Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    34s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20230220-es
  • resource tags

    arch:x64arch:x86image:win7-20230220-eslocale:es-esos:windows7-x64systemwindows
  • submitted
    01/04/2023, 16:53

General

  • Target

    Bunny-Nuker-main/Bunny_Nuker_setup.exe

  • Size

    20.7MB

  • MD5

    2c1898617ddd61ab2d58d25e22b86537

  • SHA1

    af873af6e1a123d48058a4e787c0ca2c89aa92c0

  • SHA256

    3624a777a61864553929182e2d4d990fd137dc118fe6b2269319a46827ebab67

  • SHA512

    62b24ddaf7dd3426e1cf87312ebdf250ec05f2a9c133a8cc7981d1ed76eb65092657781d21861b601a12f56d5dce204890b4deb11718c7efb1ccc224d1a46edc

  • SSDEEP

    393216:20XUiYcQrq1FeREWzL2Vmd6ml/m3pMNjTTUv9l97B9BJH7FmlCt6b5dH3rej:hYcQrqjeR3yVmdXKMNXQt7B1bFe1prej

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bunny-Nuker-main\Bunny_Nuker_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Bunny-Nuker-main\Bunny_Nuker_setup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2008
    • C:\Users\Admin\AppData\Local\Temp\Bunny-Nuker-main\Bunny_Nuker_setup.exe
      "C:\Users\Admin\AppData\Local\Temp\Bunny-Nuker-main\Bunny_Nuker_setup.exe"
      2⤵
      • Loads dropped DLL
      PID:1796
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2100
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6e19758,0x7fef6e19768,0x7fef6e19778
      2⤵
        PID:2112
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1176 --field-trial-handle=1312,i,10001009016115412915,6260636835787839778,131072 /prefetch:2
        2⤵
          PID:2320
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1500 --field-trial-handle=1312,i,10001009016115412915,6260636835787839778,131072 /prefetch:8
          2⤵
            PID:2336
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1652 --field-trial-handle=1312,i,10001009016115412915,6260636835787839778,131072 /prefetch:8
            2⤵
              PID:2360
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2220 --field-trial-handle=1312,i,10001009016115412915,6260636835787839778,131072 /prefetch:1
              2⤵
                PID:2576
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2428 --field-trial-handle=1312,i,10001009016115412915,6260636835787839778,131072 /prefetch:1
                2⤵
                  PID:2584
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1176 --field-trial-handle=1312,i,10001009016115412915,6260636835787839778,131072 /prefetch:2
                  2⤵
                    PID:2956
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3632 --field-trial-handle=1312,i,10001009016115412915,6260636835787839778,131072 /prefetch:2
                    2⤵
                      PID:1708
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=2384 --field-trial-handle=1312,i,10001009016115412915,6260636835787839778,131072 /prefetch:1
                      2⤵
                        PID:1808
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3956 --field-trial-handle=1312,i,10001009016115412915,6260636835787839778,131072 /prefetch:8
                        2⤵
                          PID:1372
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4076 --field-trial-handle=1312,i,10001009016115412915,6260636835787839778,131072 /prefetch:8
                          2⤵
                            PID:1752
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4024 --field-trial-handle=1312,i,10001009016115412915,6260636835787839778,131072 /prefetch:8
                            2⤵
                              PID:828
                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                            1⤵
                              PID:2640

                            Network

                            MITRE ATT&CK Enterprise v6

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT~RF6dfbae.TMP

                              Filesize

                              16B

                              MD5

                              46295cac801e5d4857d09837238a6394

                              SHA1

                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                              SHA256

                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                              SHA512

                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                              Filesize

                              264KB

                              MD5

                              f50f89a0a91564d0b8a211f8921aa7de

                              SHA1

                              112403a17dd69d5b9018b8cede023cb3b54eab7d

                              SHA256

                              b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                              SHA512

                              bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              4KB

                              MD5

                              42d51706bd2a6d498dfe6576988d4de5

                              SHA1

                              c123492900e20297f30a8dd2963f0b68f5e71cc5

                              SHA256

                              310b279fd1f03a15fe41dbb735701ad089f4b88800f3c10010c9a862cf48838b

                              SHA512

                              5753895bbef8d73af2c0374501fbf51d53a616676e14646041aa5552364c7a76ad5ecdb17edd0a1d418e7f6fc8f8a564ff184074dd82d6ca6436f2bf1f6bee11

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              4KB

                              MD5

                              0460f85e48a2c2252f601453a53806ad

                              SHA1

                              ed29534b6dbd78908fed648bc9ab241e3bdbf6c3

                              SHA256

                              b06ba4a0f02349697f161e6b8592499028a93ac6b2382bd5cb9b46dfdec61364

                              SHA512

                              3be79ddcb9037747fd6c88a3bce471133e64ae1adb4b5f7e47e4e2a910be4a93cb7aca423d2851d735f27a0065da0148ed04102fd57c78da2791d34724faa425

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000004.dbtmp

                              Filesize

                              16B

                              MD5

                              6752a1d65b201c13b62ea44016eb221f

                              SHA1

                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                              SHA256

