Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    19-08-2024 06:02

General

  • Target

    source_prepared.exe

  • Size

    77.0MB

  • MD5

    55b83b291ac1c8ef0b36c51dbe67c47c

  • SHA1

    97e97744dcc44ddcead0f965184cece0d77c4d10

  • SHA256

    22e0f905628e65882d9082b394eafa63278d843ef1bf4052df8719e05fa13070

  • SHA512

    b0670e2d7901b21dbfb80758b0da8c499492e5298011e99bd6834f76251000a6acea9f5a5742e891bed474a1e8a4ab0a7f12d0d64d462727da7e921777e59a9f

  • SSDEEP

    1572864:avHcRlKWfh7vXSk8IpG7V+VPhqYdfME7tlHegiYweyJulZUdg+hgrFfEpV37U:avHcRYShTSkB05awcfLdMpuyhgr5Wo

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
    "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2276
    • C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
      "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
      2⤵
      • Loads dropped DLL
      PID:1216
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1068
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef69a9758,0x7fef69a9768,0x7fef69a9778
      2⤵
        PID:868
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1196 --field-trial-handle=1320,i,6636443726455698361,6522760278756122731,131072 /prefetch:2
        2⤵
          PID:2368
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1532 --field-trial-handle=1320,i,6636443726455698361,6522760278756122731,131072 /prefetch:8
          2⤵
            PID:2940
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1624 --field-trial-handle=1320,i,6636443726455698361,6522760278756122731,131072 /prefetch:8
            2⤵
              PID:3044
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2256 --field-trial-handle=1320,i,6636443726455698361,6522760278756122731,131072 /prefetch:1
              2⤵
                PID:1736
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2264 --field-trial-handle=1320,i,6636443726455698361,6522760278756122731,131072 /prefetch:1
                2⤵
                  PID:2168
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1192 --field-trial-handle=1320,i,6636443726455698361,6522760278756122731,131072 /prefetch:2
                  2⤵
                    PID:2828
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3184 --field-trial-handle=1320,i,6636443726455698361,6522760278756122731,131072 /prefetch:1
                    2⤵
                      PID:1044
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3468 --field-trial-handle=1320,i,6636443726455698361,6522760278756122731,131072 /prefetch:1
                      2⤵
                        PID:2012
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3680 --field-trial-handle=1320,i,6636443726455698361,6522760278756122731,131072 /prefetch:8
                        2⤵
                          PID:1036
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:2740

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\34466a9f-d2dd-4b35-8065-069697d073e8.tmp

                          Filesize

                          315KB

                          MD5

                          5e27206a7d01743faf7db9c80657785e

                          SHA1

                          fc6a5579023b041174bb8895ed246e2309ebd7ef

                          SHA256

                          369e63acfd6d130232006e8378018df99fe63552ab516c445790931aab6abba8

                          SHA512

                          fccce07a68ab0ac8a64c28be7175add0cd137a9986164c10c87d12c0942d29cafa4df3ce9241674d8f03c817071a4ca8f04d021f69240741a23040cb741a098a

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

                          Filesize

                          209KB

                          MD5

                          3e552d017d45f8fd93b94cfc86f842f2

                          SHA1

                          dbeebe83854328e2575ff67259e3fb6704b17a47

                          SHA256

                          27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

                          SHA512

                          e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          168B

                          MD5

                          6fcde39181333927a4ca491054e61045

                          SHA1

                          06f4c3093156d1afe3bb900576f3b6b1ff417a7a

                          SHA256

                          9bd073e5e34f3c713c62319dfe6b3dcbadb655f4110f29e4960123e6f9c7d6fb

                          SHA512

                          6c188f0e84f3de6a15333c91b1963fb7d90f935ba43d765b3be0d397083569354f9a8847d60fe5ff9be9ceb9a55fbf6787dd93275e1d982a00a2561810efcd22

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

                          Filesize

                          16B

                          MD5

                          aefd77f47fb84fae5ea194496b44c67a

                          SHA1

                          dcfbb6a5b8d05662c4858664f81693bb7f803b82

                          SHA256

                          4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

                          SHA512

                          b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                          Filesize

                          264KB

                          MD5

                          f50f89a0a91564d0b8a211f8921aa7de

                          SHA1

                          112403a17dd69d5b9018b8cede023cb3b54eab7d

                          SHA256

                          b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                          SHA512

