Analysis

  • max time kernel
    88s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20231025-en
  • resource tags

    arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
  • submitted
    26-11-2023 12:12

General

  • Target

    ImageLoggerV9.exe

  • Size

    74.7MB

  • MD5

    6d32b1f5cb8ef1f0adc48fb9d15c71c2

  • SHA1

    fa197aadb6721117d53d05907e9fc2ba5d14743f

  • SHA256

    4ec4df15c4127aedd1a468b26c1d6b2ccda6f4f4bfede5d7f6cbe3db96207090

  • SHA512

    6c043f4e7238afe81dd271cc4cc934ffc769aacce724c6a6d092e8a90e82e3962ebf75099bb87cf10c07dd7fbc31b0448ba57aecbae4f193833194ea9561d480

  • SSDEEP

    1572864:cT2MueQpjkkSk8IpG7V+VPhqSSE7ARjRHlWWpyppiZzI+hR1XWKGZjyhfq:0ZueqwkSkB05awS8Rd0eg2zd7XEQhq

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ImageLoggerV9.exe
    "C:\Users\Admin\AppData\Local\Temp\ImageLoggerV9.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2928
    • C:\Users\Admin\AppData\Local\Temp\ImageLoggerV9.exe
      "C:\Users\Admin\AppData\Local\Temp\ImageLoggerV9.exe"
      2⤵
      • Loads dropped DLL
      PID:2632
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1800
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7479758,0x7fef7479768,0x7fef7479778
      2⤵
        PID:1648
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1100,i,5250671184159573077,17838530079975816565,131072 /prefetch:2
        2⤵
          PID:1536
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1100,i,5250671184159573077,17838530079975816565,131072 /prefetch:8
          2⤵
            PID:864
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1592 --field-trial-handle=1100,i,5250671184159573077,17838530079975816565,131072 /prefetch:8
            2⤵
              PID:836
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2264 --field-trial-handle=1100,i,5250671184159573077,17838530079975816565,131072 /prefetch:1
              2⤵
                PID:820
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2272 --field-trial-handle=1100,i,5250671184159573077,17838530079975816565,131072 /prefetch:1
                2⤵
                  PID:1092
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=984 --field-trial-handle=1100,i,5250671184159573077,17838530079975816565,131072 /prefetch:2
                  2⤵
                    PID:1620
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1352 --field-trial-handle=1100,i,5250671184159573077,17838530079975816565,131072 /prefetch:1
                    2⤵
                      PID:2212
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3084 --field-trial-handle=1100,i,5250671184159573077,17838530079975816565,131072 /prefetch:8
                      2⤵
                        PID:2688
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3104 --field-trial-handle=1100,i,5250671184159573077,17838530079975816565,131072 /prefetch:8
                        2⤵
                          PID:2588
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3892 --field-trial-handle=1100,i,5250671184159573077,17838530079975816565,131072 /prefetch:8
                          2⤵
                            PID:2764
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3996 --field-trial-handle=1100,i,5250671184159573077,17838530079975816565,131072 /prefetch:1
                            2⤵
                              PID:2220
                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                            1⤵
                              PID:1852

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                              Filesize

                              264KB

                              MD5

                              f50f89a0a91564d0b8a211f8921aa7de

                              SHA1

                              112403a17dd69d5b9018b8cede023cb3b54eab7d

                              SHA256

                              b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                              SHA512

                              bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              363B

                              MD5

                              04d3d9544282dc2e22b61125f3d3b462

                              SHA1

                              3a6ce55cf31ae24a8f1b43283f935fef8bff9726

                              SHA256

                              c94c41d5b0028184b6eace5534df22f417fa4aac1bf4c198bea55d5707f58751

                              SHA512

                              2db8c8b5a72b42eca52c3d339d3356e7ee60b5ec5b31e767a5b4a2577a6a9fa88756a803e7a8dade7f5d7f8c3ec938df534ccc083c0db6381e468600aafd953d