                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                              SHA512

                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                            • C:\Users\Admin\AppData\Local\Temp\_MEI20082\api-ms-win-core-file-l1-2-0.dll

                              Filesize

                              11KB

                              MD5

                              35bc1f1c6fbccec7eb8819178ef67664

                              SHA1

                              bbcad0148ff008e984a75937aaddf1ef6fda5e0c

                              SHA256

                              7a3c5167731238cf262f749aa46ab3bfb2ae1b22191b76e28e1d7499d28c24b7

                              SHA512

                              9ab9b5b12215e57af5b3c588ed5003d978071dc591ed18c78c4563381a132edb7b2c508a8b75b4f1ed8823118d23c88eda453cd4b42b9020463416f8f6832a3d

                            • C:\Users\Admin\AppData\Local\Temp\_MEI20082\api-ms-win-core-file-l2-1-0.dll

                              Filesize

                              11KB

                              MD5

                              3bf4406de02aa148f460e5d709f4f67d

                              SHA1

                              89b28107c39bb216da00507ffd8adb7838d883f6

                              SHA256

                              349a79fa1572e3538dfbb942610d8c47d03e8a41b98897bc02ec7e897d05237e

                              SHA512

                              5ff6e8ad602d9e31ac88e06a6fbb54303c57d011c388f46d957aee8cd3b7d7cced8b6bfa821ff347ade62f7359acb1fba9ee181527f349c03d295bdb74efbace

                            • C:\Users\Admin\AppData\Local\Temp\_MEI20082\api-ms-win-core-localization-l1-2-0.dll

                              Filesize

                              13KB

                              MD5

                              8acb83d102dabd9a5017a94239a2b0c6

                              SHA1

                              9b43a40a7b498e02f96107e1524fe2f4112d36ae

                              SHA256

                              059cb23fdcf4d80b92e3da29e9ef4c322edf6fba9a1837978fd983e9bdfc7413

                              SHA512

                              b7ecf60e20098ea509b76b1cc308a954a6ede8d836bf709790ce7d4bd1b85b84cf5f3aedf55af225d2d21fbd3065d01aa201dae6c131b8e1e3aa80ed6fc910a4

                            • C:\Users\Admin\AppData\Local\Temp\_MEI20082\api-ms-win-core-processthreads-l1-1-1.dll

                              Filesize

                              11KB

                              MD5

                              9c9b50b204fcb84265810ef1f3c5d70a

                              SHA1

                              0913ab720bd692abcdb18a2609df6a7f85d96db3

                              SHA256

                              25a99bdf8bf4d16077dc30dd9ffef7bb5a2ceaf9afcee7cf52ad408355239d40

                              SHA512

                              ea2d22234e587ad9fa255d9f57907cc14327ead917fdede8b0a38516e7c7a08c4172349c8a7479ec55d1976a37e520628006f5c362f6a3ec76ec87978c4469cd

                            • C:\Users\Admin\AppData\Local\Temp\_MEI20082\api-ms-win-core-timezone-l1-1-0.dll

                              Filesize

                              11KB

                              MD5

                              43e1ae2e432eb99aa4427bb68f8826bb

                              SHA1

                              eee1747b3ade5a9b985467512215caf7e0d4cb9b

                              SHA256

                              3d798b9c345a507e142e8dacd7fb6c17528cc1453abfef2ffa9710d2fa9e032c

                              SHA512

                              40ec0482f668bde71aeb4520a0709d3e84f093062bfbd05285e2cc09b19b7492cb96cdd6056281c213ab0560f87bd485ee4d2aeefa0b285d2d005634c1f3af0b

                            • C:\Users\Admin\AppData\Local\Temp\_MEI20082\python310.dll

                              Filesize

                              4.2MB

                              MD5

                              a1185bef38fdba5e3fe6a71f93a9d142

                              SHA1

                              e2b40f5e518ad000002b239a84c153fdc35df4eb

                              SHA256

                              8d0bec69554317ccf1796c505d749d5c9f3be74ccbfce1d9e4d5fe64a536ae9e

                              SHA512

                              cb9baea9b483b9153efe2f453d6ac0f0846b140e465d07244f651c946900bfcd768a6b4c0c335ecebb45810bf08b7324501ea22b40cc7061b2f2bb98ed7897f4

                            • C:\Users\Admin\AppData\Local\Temp\_MEI20082\ucrtbase.dll

                              Filesize

                              987KB

                              MD5

                              61eb0ad4c285b60732353a0cb5c9b2ab

                              SHA1

                              21a1bea01f6ca7e9828a522c696853706d0a457b

                              SHA256

                              10521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd

                              SHA512

                              44cd871f48b5193abb3b9664dbea8cdad19e72c47b6967c685cf1cc803bc9abb48a8a93009c972ef4936e7f78e3c92110828790aa0a9d26b80e6a523bbcd830d

