Analysis
-
max time kernel
246s -
max time network
430s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
25/11/2023, 00:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
The Life of Lilo the Bunny.zip
Resource
win7-20231020-en
windows7-x64
6 signatures
600 seconds
Behavioral task
behavioral2
Sample
The Life of Lilo the Bunny.zip
Resource
win10v2004-20231023-en
windows10-2004-x64
0 signatures
600 seconds
General
-
Target
The Life of Lilo the Bunny.zip
-
Size
12.7MB
-
MD5
26a2b365292c42c23f981796e31a1c49
-
SHA1
522e0c81c4c1af91da66e03bc7909feb3f230d4f
-
SHA256
57d25af54f92176916131161247eaaa232e215172bae8d131a31a46d7e9b4566
-
SHA512
1e19cd8d6b0cabc0716f7b42d50ba404d028a1ecbf03c164b12e078c597a1050c9010f273ee7541b7913a3ab7dccaaad824ae03811a59ff62331a4bc27728249
-
SSDEEP
393216:DfDbCyUNSnz1N51B1Hv/v/a4ppv8NMAU5Qzeumwgm:DHC8z71P/nvrvjA+BAgm
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2064 chrome.exe 2064 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2064 wrote to memory of 2564 2064 chrome.exe 33 PID 2064 wrote to memory of 2564 2064 chrome.exe 33 PID 2064 wrote to memory of 2564 2064 chrome.exe 33 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 768 2064 chrome.exe 35 PID 2064 wrote to memory of 1860 2064 chrome.exe 36 PID 2064 wrote to memory of 1860 2064 chrome.exe 36 PID 2064 wrote to memory of 1860 2064 chrome.exe 36 PID 2064 wrote to memory of 1996 2064 chrome.exe 37 PID 2064 wrote to memory of 1996 2064 chrome.exe 37 PID 2064 wrote to memory of 1996 2064 chrome.exe 37 PID 2064 wrote to memory of 1996 2064 chrome.exe 37 PID 2064 wrote to memory of 1996 2064 chrome.exe 37 PID 2064 wrote to memory of 1996 2064 chrome.exe 37 PID 2064 wrote to memory of 1996 2064 chrome.exe 37 PID 2064 wrote to memory of 1996 2064 chrome.exe 37 PID 2064 wrote to memory of 1996 2064 chrome.exe 37 PID 2064 wrote to memory of 1996 2064 chrome.exe 37 PID 2064 wrote to memory of 1996 2064 chrome.exe 37 PID 2064 wrote to memory of 1996 2064 chrome.exe 37 PID 2064 wrote to memory of 1996 2064 chrome.exe 37 PID 2064 wrote to memory of 1996 2064 chrome.exe 37 PID 2064 wrote to memory of 1996 2064 chrome.exe 37 PID 2064 wrote to memory of 1996 2064 chrome.exe 37 PID 2064 wrote to memory of 1996 2064 chrome.exe 37 PID 2064 wrote to memory of 1996 2064 chrome.exe 37 PID 2064 wrote to memory of 1996 2064 chrome.exe 37
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\The Life of Lilo the Bunny.zip"1⤵PID:1412
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2892
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6869758,0x7fef6869768,0x7fef68697782⤵PID:2564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1136 --field-trial-handle=1348,i,279023079437193867,5958400999041475193,131072 /prefetch:22⤵PID:768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 --field-trial-handle=1348,i,279023079437193867,5958400999041475193,131072 /prefetch:82⤵PID:1860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1588 --field-trial-handle=1348,i,279023079437193867,5958400999041475193,131072 /prefetch:82⤵PID:1996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2160 --field-trial-handle=1348,i,279023079437193867,5958400999041475193,131072 /prefetch:12⤵PID:1532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2308 --field-trial-handle=1348,i,279023079437193867,5958400999041475193,131072 /prefetch:12⤵PID:1228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2808 --field-trial-handle=1348,i,279023079437193867,5958400999041475193,131072 /prefetch:22⤵PID:2392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2892 --field-trial-handle=1348,i,279023079437193867,5958400999041475193,131072 /prefetch:12⤵PID:908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1128 --field-trial-handle=1348,i,279023079437193867,5958400999041475193,131072 /prefetch:82⤵PID:1864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3152 --field-trial-handle=1348,i,279023079437193867,5958400999041475193,131072 /prefetch:82⤵PID:2100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3632 --field-trial-handle=1348,i,279023079437193867,5958400999041475193,131072 /prefetch:82⤵PID:2104
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2068
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
4KB
MD56dd5f20944952a5f674e582d2a5ea0d9
SHA18f861e825f497be16a0a21ae26bcb094b6ed9bd3
SHA2566428beee19056741649905f19fba2c26fb7b1261f4e4065470a68aa5740b2ce1
SHA512fd3caaf9bbe26c06843785667076401ba501b7fd485366c3f4684a62bb0898f523b85c0529a4d065c9c6feb413fbf592fc4526bfaba2cde6c125131dea2ce4e6
-
Filesize
4KB
MD57a43e9206d7fd5283148bc280488bca5
SHA1b09258cb365e8f1e6dd3161bfa660124675c6945
SHA25617128ae14a7f429e33d20e1179bc10828b429b98fedf6f3b15e4f1e75532094c
SHA5120c33c703250dd667b33fbaf7d26d7a90dd7e5d96e128e71d4d372f8a241e6abb223fc2a033bd0c36de059f00884847c9b1d8553d43a9f69ac3c4e1fbda960af0
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2