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              4KB

                              MD5

                              2808dda2baa418088c97fa05f38d6046

                              SHA1

                              0029bcc65775e054c8ad63797d0d071a54d95f07

                              SHA256

                              d883260b81f818269b8a4133236bf13ef770898c3f0621e231091e0519bd0e8c

                              SHA512

                              f51c5bc76453d248c15c56b6bdd20dd1bae438218985f4fe532d1551bd200783c11b19d168bcf8e13df8b1bbff0208f4f9f184daa30f3d52fdf3050fe3c4d3f0

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              4KB

                              MD5

                              0adabcbb54740047a941ca38b9eb67f5

                              SHA1

                              7065b133dc84f93c78685f9e4b144d36c82b080b

                              SHA256

                              f4253123797bb4667d44f122b4702eba559063354e43f7e5f11e4230bfc6c340

                              SHA512

                              a0f1a86a82d98e15000f59a43b6c0767c3bae45ecdfc89a89a91d7fcdda8617f34b8fdb8344e2960551ddd716092fcbdbf18069fe490ab80105356c5d7310978

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                              Filesize

                              16B

                              MD5

                              18e723571b00fb1694a3bad6c78e4054

                              SHA1

                              afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                              SHA256

                              8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                              SHA512

                              43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                            • C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-file-l1-2-0.dll

                              Filesize

                              21KB

                              MD5

                              bcb8b9f6606d4094270b6d9b2ed92139

                              SHA1

                              bd55e985db649eadcb444857beed397362a2ba7b

                              SHA256

                              fa18d63a117153e2ace5400ed89b0806e96f0627d9db935906be9294a3038118

                              SHA512

                              869b2b38fd528b033b3ec17a4144d818e42242b83d7be48e2e6da6992111758b302f48f52e0dd76becb526a90a2b040ce143c6d4f0e009a513017f06b9a8f2b9

                            • C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-file-l2-1-0.dll

                              Filesize

                              18KB

                              MD5

                              bfffa7117fd9b1622c66d949bac3f1d7

                              SHA1

                              402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

                              SHA256

                              1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

                              SHA512

                              b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

                            • C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-localization-l1-2-0.dll

                              Filesize

                              21KB

                              MD5

                              20ddf543a1abe7aee845de1ec1d3aa8e

                              SHA1

                              0eaf5de57369e1db7f275a2fffd2d2c9e5af65bf

                              SHA256

                              d045a72c3e4d21165e9372f76b44ff116446c1e0c221d9cea3ab0a1134a310e8

                              SHA512

                              96dd48df315a7eea280ca3da0965a937a649ee77a82a1049e3d09b234439f7d927d7fb749073d7af1b23dadb643978b70dcdadc6c503fe850b512b0c9c1c78dd

                            • C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-processthreads-l1-1-1.dll

                              Filesize

                              21KB

                              MD5

                              4380d56a3b83ca19ea269747c9b8302b

                              SHA1

                              0c4427f6f0f367d180d37fc10ecbe6534ef6469c

                              SHA256

                              a79c7f86462d8ab8a7b73a3f9e469514f57f9fe456326be3727352b092b6b14a

                              SHA512

                              1c29c335c55f5f896526c8ee0f7160211fd457c1f1b98915bcc141112f8a730e1a92391ab96688cbb7287e81e6814cc86e3b057e0a6129cbb02892108bfafaf4

                            • C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-timezone-l1-1-0.dll

                              Filesize

                              21KB

                              MD5

                              2554060f26e548a089cab427990aacdf

                              SHA1

                              8cc7a44a16d6b0a6b7ed444e68990ff296d712fe

                              SHA256

                              5ab003e899270b04abc7f67be953eaccf980d5bbe80904c47f9aaf5d401bb044

                              SHA512

                              fd4d5a7fe4da77b0222b040dc38e53f48f7a3379f69e2199639b9f330b2e55939d89ce8361d2135182b607ad75e58ee8e34b90225143927b15dcc116b994c506

