Analysis
-
max time kernel
156s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 04:02
Static task
static1
Behavioral task
behavioral1
Sample
c7f63cfde7f4ab54c8057ab0674c5e039869b07a33191bd4edad43e5476a8598.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
300 seconds
Behavioral task
behavioral2
Sample
c7f63cfde7f4ab54c8057ab0674c5e039869b07a33191bd4edad43e5476a8598.exe
Resource
win10-20220812-en
windows10-1703-x64
10 signatures
300 seconds
General
-
Target
c7f63cfde7f4ab54c8057ab0674c5e039869b07a33191bd4edad43e5476a8598.exe
-
Size
1.4MB
-
MD5
bcd3feac8bf61e44217b1a3d34375100
-
SHA1
f9f53b2d1a17cb064c976fd66eec8937b2f88dec
-
SHA256
c7f63cfde7f4ab54c8057ab0674c5e039869b07a33191bd4edad43e5476a8598
-
SHA512
ea07b8a23b96e534c2c634d415251d2829bdcf6420835e0f8d311c14a77853370121a1c201a00e06ce2db3d838d97830f04292c59dc5ceb0d38c2d50e0222f6b
-
SSDEEP
24576:TrYqrk6ddiMV5vw9Yxy4b0+bDWtWd5H8cQcS7hKvhAAbpQh04+bnWc:Trhk6XB5w9Z4b0WDW8Bxm7h0AAbLWc
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 240 explorer.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1960 c7f63cfde7f4ab54c8057ab0674c5e039869b07a33191bd4edad43e5476a8598.exe 240 explorer.exe 564 chrome.exe 936 chrome.exe 936 chrome.exe 1240 chrome.exe 1240 chrome.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1960 c7f63cfde7f4ab54c8057ab0674c5e039869b07a33191bd4edad43e5476a8598.exe 240 explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 240 explorer.exe Token: SeShutdownPrivilege 1240 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1960 wrote to memory of 240 1960 c7f63cfde7f4ab54c8057ab0674c5e039869b07a33191bd4edad43e5476a8598.exe 28 PID 1960 wrote to memory of 240 1960 c7f63cfde7f4ab54c8057ab0674c5e039869b07a33191bd4edad43e5476a8598.exe 28 PID 1960 wrote to memory of 240 1960 c7f63cfde7f4ab54c8057ab0674c5e039869b07a33191bd4edad43e5476a8598.exe 28 PID 1960 wrote to memory of 240 1960 c7f63cfde7f4ab54c8057ab0674c5e039869b07a33191bd4edad43e5476a8598.exe 28 PID 240 wrote to memory of 936 240 explorer.exe 29 PID 240 wrote to memory of 936 240 explorer.exe 29 PID 240 wrote to memory of 936 240 explorer.exe 29 PID 240 wrote to memory of 936 240 explorer.exe 29 PID 936 wrote to memory of 1240 936 chrome.exe 30 PID 936 wrote to memory of 1240 936 chrome.exe 30 PID 936 wrote to memory of 1240 936 chrome.exe 30 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 1012 936 chrome.exe 31 PID 936 wrote to memory of 564 936 chrome.exe 32 PID 936 wrote to memory of 564 936 chrome.exe 32 PID 936 wrote to memory of 564 936 chrome.exe 32 PID 936 wrote to memory of 1228 936 chrome.exe 33 PID 936 wrote to memory of 1228 936 chrome.exe 33 PID 936 wrote to memory of 1228 936 chrome.exe 33 PID 936 wrote to memory of 1228 936 chrome.exe 33 PID 936 wrote to memory of 1228 936 chrome.exe 33 PID 936 wrote to memory of 1228 936 chrome.exe 33 PID 936 wrote to memory of 1228 936 chrome.exe 33 PID 936 wrote to memory of 1228 936 chrome.exe 33 PID 936 wrote to memory of 1228 936 chrome.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7f63cfde7f4ab54c8057ab0674c5e039869b07a33191bd4edad43e5476a8598.exe"C:\Users\Admin\AppData\Local\Temp\c7f63cfde7f4ab54c8057ab0674c5e039869b07a33191bd4edad43e5476a8598.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fefa934f50,0x7fefa934f60,0x7fefa934f704⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1140,6728712110245756968,13113787180232030721,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1152 /prefetch:24⤵PID:1012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1140,6728712110245756968,13113787180232030721,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1456 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1140,6728712110245756968,13113787180232030721,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1660 /prefetch:84⤵PID:1228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1140,6728712110245756968,13113787180232030721,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2064 /prefetch:14⤵PID:432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1140,6728712110245756968,13113787180232030721,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2052 /prefetch:14⤵PID:1908
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40B
MD5bc5979639000670774254dc36b056fa1
SHA1afc397d27f0c416e37ac4c970099acaab24289b0
SHA25688f00296b2d8dd96b3e5dcf6dfb65bfa338ba5e3cc94b538f8bbc60fc63de78c
SHA5126c8f82a2267e912d339ac9bce12db6b22c5e827f9288264021504121b6c2ada8fa816541f1f6ecb0f291affff3b30a1b0097dbd92408cc77a375d4a2a345316e