Analysis Overview
SHA256
2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad
Threat Level: No (potentially) malicious behavior was detected
The file eicar_com.zip was found to be: No (potentially) malicious behavior was detected.
Malicious Activity Summary
EICAR Anti-Malware test file
Suspicious use of AdjustPrivilegeToken
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of SetWindowsHookEx
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-18 08:10
Signatures
EICAR Anti-Malware test file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-18 08:10
Reported
2024-06-18 08:12
Platform
win7-20240419-en
Max time kernel
86s
Max time network
101s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\eicar_com.zip
C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UninstallPop.aiff"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef4c59758,0x7fef4c59768,0x7fef4c59778
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1320,i,15622513448227878054,13069550017283379469,131072 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1544 --field-trial-handle=1320,i,15622513448227878054,13069550017283379469,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 --field-trial-handle=1320,i,15622513448227878054,13069550017283379469,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2096 --field-trial-handle=1320,i,15622513448227878054,13069550017283379469,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=1540 --field-trial-handle=1320,i,15622513448227878054,13069550017283379469,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1488 --field-trial-handle=1320,i,15622513448227878054,13069550017283379469,131072 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3200 --field-trial-handle=1320,i,15622513448227878054,13069550017283379469,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3460 --field-trial-handle=1320,i,15622513448227878054,13069550017283379469,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3580 --field-trial-handle=1320,i,15622513448227878054,13069550017283379469,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3420 --field-trial-handle=1320,i,15622513448227878054,13069550017283379469,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3984 --field-trial-handle=1320,i,15622513448227878054,13069550017283379469,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3968 --field-trial-handle=1320,i,15622513448227878054,13069550017283379469,131072 /prefetch:8
C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 142.250.187.196:443 | www.google.com | tcp |
| US | 8.8.8.8:53 | apis.google.com | udp |
| GB | 142.250.200.14:443 | apis.google.com | tcp |
| US | 8.8.8.8:53 | play.google.com | udp |
| GB | 172.217.169.46:443 | play.google.com | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 142.250.187.196:443 | www.google.com | udp |
| GB | 172.217.169.46:443 | play.google.com | udp |
Files
memory/2532-13-0x000007FEF5110000-0x000007FEF5144000-memory.dmp
memory/2532-12-0x000000013F400000-0x000000013F4F8000-memory.dmp
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.em2532
| MD5 | 42baee16651e4f0c23cc0db68e52b2e8 |
| SHA1 | da8b59603ff40593c021f76f589c21cc851c0d6f |
| SHA256 | 6153f826239bf0e75abc3c4420ff924aa565107e6071013b421888383c7b2ef7 |
| SHA512 | a258a8f0f06510e2a167af6674ebbbfdd0cc8035e8cc387001471184c3c0c479e23343ea2edaf4425c6fae42b011ec077ddb30e71c0cd34546e0efb1840abee9 |
memory/2532-25-0x000007FEF4CD0000-0x000007FEF4CE1000-memory.dmp
memory/2532-26-0x000007FEF4CB0000-0x000007FEF4CCD000-memory.dmp
memory/2532-27-0x000007FEF4A60000-0x000007FEF4A71000-memory.dmp
memory/2532-24-0x000007FEF4CF0000-0x000007FEF4D07000-memory.dmp
memory/2532-23-0x000007FEF4F80000-0x000007FEF4F91000-memory.dmp
memory/2532-22-0x000007FEF4FA0000-0x000007FEF4FB7000-memory.dmp
memory/2532-21-0x000007FEF6030000-0x000007FEF6048000-memory.dmp
memory/2532-14-0x000007FEF4680000-0x000007FEF4936000-memory.dmp
memory/2532-28-0x000007FEF4340000-0x000007FEF454B000-memory.dmp
memory/2532-36-0x000007FEF4A10000-0x000007FEF4A51000-memory.dmp
