Analysis

  • max time kernel
    99s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    12-07-2024 07:08

General

  • Target

    picture_of_avis_dogEXTRACT_FILE.zip

  • Size

    41KB

  • MD5

    1df9a18b18332f153918030b7b516615

  • SHA1

    6c42c62696616b72bbfc88a4be4ead57aa7bc503

  • SHA256

    bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa

  • SHA512

    6382ca9c307d66ab7566acf78b1afd44b18b24d766253e1dc1cb3a3c0be96ecf1f2042d6bd3332d49078ffee571cf98869c1284c1d3e5c1c7dc3e4c64f71af80

  • SSDEEP

    768:hzyVr8GSKL6O3QOXk/0u3wqOghrFCezL1VFJdbq2QTJTw02Q:hGx8DKXE//ZhhCirFi2cwK

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\picture_of_avis_dogEXTRACT_FILE.zip
    1⤵
      PID:2716
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:2872
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        1⤵
          PID:2640
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe"
          1⤵
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2080
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5a49758,0x7fef5a49768,0x7fef5a49778
            2⤵
              PID:1124
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1156 --field-trial-handle=1304,i,17345585871733674793,10194273843395277124,131072 /prefetch:2
              2⤵
                PID:1256
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1528 --field-trial-handle=1304,i,17345585871733674793,10194273843395277124,131072 /prefetch:8
                2⤵
                  PID:3048
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1628 --field-trial-handle=1304,i,17345585871733674793,10194273843395277124,131072 /prefetch:8
                  2⤵
                    PID:2016
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2268 --field-trial-handle=1304,i,17345585871733674793,10194273843395277124,131072 /prefetch:1
                    2⤵
                      PID:2452
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2348 --field-trial-handle=1304,i,17345585871733674793,10194273843395277124,131072 /prefetch:1
                      2⤵
                        PID:2548
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1328 --field-trial-handle=1304,i,17345585871733674793,10194273843395277124,131072 /prefetch:2
                        2⤵
                          PID:1572
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1420 --field-trial-handle=1304,i,17345585871733674793,10194273843395277124,131072 /prefetch:1
                          2⤵
                            PID:2728
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3936 --field-trial-handle=1304,i,17345585871733674793,10194273843395277124,131072 /prefetch:8
                            2⤵
                              PID:2320
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3880 --field-trial-handle=1304,i,17345585871733674793,10194273843395277124,131072 /prefetch:1
                              2⤵
                                PID:1504
                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                              1⤵
                                PID:2540

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

                                Filesize

                                211KB

                                MD5

                                151fb811968eaf8efb840908b89dc9d4

                                SHA1

                                7ec811009fd9b0e6d92d12d78b002275f2f1bee1

                                SHA256

                                043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

                                SHA512

                                83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                Filesize

                                264KB

                                MD5

                                f50f89a0a91564d0b8a211f8921aa7de

                                SHA1

                                112403a17dd69d5b9018b8cede023cb3b54eab7d

                                SHA256

                                b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                SHA512

                                bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                2c33504f228b4a52eb3a760101c49db6

                                SHA1

                                beda8997010a9a3342006f40e86341a6b5a9f083

                                SHA256

                                c043766ee780ef23b79c4b0304e0ab7df4ca82741221f24681fa81d44a1c31e4

                                SHA512

                                77c7c921b910b35ae11c965c8dda204b641e4ec910ab5ea5e2db68228e028b99c5f8f7b2103d3f32230fa7f2ba5165bcd890667f23d489acb9a84c64f58a2b5b

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                3b83b9dcf95c3f361a22c6101d8810c5

                                SHA1

                                ffa1662957f4d75b6285056be1e379304d1f69c9

                                SHA256

                                76984ebcd28834d995fb810b202d8b024da586822fc3c013d953c3f6510f5bcc

                                SHA512

                                6fb1ce1873b3280a5349a1ca8f2bc7ad057cc73f5a98182e4e7c2c8f9b62f4160e506cd45f895239b4ca9aec6b41119862fa3c43f25e8d2ef73b2ad84f014085

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                                Filesize

                                16B

                                MD5

                                18e723571b00fb1694a3bad6c78e4054

                                SHA1

                                afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                SHA256

                                8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                SHA512

                                43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                              • C:\vcredist2010_x64.log-MSI_vc_red.msi.txt

                                Filesize

                                362KB

                                MD5

                                593f81f8e3ce8c68a2c186487b55efed

                                SHA1

                                97e77969bb69e1f1e6ef00b4fa237d6535b7a7b5

                                SHA256

                                68ea60f0c1fb8704078a1eba0bf5e8881d8c745df73e0219782925b6acab0db8

                                SHA512

                                85c17e1fed02362a202229f7d96ddae1ff96c832a0b3cd22f490979a0d7187d0982bc0c21ba4605f04d8b522d4495aed98a9e2b62a2ff1a57043a6ef497d6ac0