                            • C:\Users\Admin\AppData\Local\Temp\_MEI29282\python310.dll

                              Filesize

                              1.4MB

                              MD5

                              178a0f45fde7db40c238f1340a0c0ec0

                              SHA1

                              dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe

                              SHA256

                              9fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed

                              SHA512

                              4b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee

                            • C:\Users\Admin\AppData\Local\Temp\_MEI29282\ucrtbase.dll

                              Filesize

                              992KB

                              MD5

                              0e0bac3d1dcc1833eae4e3e4cf83c4ef

                              SHA1

                              4189f4459c54e69c6d3155a82524bda7549a75a6

                              SHA256

                              8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

                              SHA512

                              a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

                            • \??\pipe\crashpad_1800_XRQLRIRVBBHWQKSA

                              MD5

                              d41d8cd98f00b204e9800998ecf8427e

                              SHA1

                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                              SHA256

                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                              SHA512

                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                            • \Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-file-l1-2-0.dll

                              Filesize

                              21KB

                              MD5

                              bcb8b9f6606d4094270b6d9b2ed92139

                              SHA1

                              bd55e985db649eadcb444857beed397362a2ba7b

                              SHA256

                              fa18d63a117153e2ace5400ed89b0806e96f0627d9db935906be9294a3038118

                              SHA512

                              869b2b38fd528b033b3ec17a4144d818e42242b83d7be48e2e6da6992111758b302f48f52e0dd76becb526a90a2b040ce143c6d4f0e009a513017f06b9a8f2b9

                            • \Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-file-l2-1-0.dll

                              Filesize

                              18KB

                              MD5

                              bfffa7117fd9b1622c66d949bac3f1d7

                              SHA1

                              402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

                              SHA256

                              1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

                              SHA512

                              b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

                            • \Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-localization-l1-2-0.dll

                              Filesize

                              21KB

                              MD5

                              20ddf543a1abe7aee845de1ec1d3aa8e

                              SHA1

                              0eaf5de57369e1db7f275a2fffd2d2c9e5af65bf

                              SHA256

                              d045a72c3e4d21165e9372f76b44ff116446c1e0c221d9cea3ab0a1134a310e8

                              SHA512

                              96dd48df315a7eea280ca3da0965a937a649ee77a82a1049e3d09b234439f7d927d7fb749073d7af1b23dadb643978b70dcdadc6c503fe850b512b0c9c1c78dd

                            • \Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-processthreads-l1-1-1.dll

                              Filesize

                              21KB

                              MD5

                              4380d56a3b83ca19ea269747c9b8302b

                              SHA1

                              0c4427f6f0f367d180d37fc10ecbe6534ef6469c

                              SHA256

                              a79c7f86462d8ab8a7b73a3f9e469514f57f9fe456326be3727352b092b6b14a

                              SHA512

                              1c29c335c55f5f896526c8ee0f7160211fd457c1f1b98915bcc141112f8a730e1a92391ab96688cbb7287e81e6814cc86e3b057e0a6129cbb02892108bfafaf4

                            • \Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-timezone-l1-1-0.dll

                              Filesize

                              21KB

                              MD5

                              2554060f26e548a089cab427990aacdf

                              SHA1

                              8cc7a44a16d6b0a6b7ed444e68990ff296d712fe

                              SHA256

                              5ab003e899270b04abc7f67be953eaccf980d5bbe80904c47f9aaf5d401bb044

                              SHA512

                              fd4d5a7fe4da77b0222b040dc38e53f48f7a3379f69e2199639b9f330b2e55939d89ce8361d2135182b607ad75e58ee8e34b90225143927b15dcc116b994c506

                            • \Users\Admin\AppData\Local\Temp\_MEI29282\python310.dll

                              Filesize

                              1.4MB

                              MD5

                              178a0f45fde7db40c238f1340a0c0ec0

                              SHA1

                              dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe

                              SHA256

                              9fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed

                              SHA512

                              4b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee

                            • \Users\Admin\AppData\Local\Temp\_MEI29282\ucrtbase.dll

                              Filesize

                              992KB

                              MD5

                              0e0bac3d1dcc1833eae4e3e4cf83c4ef

                              SHA1

                              4189f4459c54e69c6d3155a82524bda7549a75a6

                              SHA256

                              8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

                              SHA512

                              a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

                            • memory/2632-1313-0x000007FEF6520000-0x000007FEF698E000-memory.dmp

                              Filesize

                              4.4MB