memory/2532-38-0x000007FEF3270000-0x000007FEF3288000-memory.dmp
memory/2532-37-0x000007FEF49E0000-0x000007FEF4A01000-memory.dmp
memory/2532-39-0x000007FEF3250000-0x000007FEF3261000-memory.dmp
memory/2532-40-0x000007FEF3230000-0x000007FEF3241000-memory.dmp
memory/2532-41-0x000007FEF3210000-0x000007FEF3221000-memory.dmp
memory/2532-46-0x000007FEF3110000-0x000007FEF3177000-memory.dmp
memory/2532-47-0x000007FEF3090000-0x000007FEF310C000-memory.dmp
memory/2532-45-0x000007FEF3180000-0x000007FEF31B0000-memory.dmp
memory/2532-44-0x000007FEF31B0000-0x000007FEF31C8000-memory.dmp
memory/2532-52-0x000007FEF2F90000-0x000007FEF2FA8000-memory.dmp
memory/2532-50-0x000007FEF2FE0000-0x000007FEF3008000-memory.dmp
memory/2532-29-0x000007FEF3290000-0x000007FEF4340000-memory.dmp
memory/2532-53-0x000007FEF2F60000-0x000007FEF2F83000-memory.dmp
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.lock
| MD5 | 8d4bc957ae219d90066b51e5ca15738c |
| SHA1 | 1cbe2b7392b9bc03d44f93c9a92aad56ea2b1b85 |
| SHA256 | 2849243db3bbb5e8d78d7753fd15aaf12c5d9dcc411f8e0d7d357c26e12db46e |
| SHA512 | 87d3c8ea227acde386832e23a47268ee59e42f4941beb988addf0c3943f958a70dd4a5983eb0b6e0b9f85fc6a2c2a33dafc894b740de82a470700bca5ef57a5a |
memory/2532-55-0x000007FEF2F40000-0x000007FEF2F51000-memory.dmp
memory/2532-51-0x000007FEF2FB0000-0x000007FEF2FD4000-memory.dmp
memory/2532-56-0x000007FEF2F20000-0x000007FEF2F32000-memory.dmp
memory/2532-49-0x000007FEF3010000-0x000007FEF3067000-memory.dmp
memory/2532-48-0x000007FEF3070000-0x000007FEF3081000-memory.dmp
memory/2532-43-0x000007FEF31D0000-0x000007FEF31E1000-memory.dmp
memory/2532-42-0x000007FEF31F0000-0x000007FEF320B000-memory.dmp
memory/2532-73-0x000007FEF5110000-0x000007FEF5144000-memory.dmp
memory/2532-72-0x000000013F400000-0x000000013F4F8000-memory.dmp
memory/2532-74-0x000007FEF4680000-0x000007FEF4936000-memory.dmp
memory/2532-75-0x000007FEF3290000-0x000007FEF4340000-memory.dmp
\??\pipe\crashpad_576_CVXQNJCCOWMZCHCT
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp
| MD5 | 18e723571b00fb1694a3bad6c78e4054 |
| SHA1 | afcc0ef32d46fe59e0483f9a3c891d3034d12f32 |
| SHA256 | 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa |
| SHA512 | 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
| MD5 | f50f89a0a91564d0b8a211f8921aa7de |
| SHA1 | 112403a17dd69d5b9018b8cede023cb3b54eab7d |
| SHA256 | b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec |
| SHA512 | bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp
| MD5 | aefd77f47fb84fae5ea194496b44c67a |
| SHA1 | dcfbb6a5b8d05662c4858664f81693bb7f803b82 |
| SHA256 | 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611 |
| SHA512 | b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 48738db11b7ed6812a4ac242e9f821bb |
| SHA1 | 9067b5ce3a3bf3f531950ae7858c362eecb81b6d |
| SHA256 | 81da2b66952056e03d2fcb466c2f72efa5aa6681abf7c6f49b4e3bf6117aa6d2 |
| SHA512 | 7f00c33ed66baba57048267722902b9e83f275f195588c4c8d54763910ffb85dcd0d9addd6ae3412f38cce51afa1e57132fbff7458fac2e8b3d2f198a306c7e4 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | a3ce7a64f0b0a48262c62063d9a1bbc8 |
| SHA1 | 53db2c9091a69d7d1e01ae6605872901433027b1 |
| SHA256 | dabdafab8b68ff794aa52df61476f33153b3fc77802a2596548b7149aa7abbec |
| SHA512 | 84e1f4f8fd0ebf40d8b414c4dc97bf57c277df7295b849fb8b94de3e335691ab4680c32de52c4d5f323f3aeb2845381b18af4cfc58700713eb957034732ec999 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | ef251cb30a61de1c849e792f336947aa |
| SHA1 | 270f3ae154f32ad6a39667dfda777529b684c59d |
| SHA256 | 069665b05a863bcb1777ae8d4d55060708232068f6fda3dffbde9363a9832ec5 |
| SHA512 | c53e776795f60091edeafe3fbfb130817668678521ef9c2fbe631970efa1e8230182f4c48888f1a44d99cde8e59e989d273d2753caffd3036c0be3427967e627 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-18 08:10
Reported
2024-06-18 08:13
Platform
win10v2004-20240508-en
Max time kernel
147s
Max time network
150s
Command Line
Signatures
Processes
C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\eicar_com.zip
Network
| Country | Destination | Domain | Proto |
| US | 23.53.113.159:80 | tcp |