                              • C:\vcredist2010_x64.log.html

                                Filesize

                                85KB

                                MD5

                                6621807135963a0a7b295050f1cf9231

                                SHA1

                                f9ea17960d51c0d0e605789bf1773180aaa7a42b

                                SHA256

                                25d9a090a5cd5808142c2f16e97cb5f51e537d402f2221bd589af89f9c633c30

                                SHA512

                                1847e8eada3a931b110851b5165ae78218ff5c19f3877eb44e358083b496af1f5c5782cc4d7a049d82e9c2724c8a9d74b8c3edad209513f5c2e387fbbd0a045b

                              • C:\vcredist2010_x86.log-MSI_vc_red.msi.txt

                                Filesize

                                378KB

                                MD5

                                1b5c197538b863b09806e32ee2ee6e23

                                SHA1

                                df6522994ce49e0c5df364c57ef148964cc86956

                                SHA256

                                4a6da066493e5534fcb51e677a5f59bd10328b93256803f921b3156999b71599

                                SHA512

                                3e9c7c9ed6d212d71fee7dc37f92046d7523cf02b95b4ffd105b81075a1ffc1a1f251ec0941ba6337e707ce0d722f7c0315e603b637971be348ccda87ea9f132

                              • C:\vcredist2010_x86.log.html

                                Filesize

                                80KB

                                MD5

                                58b221f5452efa13caef9dbc7b222f06

                                SHA1

                                798807a9d5855384a387cfac86dcb6c635c69cfc

                                SHA256

                                ab0bd12bd88918a5d6c33aff521b474dc9f5b115e4e5bf4cd58dc93dfb51215e

                                SHA512

                                d9fa6822d37851065203248bba1b0cca1b419a88531043a331c4adadceefe7983cf82f9165a77ae94d3dc1da27abd08cf13aa18997caab1ddcdd62b34b7fdfba

                              • C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log

                                Filesize

                                165KB

                                MD5

                                e14b473b104409e03b250c4fd9970487

                                SHA1

                                de3a11e47406acfda926bd44f2aa017b42aa14cb

                                SHA256

                                6b09e88cb374b32bb2cb394d4482b189b11a2c0f875ac465c9c70ef5019df105

                                SHA512

                                76a4a809b2a120f70a6258ec116f0fd26b16070ba68ae3ae2b8585f0bc729e63a173c112a7df41dc3b96f2d88d078942da38429a077c9738d1fff337e6ad1ab9

                              • C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log

                                Filesize

                                193KB

                                MD5

                                cdad5d9ddf5a077b44c598ede99a3915

                                SHA1

                                b3cbd1bfcf00513885cf65692c004048c3da078e

                                SHA256

                                472ef9f918be5d04fe2f4a3c682370ee4386a782ee5c4452dbe61092b64419dc

                                SHA512

                                49a42cf0932731ac82d380683872a606c8ed95b8c105a93212b8a4b04a5abba8b267e126560bfc7876b5be6754fcb4ce19af6b3592322c6af8944d7ee84339f0

                              • C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log

                                Filesize

                                168KB

                                MD5

                                d76405f994ef209afac2c1b5690083d6

                                SHA1

                                01a8e8cb7881a2d53b3ce786a910c850299189e3

                                SHA256

                                72e7da44a951fa384ed52f48c3f0b11f40bed716c0a5c5e3a6d2693b88602f87

                                SHA512

                                8e5f6cb2c9f8583a0ff40154d88a11ec43955823ce2842bd7058495379e7f8326185270775cbc8cd55b72145db31267329617d534c2efcd53a28316d45366917

                              • C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log

                                Filesize

                                206KB

                                MD5

                                994363c1176cade0b133e6ffb4381292

                                SHA1

                                98acebd603bf57e2258ad1c1c18f993c11edc7d7

                                SHA256

                                22a9ee3b56278cfabd73f89c97d8e32fa95543a133e5adf6681365a08e904ff7

                                SHA512

                                e598684698f583283ea978ba1c806a8a20cd26c553e73f18ac07f5154518d8178d4735e877c054e0395f8f07939cc7730f5310fe770cc591d3ec20382845e388

                              • C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log

                                Filesize

                                167KB

                                MD5

                                74088738db061e2335134e63c1403621

                                SHA1

                                22f8543d4f84cb7defcb49dd7900799bf095f08d

                                SHA256

                                92ee96d973ff30342518f8500d78f99d4825796236a49ae7e5bf6297b5fe34bf

                                SHA512

                                277b8663c92f8fd30667aad0d688ae2afb42508d2eb71598649a4392b62679107b5b02bb272268d61a33ab128fe1645c459c05bcc29e0a4c50c46fe8acf9a7fb

