000006D0000-0x00000000006F2000-memory.dmp

Filesize
136KB

Download
memory/4920-125-0x00000000006D0000-0x00000000006F2000-memory.dmp

Filesize
136KB

Download
memory/4920-67-0x00000000006D0000-0x00000000006F2000-memory.dmp

Filesize
136KB

Download
memory/4920-130-0x00000000006D0000-0x00000000006F2000-memory.dmp

Filesize
136KB

Download
memory/4920-132-0x00000000006D0000-0x00000000006F2000-memory.dmp

Filesize
136KB

Download
memory/4920-133-0x00000000006D0000-0x00000000006F2000-memory.dmp

Filesize
136KB

Download
memory/4920-49-0x00000000006D0000-0x00000000006F2000-memory.dmp

Filesize
136KB

Download
memory/4920-54-0x00000000006D0000-0x00000000006F2000-memory.dmp

Filesize
136KB

Download
memory/4920-50-0x00000000006D0000-0x00000000006F2000-memory.dmp

Filesize
136KB

Download
memory/4920-160-0x00000000006D0000-0x00000000006F2000-memory.dmp

Filesize
136KB

Download
memory/4920-166-0x00000000006D0000-0x00000000006F2000-memory.dmp

Filesize
136KB

Download
memory/4920-169-0x00000000006D0000-0x00000000006F2000-memory.dmp

Filesize
136KB

Download