Overview

overview

3

Static

static

3

dope internal.dll

windows7-x64

1

dope internal.dll

windows10-2004-x64

1

Resubmissions

04/05/2023, 09:31

230504-lg4y1sbc88 3

04/05/2023, 09:28

230504-lfhpdsbc84 3

04/05/2023, 09:01

230504-ky4txabb99 3

Analysis

  • max time kernel
    132s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    04/05/2023, 09:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dope internal.dll

  • Size

    673KB

  • MD5

    53fcf13c64c27fa11e9b6f8573da2a68

  • SHA1

    8c62c1da0e6973211e8c1249ebdcdd5655319faf

  • SHA256

    6ba5628affbed64053d1ff1ef51b27c4d0ced0a8bd083278926db9ca9c3ccbde

  • SHA512

    f660a3226e62c2ac8af0a3e8f6a7d78a6446bf8b06f95d6586c3adc0e5ae9cdd150c5c1845f576a6dcb826e2abb2f8f4ec9885c4f08e63a3d9b90c35d59ce034

  • SSDEEP

    12288:J70yGLf4Sun2ZeufT1Hgl7IZOgY6EJE0B6PlsTdHnTop+DJzB:JAyGLfOn2ZZusZBY6j04POHnTS+d

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\dope internal.dll",#1
    1⤵
      PID:1628
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fefaeb9758,0x7fefaeb9768,0x7fefaeb9778
      1⤵
        PID:1444
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1160 --field-trial-handle=1196,i,8850335871073903842,7890452348028371090,131072 /prefetch:2
        1⤵
          PID:1168
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1488 --field-trial-handle=1196,i,8850335871073903842,7890452348028371090,131072 /prefetch:8
          1⤵
            PID:280
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1640 --field-trial-handle=1196,i,8850335871073903842,7890452348028371090,131072 /prefetch:8
            1⤵
              PID:688
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2196 --field-trial-handle=1196,i,8850335871073903842,7890452348028371090,131072 /prefetch:1
              1⤵
                PID:1964
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2356 --field-trial-handle=1196,i,8850335871073903842,7890452348028371090,131072 /prefetch:1
                1⤵
                  PID:1472
                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                  1⤵
                    PID:1992
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1416 --field-trial-handle=1196,i,8850335871073903842,7890452348028371090,131072 /prefetch:2
                    1⤵
                      PID:1916
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --mojo-platform-channel-handle=2340 --field-trial-handle=1196,i,8850335871073903842,7890452348028371090,131072 /prefetch:1
                      1⤵
                        PID:1008
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3884 --field-trial-handle=1196,i,8850335871073903842,7890452348028371090,131072 /prefetch:8
                        1⤵
                          PID:1612
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4008 --field-trial-handle=1196,i,8850335871073903842,7890452348028371090,131072 /prefetch:8
                          1⤵
                            PID:1168
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=1976 --field-trial-handle=1196,i,8850335871073903842,7890452348028371090,131072 /prefetch:1
                            1⤵
                              PID:2232
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=2392 --field-trial-handle=1196,i,8850335871073903842,7890452348028371090,131072 /prefetch:1
                              1⤵
                                PID:2388
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --mojo-platform-channel-handle=2352 --field-trial-handle=1196,i,8850335871073903842,7890452348028371090,131072 /prefetch:1
                                1⤵
                                  PID:2544
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --mojo-platform-channel-handle=3880 --field-trial-handle=1196,i,8850335871073903842,7890452348028371090,131072 /prefetch:1
                                  1⤵
                                    PID:2624
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2572 --field-trial-handle=1196,i,8850335871073903842,7890452348028371090,131072 /prefetch:8
                                    1⤵
                                      PID:2704
                                    • C:\Windows\system32\AUDIODG.EXE
                                      C:\Windows\system32\AUDIODG.EXE 0x45c
                                      1⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2756
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3336 --field-trial-handle=1196,i,8850335871073903842,7890452348028371090,131072 /prefetch:8
                                      1⤵
                                        PID:2856
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 --field-trial-handle=1196,i,8850335871073903842,7890452348028371090,131072 /prefetch:8
                                        1⤵
                                          PID:1908
                                        • C:\Users\Admin\Desktop\v2\dope loader.exe
                                          "C:\Users\Admin\Desktop\v2\dope loader.exe"
                                          1⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2936
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4336 --field-trial-handle=1196,i,8850335871073903842,7890452348028371090,131072 /prefetch:8
                                          1⤵
                                            PID:2980