                            • C:\Users\Admin\AppData\Local\Temp\_MEI20082\wheel-0.37.1.dist-info\INSTALLER

                              Filesize

                              4B

                              MD5

                              365c9bfeb7d89244f2ce01c1de44cb85

                              SHA1

                              d7a03141d5d6b1e88b6b59ef08b6681df212c599

                              SHA256

                              ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

                              SHA512

                              d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

                            • \Users\Admin\AppData\Local\Temp\_MEI20082\api-ms-win-core-file-l1-2-0.dll

                              Filesize

                              11KB

                              MD5

                              35bc1f1c6fbccec7eb8819178ef67664

                              SHA1

                              bbcad0148ff008e984a75937aaddf1ef6fda5e0c

                              SHA256

                              7a3c5167731238cf262f749aa46ab3bfb2ae1b22191b76e28e1d7499d28c24b7

                              SHA512

                              9ab9b5b12215e57af5b3c588ed5003d978071dc591ed18c78c4563381a132edb7b2c508a8b75b4f1ed8823118d23c88eda453cd4b42b9020463416f8f6832a3d

                            • \Users\Admin\AppData\Local\Temp\_MEI20082\api-ms-win-core-file-l2-1-0.dll

                              Filesize

                              11KB

                              MD5

                              3bf4406de02aa148f460e5d709f4f67d

                              SHA1

                              89b28107c39bb216da00507ffd8adb7838d883f6

                              SHA256

                              349a79fa1572e3538dfbb942610d8c47d03e8a41b98897bc02ec7e897d05237e

                              SHA512

                              5ff6e8ad602d9e31ac88e06a6fbb54303c57d011c388f46d957aee8cd3b7d7cced8b6bfa821ff347ade62f7359acb1fba9ee181527f349c03d295bdb74efbace

                            • \Users\Admin\AppData\Local\Temp\_MEI20082\api-ms-win-core-localization-l1-2-0.dll

                              Filesize

                              13KB

                              MD5

                              8acb83d102dabd9a5017a94239a2b0c6

                              SHA1

                              9b43a40a7b498e02f96107e1524fe2f4112d36ae

                              SHA256

                              059cb23fdcf4d80b92e3da29e9ef4c322edf6fba9a1837978fd983e9bdfc7413

                              SHA512

                              b7ecf60e20098ea509b76b1cc308a954a6ede8d836bf709790ce7d4bd1b85b84cf5f3aedf55af225d2d21fbd3065d01aa201dae6c131b8e1e3aa80ed6fc910a4

                            • \Users\Admin\AppData\Local\Temp\_MEI20082\api-ms-win-core-processthreads-l1-1-1.dll

                              Filesize

                              11KB

                              MD5

                              9c9b50b204fcb84265810ef1f3c5d70a

                              SHA1

                              0913ab720bd692abcdb18a2609df6a7f85d96db3

                              SHA256

                              25a99bdf8bf4d16077dc30dd9ffef7bb5a2ceaf9afcee7cf52ad408355239d40

                              SHA512

                              ea2d22234e587ad9fa255d9f57907cc14327ead917fdede8b0a38516e7c7a08c4172349c8a7479ec55d1976a37e520628006f5c362f6a3ec76ec87978c4469cd

                            • \Users\Admin\AppData\Local\Temp\_MEI20082\api-ms-win-core-timezone-l1-1-0.dll

                              Filesize

                              11KB

                              MD5

                              43e1ae2e432eb99aa4427bb68f8826bb

                              SHA1

                              eee1747b3ade5a9b985467512215caf7e0d4cb9b

                              SHA256

                              3d798b9c345a507e142e8dacd7fb6c17528cc1453abfef2ffa9710d2fa9e032c

                              SHA512

                              40ec0482f668bde71aeb4520a0709d3e84f093062bfbd05285e2cc09b19b7492cb96cdd6056281c213ab0560f87bd485ee4d2aeefa0b285d2d005634c1f3af0b

                            • \Users\Admin\AppData\Local\Temp\_MEI20082\python310.dll

                              Filesize

                              4.2MB

                              MD5

                              a1185bef38fdba5e3fe6a71f93a9d142

                              SHA1

                              e2b40f5e518ad000002b239a84c153fdc35df4eb

                              SHA256

                              8d0bec69554317ccf1796c505d749d5c9f3be74ccbfce1d9e4d5fe64a536ae9e

                              SHA512

                              cb9baea9b483b9153efe2f453d6ac0f0846b140e465d07244f651c946900bfcd768a6b4c0c335ecebb45810bf08b7324501ea22b40cc7061b2f2bb98ed7897f4

                            • \Users\Admin\AppData\Local\Temp\_MEI20082\ucrtbase.dll

                              Filesize

                              987KB

                              MD5

                              61eb0ad4c285b60732353a0cb5c9b2ab

                              SHA1

                              21a1bea01f6ca7e9828a522c696853706d0a457b

                              SHA256

                              10521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd

                              SHA512

                              44cd871f48b5193abb3b9664dbea8cdad19e72c47b6967c685cf1cc803bc9abb48a8a93009c972ef4936e7f78e3c92110828790aa0a9d26b80e6a523bbcd830d