                          bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          5KB

                          MD5

                          76f3423a5c55558ac6f1bbfe3ab2449e

                          SHA1

                          428746d816be7246d914c6bed970aa39637363d7

                          SHA256

                          e3c5a55c69ece4b2cd0a093941bff52ef5eea135d031df1fdb865b8fa413243a

                          SHA512

                          8a898d5aefb2c31df9534183f35c15be9611abef2fea997ad8c3653cd139602e5d6a40f86c50910e099a35c100e49aed96fad44838f565e34a2cccf55673c459

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                          Filesize

                          16B

                          MD5

                          18e723571b00fb1694a3bad6c78e4054

                          SHA1

                          afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                          SHA256

                          8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                          SHA512

                          43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          315KB

                          MD5

                          9ca4740ac0615ea78f28d491c4abd000

                          SHA1

                          3c5826cc13a7466e7bdf4231c4a94fb7727a1f7c

                          SHA256

                          98fe03a86c70e7aebe3ad486412f55146a5ad8c57b7136a295269ecb2a5219ad

                          SHA512

                          5a82e19250bceee37ca905e80e6edfe51a3fbdddcfea1180b723f5f53f6d436335d8ecd3cd0f38ef38909ff528cf6bab4037ef8a8f268a37ff12a709d962a3e4

                        • C:\Users\Admin\AppData\Local\Temp\_MEI22762\python312.dll

                          Filesize

                          1.7MB

                          MD5

                          36e9be7e881d1dc29295bf7599490241

                          SHA1

                          5b6746aedac80f0e6f16fc88136bcdcbd64b3c65

                          SHA256

                          ebef43e92267a17f44876c702c914aafa46b997b63223ff46b12149fd2a2616e

                          SHA512

                          090d4e9092b7fe00180164b6f84b4bd1d1a1e12dc8fea042eaa0e75cc08bb9994c91c3853bedec390208db4ef2e3447cd9be20d7dc20c14e6deb52a141d554cf

                        • C:\Users\Admin\AppData\Local\Temp\_MEI22762\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\INSTALLER

                          Filesize

                          4B

                          MD5

                          365c9bfeb7d89244f2ce01c1de44cb85

                          SHA1

                          d7a03141d5d6b1e88b6b59ef08b6681df212c599

                          SHA256

                          ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

                          SHA512

                          d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

                        • C:\Users\Admin\AppData\Local\Temp\_MEI22762\setuptools\_vendor\jaraco.text-3.12.1.dist-info\LICENSE

                          Filesize

                          1023B

                          MD5

                          141643e11c48898150daa83802dbc65f

                          SHA1

                          0445ed0f69910eeaee036f09a39a13c6e1f37e12

                          SHA256

                          86da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741

                          SHA512

                          ef62311602b466397baf0b23caca66114f8838f9e78e1b067787ceb709d09e0530e85a47bbcd4c5a0905b74fdb30df0cc640910c6cc2e67886e5b18794a3583f

                        • C:\Users\Admin\AppData\Local\Temp\_MEI22762\setuptools\_vendor\jaraco.text-3.12.1.dist-info\WHEEL

                          Filesize

                          92B

                          MD5

                          43136dde7dd276932f6197bb6d676ef4

                          SHA1

                          6b13c105452c519ea0b65ac1a975bd5e19c50122

                          SHA256

                          189eedfe4581172c1b6a02b97a8f48a14c0b5baa3239e4ca990fbd8871553714

                          SHA512

                          e7712ba7d36deb083ebcc3b641ad3e7d19fb071ee64ae3a35ad6a50ee882b20cd2e60ca1319199df12584fe311a6266ec74f96a3fb67e59f90c7b5909668aee1

                        • \??\pipe\crashpad_1068_KGYGEKMNBGXUGHKZ

                          MD5

                          d41d8cd98f00b204e9800998ecf8427e

                          SHA1

                          da39a3ee5e6b4b0d3255bfef95601890afd80709

                          SHA256

                          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                          SHA512

                          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                        • memory/1216-1365-0x000007FEF5A00000-0x000007FEF60C5000-memory.dmp

                          Filesize

                          6.8MB