Overview
overview
3Static
static
3f817a9-Pac...er.zip
windows7-x64
3f817a9-Pac...er.zip
windows10-2004-x64
1PackfileLi...er.dll
windows7-x64
1PackfileLi...er.dll
windows10-2004-x64
1PackfileLi...er.ini
windows7-x64
1PackfileLi...er.ini
windows10-2004-x64
1ReadMe.txt
windows7-x64
1ReadMe.txt
windows10-2004-x64
1Analysis
-
max time kernel
32s -
max time network
109s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/08/2024, 06:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f817a9-PackfileLimitAdjuster.zip
Resource
win7-20240704-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
f817a9-PackfileLimitAdjuster.zip
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
PackfileLimitAdjuster.dll
Resource
win7-20240704-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
PackfileLimitAdjuster.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
PackfileLimitAdjuster.ini
Resource
win7-20240729-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
PackfileLimitAdjuster.ini
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
ReadMe.txt
Resource
win7-20240708-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
ReadMe.txt
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
f817a9-PackfileLimitAdjuster.zip
-
Size
151KB
-
MD5
70af10081bcc2d328bfd014df16f672b
-
SHA1
df6ddff8c17b5bd9ebf5faa91e6697ca9a9de19f
-
SHA256
b3d17fc935265e38a2567e77d9beebbde035558d4a5d1a81f951a4a1d2a05479
-
SHA512
0a8542474510137214c19e1a274f059de378c33efb8fd4c0d5b2e153c28954933cceb1ff9a58fa0e0cf129a05174857cc4de04a36eec77fa4c0b22a0b8514f39
-
SSDEEP
3072:PmjuisiVYp3eIuwB8jLsmx8kfuJZLXEfqF/Ywld4C/j8hfv3/:UbsiVYp3NGL+RB/Zl2Cr8hfv3/
Score
3/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2444 chrome.exe 2444 chrome.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2444 wrote to memory of 2376 2444 chrome.exe 32 PID 2444 wrote to memory of 2376 2444 chrome.exe 32 PID 2444 wrote to memory of 2376 2444 chrome.exe 32 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2692 2444 chrome.exe 34 PID 2444 wrote to memory of 2176 2444 chrome.exe 35 PID 2444 wrote to memory of 2176 2444 chrome.exe 35 PID 2444 wrote to memory of 2176 2444 chrome.exe 35 PID 2444 wrote to memory of 2796 2444 chrome.exe 36 PID 2444 wrote to memory of 2796 2444 chrome.exe 36 PID 2444 wrote to memory of 2796 2444 chrome.exe 36 PID 2444 wrote to memory of 2796 2444 chrome.exe 36 PID 2444 wrote to memory of 2796 2444 chrome.exe 36 PID 2444 wrote to memory of 2796 2444 chrome.exe 36 PID 2444 wrote to memory of 2796 2444 chrome.exe 36 PID 2444 wrote to memory of 2796 2444 chrome.exe 36 PID 2444 wrote to memory of 2796 2444 chrome.exe 36 PID 2444 wrote to memory of 2796 2444 chrome.exe 36 PID 2444 wrote to memory of 2796 2444 chrome.exe 36 PID 2444 wrote to memory of 2796 2444 chrome.exe 36 PID 2444 wrote to memory of 2796 2444 chrome.exe 36 PID 2444 wrote to memory of 2796 2444 chrome.exe 36 PID 2444 wrote to memory of 2796 2444 chrome.exe 36 PID 2444 wrote to memory of 2796 2444 chrome.exe 36 PID 2444 wrote to memory of 2796 2444 chrome.exe 36 PID 2444 wrote to memory of 2796 2444 chrome.exe 36 PID 2444 wrote to memory of 2796 2444 chrome.exe 36
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\f817a9-PackfileLimitAdjuster.zip1⤵PID:2072
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef67b9758,0x7fef67b9768,0x7fef67b97782⤵PID:2376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1140 --field-trial-handle=1440,i,1683623848686525381,5403333682322579460,131072 /prefetch:22⤵PID:2692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1364 --field-trial-handle=1440,i,1683623848686525381,5403333682322579460,131072 /prefetch:82⤵PID:2176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1552 --field-trial-handle=1440,i,1683623848686525381,5403333682322579460,131072 /prefetch:82⤵PID:2796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2300 --field-trial-handle=1440,i,1683623848686525381,5403333682322579460,131072 /prefetch:12⤵PID:2648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2404 --field-trial-handle=1440,i,1683623848686525381,5403333682322579460,131072 /prefetch:12⤵PID:2984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1628 --field-trial-handle=1440,i,1683623848686525381,5403333682322579460,131072 /prefetch:22⤵PID:2192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3192 --field-trial-handle=1440,i,1683623848686525381,5403333682322579460,131072 /prefetch:12⤵PID:784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3608 --field-trial-handle=1440,i,1683623848686525381,5403333682322579460,131072 /prefetch:82⤵PID:1060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1992 --field-trial-handle=1440,i,1683623848686525381,5403333682322579460,131072 /prefetch:12⤵PID:2372
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2308
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
210KB
MD548d2860dd3168b6f06a4f27c6791bcaa
SHA1f5f803efed91cd45a36c3d6acdffaaf0e863bf8c
SHA25604d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77
SHA512172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
363B
MD5ccc29c0ec723cfcd07d5840bb7f943ec
SHA17f5cde63ac60b70340865186211e505aef734f37
SHA25676f445a22445ce3a8874af25f6ac0e98ff4eb5d451d77e1a9dbe33160d6015bb
SHA5128e42e9082c6b3b022e8d971c812a333a845e3c88d2e90058a9f0da1d553386f34a18f6ed6629fa309ef80d1434f4f7957eeb70d11e6d79febc9c83e333da1d7a
-
Filesize
5KB
MD50d6256f6f521c6cd16e65fc6e434c50d
SHA19f93475856d64a17920cfae667071fb6c1046ffd
SHA256f1d5c18f83a1720ce544f46b4d1fb6248f7351b4b953990b0a61f8ef876903aa
SHA5124063302049ddb45b36ad17279d18fda91efca216126be155eef753ce96a455268452444e05df22e4622ad205a7db523e16b2e223780e12d6cf75bc574fd9420d
-
Filesize
4KB
MD56e325ffc2e70a4fe981cd992a9b399a3
SHA148009c96daca3cd83b962417ed7f921cd524fc42
SHA2567ac4d84c6a75b0f92312aca91216f512c07679e3e75bee43528a58c0c3a56cb9
SHA5129b882379e96e25c6b3ac78e496a80912c1f459b1da1215763ba8db888ee5d69a3bcf3ae27e240d155c3b7ab884f36a78c4e9db3467a9f1d6398f5ad9ebd9a0a1
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2