Analysis
-
max time kernel
387s -
max time network
362s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19/08/2024, 10:03
Static task
static1
Behavioral task
behavioral1
Sample
SKlauncher-3.2 (1).exe
Resource
win7-20240708-en
General
-
Target
SKlauncher-3.2 (1).exe
-
Size
1.6MB
-
MD5
b63468dd118dfbca5ef7967ba344e0e3
-
SHA1
2ba4f0df5f3bd284bf2a89aba320e4440d8b8355
-
SHA256
05ae2f0dd61ef10019b94c200e8df192b767bb4cc24a7e7b329ab43cc9c74caf
-
SHA512
007ecb7445dc0c01a802b5a2c91313aae59f9dc96e27455dd85e7a92a4e649d683fbc2ada5f48925d9ab3b4fdaea20aa89eeb442fde079902aecb5ca3454a548
-
SSDEEP
49152:HIBc3n9dRvwVlzhFAQ/ggUTPQjYEiim7V:oBaO/FAqMQjYEXm
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2728 chrome.exe 2728 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe Token: SeShutdownPrivilege 2728 chrome.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2728 wrote to memory of 2636 2728 chrome.exe 32 PID 2728 wrote to memory of 2636 2728 chrome.exe 32 PID 2728 wrote to memory of 2636 2728 chrome.exe 32 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2712 2728 chrome.exe 34 PID 2728 wrote to memory of 2368 2728 chrome.exe 35 PID 2728 wrote to memory of 2368 2728 chrome.exe 35 PID 2728 wrote to memory of 2368 2728 chrome.exe 35 PID 2728 wrote to memory of 2656 2728 chrome.exe 36 PID 2728 wrote to memory of 2656 2728 chrome.exe 36 PID 2728 wrote to memory of 2656 2728 chrome.exe 36 PID 2728 wrote to memory of 2656 2728 chrome.exe 36 PID 2728 wrote to memory of 2656 2728 chrome.exe 36 PID 2728 wrote to memory of 2656 2728 chrome.exe 36 PID 2728 wrote to memory of 2656 2728 chrome.exe 36 PID 2728 wrote to memory of 2656 2728 chrome.exe 36 PID 2728 wrote to memory of 2656 2728 chrome.exe 36 PID 2728 wrote to memory of 2656 2728 chrome.exe 36 PID 2728 wrote to memory of 2656 2728 chrome.exe 36 PID 2728 wrote to memory of 2656 2728 chrome.exe 36 PID 2728 wrote to memory of 2656 2728 chrome.exe 36 PID 2728 wrote to memory of 2656 2728 chrome.exe 36 PID 2728 wrote to memory of 2656 2728 chrome.exe 36 PID 2728 wrote to memory of 2656 2728 chrome.exe 36 PID 2728 wrote to memory of 2656 2728 chrome.exe 36 PID 2728 wrote to memory of 2656 2728 chrome.exe 36 PID 2728 wrote to memory of 2656 2728 chrome.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\SKlauncher-3.2 (1).exe"C:\Users\Admin\AppData\Local\Temp\SKlauncher-3.2 (1).exe"1⤵PID:3040
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5f29758,0x7fef5f29768,0x7fef5f297782⤵PID:2636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 --field-trial-handle=1188,i,13483881157503731023,10851952530824420585,131072 /prefetch:22⤵PID:2712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1488 --field-trial-handle=1188,i,13483881157503731023,10851952530824420585,131072 /prefetch:82⤵PID:2368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1592 --field-trial-handle=1188,i,13483881157503731023,10851952530824420585,131072 /prefetch:82⤵PID:2656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2128 --field-trial-handle=1188,i,13483881157503731023,10851952530824420585,131072 /prefetch:12⤵PID:1800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2148 --field-trial-handle=1188,i,13483881157503731023,10851952530824420585,131072 /prefetch:12⤵PID:1960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1224 --field-trial-handle=1188,i,13483881157503731023,10851952530824420585,131072 /prefetch:22⤵PID:1856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2860 --field-trial-handle=1188,i,13483881157503731023,10851952530824420585,131072 /prefetch:12⤵PID:1136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3712 --field-trial-handle=1188,i,13483881157503731023,10851952530824420585,131072 /prefetch:82⤵PID:2900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3756 --field-trial-handle=1188,i,13483881157503731023,10851952530824420585,131072 /prefetch:12⤵PID:1688
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1916
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2432
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5ac1⤵PID:2852
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
209KB
MD53e552d017d45f8fd93b94cfc86f842f2
SHA1dbeebe83854328e2575ff67259e3fb6704b17a47
SHA25627d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
SHA512e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
361B
MD50363b96e96d531565aaf582e0c3f6f96
SHA144adbd65b422531db56359286981a485df293b86
SHA25608d662befd5a2741a8e4c70e5f5d76b2d5df0190a8aeba3c760ff13dfd7e336f
SHA5122be6e6b2658412ebc364e9679a6829efa2bb768bfd7aec5349a67d0b80f079b781c0f3904f1f5877209998bdedd686f444f3a656254a941befc6225621eb680f
-
Filesize
5KB
MD5d929987ea69c300d5b6966f084c09cb3
SHA1cff2146deaf9a52f006420854c5cf5119932efda
SHA256d1032856a1947234e86e1548073051a5ba91b4623bb3b16df84d6c8ac59d9908
SHA5126da41b207ec2b6ab93fc8cd5746c38694741193d4596440263a036f63a97b6d7f7aa5f8146cb32aa63b8af6207a71cd11d1c3db880b4e20cfc0fd0ef68a5203b
-
Filesize
5KB
MD542ad6f7a833477f8aeec4d96fe4448a8
SHA11dda358497fc8526b62c5134b70230ff04bb001c
SHA256c5af270dfcfd13edaa64d5fce00c676854b1be58c3cdee038d99c4e95c5a2c3b
SHA512b85454e5410166ad9134cafb765238bcb0a88780a695a1b7613327c1794206afe2646c841a49b471fc137c32acb2a057de7bb9dbf0fade9286c391a1147d8ad3
-
Filesize
6KB
MD5cbfb37076ff26e6e89df7be53ebcf2e4
SHA19d51f0d2b64896b1dfe133a4fb4fc062cb315261
SHA256e8ded17f8e5b3233109a16c023c8be015a1cadf73829984a6d852bdc27bc1ee4
SHA512cdb290c933cdbe21845b8048dd0e7ea5a47ce161362cad13ed0e537159d637510d6a9575be4c0a04e6fb78f7bda72375228d1a9e8bbe152813ad71f77a08e32d
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
314KB
MD55e1d2618be067e1ab6635100ef984e4b
SHA11408fae7643e8413cd6573848898d7fa57ef7acc
SHA256f7d5bd68685e0dc62f8e3551da0b60f76a63961bed51fa25ecb70d56b1cac1df
SHA51205af0d9879c3ac6e4f8f0c7b8f506d2da5a9e66d6b4744041f7b89f2efb6b973efa15e7a33f2f8707ebc730f1ecc49a3b006f524608b831c4c10c5a01dc3c07f
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
314KB
MD5a51e290d4e03918a2e0c3f890754e94c
SHA15f0d7a88c378423f5b9801485277e89fece951fb
SHA2560bc10699cb131b318e09b94521fe54f69b9cf6b509ce9cacda05cf1f2343b946
SHA512803e9999befdc962c67afb9b7965725326375eab528b9aa06d4a073a60afd5e599eab88373f6c24ec4ec0b1d5804bb3625b508e61cdfffd9f5ef9abe93b41d53