Resubmissions
02/02/2023, 03:06
230202-dlzwvsee691002/02/2023, 03:04
230202-dk4tesee62102/02/2023, 02:57
230202-df3qkaee336Analysis
- max time kernel
53s - max time network
57s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
02/02/2023, 03:04
Static task
static1
Behavioral task
behavioral1
Sample
Petya.A.zip
Resource
win7-20221111-en
windows7-x64
0 signatures
1200 seconds
Behavioral task
behavioral2
Sample
Petya.A.zip
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
1200 seconds
General
- Target Petya.A.zip
- Size 133KB
- Sample230202-dk4tesee62
- SHA256 373c74b50f3db82289c7d04e2ae5b49af8a4f0f5aef2ebd62dd633dc16f76306
- MD5 82e7fcb4516fe8aa646853a3dd996b52
- SHA1 548f18a1d50b0a0eb38a4a7d5e31212e423071c1
- SHA512 687560aaa21657bd00b0dafb0efc43cc23a3451f04c874bcdf1e369a4495bea92da0d8674efcb188857735e49127530aca8ae7b69f9d0c4d0580d3223bf98119
- SSDEEP 3072:pxTRgFloaoWrgdNHWkw1SBq25tdRRBXQmEZP6u3OP9HCmeDuqJkBgtBI38Etu8q5:HTRgFloQDuqJegtBI38EY8qiy1v+m//Z
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1844 chrome.exe 1844 chrome.exe 2156 chrome.exe 2156 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2156 wrote to memory of 4988 2156 chrome.exe 100 PID 2156 wrote to memory of 4988 2156 chrome.exe 100 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 2704 2156 chrome.exe 101 PID 2156 wrote to memory of 1844 2156 chrome.exe 102 PID 2156 wrote to memory of 1844 2156 chrome.exe 102 PID 2156 wrote to memory of 2412 2156 chrome.exe 103 PID 2156 wrote to memory of 2412 2156 chrome.exe 103 PID 2156 wrote to memory of 2412 2156 chrome.exe 103 PID 2156 wrote to memory of 2412 2156 chrome.exe 103 PID 2156 wrote to memory of 2412 2156 chrome.exe 103 PID 2156 wrote to memory of 2412 2156 chrome.exe 103 PID 2156 wrote to memory of 2412 2156 chrome.exe 103 PID 2156 wrote to memory of 2412 2156 chrome.exe 103 PID 2156 wrote to memory of 2412 2156 chrome.exe 103 PID 2156 wrote to memory of 2412 2156 chrome.exe 103 PID 2156 wrote to memory of 2412 2156 chrome.exe 103 PID 2156 wrote to memory of 2412 2156 chrome.exe 103 PID 2156 wrote to memory of 2412 2156 chrome.exe 103 PID 2156 wrote to memory of 2412 2156 chrome.exe 103 PID 2156 wrote to memory of 2412 2156 chrome.exe 103 PID 2156 wrote to memory of 2412 2156 chrome.exe 103 PID 2156 wrote to memory of 2412 2156 chrome.exe 103 PID 2156 wrote to memory of 2412 2156 chrome.exe 103 PID 2156 wrote to memory of 2412 2156 chrome.exe 103 PID 2156 wrote to memory of 2412 2156 chrome.exe 103
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Petya.A.zip1⤵PID:4260
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2328
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbc7394f50,0x7ffbc7394f60,0x7ffbc7394f702⤵PID:4988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1584,885031779769217967,3305072289292727315,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1600 /prefetch:22⤵PID:2704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1584,885031779769217967,3305072289292727315,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1980 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1584,885031779769217967,3305072289292727315,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2280 /prefetch:82⤵PID:2412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,885031779769217967,3305072289292727315,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2932 /prefetch:12⤵PID:3800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,885031779769217967,3305072289292727315,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:12⤵PID:1156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,885031779769217967,3305072289292727315,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:12⤵PID:3276
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2088