Analysis
-
max time kernel
77s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
20/07/2024, 04:26
Behavioral task
behavioral1
Sample
skeet_cracked.exe
Resource
win7-20240704-en
General
-
Target
skeet_cracked.exe
-
Size
10.2MB
-
MD5
275b3daab28a48554aa8b237180e7683
-
SHA1
ac565b427bc52c508310bf6f72a793c8679cde4a
-
SHA256
afaa2393aa66bdf295df7abcdc9ec2335e1b77b33a23763db57af19bac37cbdd
-
SHA512
988b16a5c43d56b8528b9980befa375b4fe952542924bcf2533a36d02fad02e92b88bd8882192ac975b8c8b75f578d33dfe38165e8bb282eacb2cc2c1743aca3
-
SSDEEP
196608:z/xEkYcowuLIoBA1HeT39Iigwh1ncKOVVtc97XEtQ1NjOp4U:1EkYcXIq1+TtIiFv0VQx060l
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 3044 skeet_cracked.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2712 chrome.exe 2712 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe Token: SeShutdownPrivilege 2712 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe 2712 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2240 wrote to memory of 3044 2240 skeet_cracked.exe 28 PID 2240 wrote to memory of 3044 2240 skeet_cracked.exe 28 PID 2240 wrote to memory of 3044 2240 skeet_cracked.exe 28 PID 2712 wrote to memory of 2556 2712 chrome.exe 32 PID 2712 wrote to memory of 2556 2712 chrome.exe 32 PID 2712 wrote to memory of 2556 2712 chrome.exe 32 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 2936 2712 chrome.exe 34 PID 2712 wrote to memory of 1632 2712 chrome.exe 35 PID 2712 wrote to memory of 1632 2712 chrome.exe 35 PID 2712 wrote to memory of 1632 2712 chrome.exe 35 PID 2712 wrote to memory of 1964 2712 chrome.exe 36 PID 2712 wrote to memory of 1964 2712 chrome.exe 36 PID 2712 wrote to memory of 1964 2712 chrome.exe 36 PID 2712 wrote to memory of 1964 2712 chrome.exe 36 PID 2712 wrote to memory of 1964 2712 chrome.exe 36 PID 2712 wrote to memory of 1964 2712 chrome.exe 36 PID 2712 wrote to memory of 1964 2712 chrome.exe 36 PID 2712 wrote to memory of 1964 2712 chrome.exe 36 PID 2712 wrote to memory of 1964 2712 chrome.exe 36 PID 2712 wrote to memory of 1964 2712 chrome.exe 36 PID 2712 wrote to memory of 1964 2712 chrome.exe 36 PID 2712 wrote to memory of 1964 2712 chrome.exe 36 PID 2712 wrote to memory of 1964 2712 chrome.exe 36 PID 2712 wrote to memory of 1964 2712 chrome.exe 36 PID 2712 wrote to memory of 1964 2712 chrome.exe 36 PID 2712 wrote to memory of 1964 2712 chrome.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\skeet_cracked.exe"C:\Users\Admin\AppData\Local\Temp\skeet_cracked.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\skeet_cracked.exe"C:\Users\Admin\AppData\Local\Temp\skeet_cracked.exe"2⤵
- Loads dropped DLL
PID:3044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7ad9758,0x7fef7ad9768,0x7fef7ad97782⤵PID:2556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1160 --field-trial-handle=1380,i,4814539078638239241,5332211803329133086,131072 /prefetch:22⤵PID:2936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1480 --field-trial-handle=1380,i,4814539078638239241,5332211803329133086,131072 /prefetch:82⤵PID:1632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1576 --field-trial-handle=1380,i,4814539078638239241,5332211803329133086,131072 /prefetch:82⤵PID:1964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2320 --field-trial-handle=1380,i,4814539078638239241,5332211803329133086,131072 /prefetch:12⤵PID:1992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2416 --field-trial-handle=1380,i,4814539078638239241,5332211803329133086,131072 /prefetch:12⤵PID:1644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1508 --field-trial-handle=1380,i,4814539078638239241,5332211803329133086,131072 /prefetch:22⤵PID:1788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1264 --field-trial-handle=1380,i,4814539078638239241,5332211803329133086,131072 /prefetch:12⤵PID:2304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3644 --field-trial-handle=1380,i,4814539078638239241,5332211803329133086,131072 /prefetch:82⤵PID:1864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3684 --field-trial-handle=1380,i,4814539078638239241,5332211803329133086,131072 /prefetch:12⤵PID:2832
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2696
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
211KB
MD5151fb811968eaf8efb840908b89dc9d4
SHA17ec811009fd9b0e6d92d12d78b002275f2f1bee1
SHA256043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed
SHA51283aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
359B
MD56d75f3c62561264647db9904b4243506
SHA1a4cac443c1290a24133a41af5466f3e8eb2d64e9
SHA256432b0f619bbe17df2b77a9fac5bbc567d2d0e5e9e04956b8f73304b9330d7494
SHA51266c13064aba78e4a368d1b3dde1178cdd214ae8e6a67754320890136719af8f7f470ddabc48419805c25631ae706bd57b6deaa67274218dbf075033b35773e1a
-
Filesize
5KB
MD5b10db8969156c9fb60a6acf8bcab8e3a
SHA1214448f541a06c5719b48d89044d114e4c702fab
SHA256001e82c3bb7a9d25add54e89a327352d87a7ecbb5b24f3e12ea59ed6fb88523d
SHA512c43d9e92850f442582a7d9b828be2c0b07c149353c44c16c4ebff1a9dacab464881d2bdde556df98a3830a12928c22dfdc794199737722aa71a68855a6c87a9c
-
Filesize
5KB
MD5b29baf645ecc4589f22338d90474b311
SHA1ba66a1f65303809d4605a60315d297da596d8d34
SHA25697c995bc558df7b354e15957c15d48f8ba9976117d78201e2c8117167b4affba
SHA5120697f355f37e6de63cf48862a42fe55796dbf88841006d84b45e4e88f0d97616f8f1f12d92d75bda1bf11b79e1a3af9e546bd7537c915ac28c887f945aa166af
-
Filesize
5KB
MD5fb04b914af52169e4dc4195d63313a35
SHA1f9c24fafab3c4536fffbf097ad8f250df3e64133
SHA25685d1c2b01408893356ef604b618c3e793aba5cad220eea198b8ab5e351a2bbe2
SHA5129b548819ce435c47231749311aec8bd705ce83349d5b2ac81caee65214eb7583db3bea01ae4a5a7ca8324a3c2a48dd255c65338f031e3908e138c3194079578b
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
6.6MB
MD5d521654d889666a0bc753320f071ef60
SHA15fd9b90c5d0527e53c199f94bad540c1e0985db6
SHA25621700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2
SHA5127a726835423a36de80fb29ef65dfe7150bd1567cac6f3569e24d9fe091496c807556d0150456429a3d1a6fd2ed0b8ae3128ea3b8674c97f42ce7c897719d2cd3