                              • C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log

                                Filesize

                                188KB

                                MD5

                                2c34d066aba847339bc76fe659e850a5

                                SHA1

                                c86c407e3d0cfbf2f3982626c54397166071fe89

                                SHA256

                                a8555e32b9acc020961878fa2c9fa76cb6d0a3215e34094c1ebd6874c6a5bd7a

                                SHA512

                                4299a1b4149292ad39a636e8fc3a7a6f7107503fab205047045c82d1727f76fd721caf759ccc26c54d4dcea6b5b5674147d3727224d1b041381d382731402bc8

                              • C:\vcredist2013_x86.log

                                Filesize

                                8KB

                                MD5

                                23c151d3b43ac82eac37bb5d5ba89bfe

                                SHA1

                                fee1a6913959fffd9781b68719a9dc1ed3c2e907

                                SHA256

                                6ba06a2bdd82fd1fb4639e349516f81821fd302d3ce465cc794c0c428150ffcd

                                SHA512

                                a2cdfaa5c0a46083c9677d59537bea39108eded2e1587c8ab6c40544ce49397e787bf7db304ceb7fa321c97e13311196a60a702a7588d81d3d0778c64500eae1

                              • C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log

                                Filesize

                                168KB

                                MD5

                                b9ca74794c3cbadaf38d11c0844484ad

                                SHA1

                                d0fee73ee0715155bdcce3afbafdf28b81441bc7

                                SHA256

                                650611f669d2e99e55963d6a972eea715ee79c0925b79056dadc02870919766f

                                SHA512

                                b84014486da959421edf3cd3b1857a8ee8fbd7c3a35f37c92ca4584b07fb4ca9a32b17f65e7d71c56c669c824f44941a24ce0c27d869ea6273fc22b4ec4553a7

                              • C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log

                                Filesize

                                196KB

                                MD5

                                c5bf022516a580f5ba18dadd51028b47

                                SHA1

                                232389ef80fbbbc2ba3e5a985dda063b0eb89779

                                SHA256

                                c7b26d8f1aeb6370a2a5ff25fc6d383f3d5c282aa75da0e2dafe5bef1dddab6f

                                SHA512

                                618899e94bf0332ac7947109197b4c8f487e1d14b0d2a3c1fb7774efb6cd1334308a6550703ed05084d05fb8c250ca68433c664faca9941f0c0949943be5d0ac

                              • C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log

                                Filesize

                                120KB

                                MD5

                                a93483bc3200fefa6a7da791503fd89b

                                SHA1

                                16cd3cd7df62a1486b8d050b713d7de7a0dce81b

                                SHA256

                                53fbf4ec025005f9b002c002ca151c90f54bebb653c796d3e2af3757ef241c85

                                SHA512

                                d5e65a19f4f3e9bc41ac4ab05feca2378f12266d27988ef3e1394b43149d8c21551fd89adfd0d1914b9ab481174d22a2b6cc83c09f02ca58e7adadfe22c19ed1

                              • C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log

                                Filesize

                                127KB

                                MD5

                                3bc672dbe77de19dc89fd9605aad66d9

                                SHA1

                                27c262220cd1105e824bd9dfa1ad710e2e7e97a7

                                SHA256

                                84129f8fd2051285ecbf1a4207e296cfced12e0fb6eaf6d7ea4f75a67df3867c

                                SHA512

                                109c996699530f3de32410e7aea2635b742e98260939bd54ced024b7ef16a4f9e5610c3f06c50232d6139cbb6b6b0e3ad21e2644f1a8fd2e849744a963ce716d

                              • C:\vcredist2022_x86_001_vcRuntimeMinimum_x86.log

                                Filesize

                                121KB

                                MD5

                                d3fceee7e66b42d0cf80e3f1b11d3ee2

                                SHA1

                                f83beace832e899b46d769fc54a66cd99cac6af9

                                SHA256

                                5b16bf4b2580bd57a546d5c659b5a1a1e01b5f7f0794735f88cbff8de7c23c4e

                                SHA512

                                530f6f47551b0ee984985c7b187423d11ab9fb57031ea0a4f7e8f988b482bc8c0757bda572c8edd357c4d4b6451df074cc4b47efb90545f7a6a249fab172c4ee

                              • C:\vcredist2022_x86_002_vcRuntimeAdditional_x86.log

                                Filesize

                                133KB

                                MD5

                                3da2be18828e2b7c701c3521bc42bbcd

                                SHA1

                                65d30cf2587368b49b8d1ff6587d94fb458eb7af

                                SHA256

                                d87b6468f70f9190448f667ffa0da443f41140d53dd06a510f5fd89a19a8e8ce

                                SHA512

                                9ef96df72cb5c12b8ed093489fd83db5a329bbf4cf7c9130daa259fa1ab2eb3145e48fb9bcddded9e515169f975d7ca202441fe3f6be9fdbeb9652421f1a1199