                                          Network

                                          MITRE ATT&CK Enterprise v6

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d
                                            Filesize

                                            47KB

                                            MD5

                                            c6ef2aec7c094f9636f38ac98617fee0

                                            SHA1

                                            7b22266bafcd09bef4138b73c3a03896c74d1e82

                                            SHA256

                                            8a5447ccb9b67e4c1684bfcf9741d6d8d0ee6bea6ebc89021bb6ee210cf7e86f

                                            SHA512

                                            c9f404fb863d2604adef8031bd1058d6fdad799d7fc9bbcf8f1f5f03f4c388098f7a3e776754c244a2f30c72806f615ea685204ed19fb43f5465e5d5e551607d

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000020
                                            Filesize

                                            728KB

                                            MD5

                                            c1bcd26cf3eea6783c45156655639abb

                                            SHA1

                                            648646fd22f5c9b658978f187be8a146bbcd7121

                                            SHA256

                                            c103d5e20470cc42016a9d870bff6f8914000f95d24ef3a9cb1ab7840078ee52

                                            SHA512

                                            de89afc5359011d261e90aa75aebdfeef1a8639fd70a113c4c22d9b8647ea179672998832d69d22c68ff958a2ef4d98325c37563754230c5e86fcc90d60c942f

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                            Filesize

                                            363B

                                            MD5

                                            495280a37f729a9c7354a6e4f3058fd7

                                            SHA1

                                            7485f031007ff9ede8c7c90e8f11e043ab247773

                                            SHA256

                                            d7dda79206089ca9152282c07566777a8c90bfeaa78428f8bc397aaee7ef8ed8

                                            SHA512

                                            4cc72100369402a63170eb166c9a137bdf0fd291364931c1cd16690e08158b62cc784d8994048fa16e3441bb6bb9b876b3b3c212e098fc3e7ad26c98a7e7ca30

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                            Filesize

                                            854B

                                            MD5

                                            e262ff939b1f5b26503fa004d37bf13d

                                            SHA1

                                            81835cf4b84654c171010d5e3c01450a2f59a053

                                            SHA256

                                            7127b53e1f4de6d4e560101d063eea68fbba86cb6ceda527f794ba6a154c0064

                                            SHA512

                                            6208e5c05b0fb383ccab9d42e0569d2acf00cf44dff13744f34790ca71b3db5e9eac747be386e0969ec8172f79ea873dfaff762127e83c8a8c0d1c70e5ea2321

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                            Filesize

                                            691B

                                            MD5

                                            be4074f34ab57d35c031ec72dc0b33a8

                                            SHA1

                                            61bf912692d63e8142e350cda201fe5dcdb3e431

                                            SHA256

                                            5a716cfe471b716eaf9b9ea74e62511b840a07ab06902310609a98e87934419e

                                            SHA512

                                            dcfcc495e3a8ca3b6e270115c754d096e28d361e3d0eef89f71393a659d4db873b4838e1b123c7fcad3215eb2da95df52916d4653e61f9159ef33eb1535b27d8

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                            Filesize

                                            691B

                                            MD5

                                            5694ffa5d83231fb7730ca420eb0ba90

                                            SHA1

                                            500569dc133e1efefaed071962772f15d6819bae

                                            SHA256

                                            aa32a077bd0bdf81950a40d262e0d7e692699842e30a533dd2e7809c53d94cf3

                                            SHA512

                                            32e0b137dfa5664592de91f1d8e40e9977ea1ed710e246b97a30fc3cd44117cc43468b6b6998df086b3ad42beff31ccdbc941962c6d3aad32f387634570df8e8

                                            Download Submit