c8ebac16286aefc992369dc4cec84550c734b29098c674042ee98306cbe9e7e6

Analysis

max time kernel
79s
max time network
147s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

RangerHack (pass 2024).zip
Size

1.2MB
MD5

2640435c54091037d2917a71b800d997
SHA1

265df495f8122f75cd0e0f57ae9d801b0552c56c
SHA256

c8ebac16286aefc992369dc4cec84550c734b29098c674042ee98306cbe9e7e6
SHA512

1eab3ee47e7fadf85e1d61d2ca8d10b6169f64718ba0a33d4ea22265d8c18a8fcb0731f7907792031a00ac748432e1cc31569a4201d33f968f3bb172430444d8
SSDEEP

24576:9B/0QEctdUQMpVrV1mRDsZ6VyAuyceSoVaVazaJut6BaeJYtaWvW15D3z4L:9tO4BMpV6AAuy1S4aMaiUJJYtTO19z4L

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
568	chrome.exe
568	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe
Token: SeShutdownPrivilege	568	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe
568	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 2536	568	chrome.exe	32
PID 568 wrote to memory of 2536	568	chrome.exe	32
PID 568 wrote to memory of 2536	568	chrome.exe	32
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 3012	568	chrome.exe	34
PID 568 wrote to memory of 2740	568	chrome.exe	35
PID 568 wrote to memory of 2740	568	chrome.exe	35
PID 568 wrote to memory of 2740	568	chrome.exe	35
PID 568 wrote to memory of 2928	568	chrome.exe	36
PID 568 wrote to memory of 2928	568	chrome.exe	36
PID 568 wrote to memory of 2928	568	chrome.exe	36
PID 568 wrote to memory of 2928	568	chrome.exe	36
PID 568 wrote to memory of 2928	568	chrome.exe	36
PID 568 wrote to memory of 2928	568	chrome.exe	36
PID 568 wrote to memory of 2928	568	chrome.exe	36
PID 568 wrote to memory of 2928	568	chrome.exe	36
PID 568 wrote to memory of 2928	568	chrome.exe	36
PID 568 wrote to memory of 2928	568	chrome.exe	36
PID 568 wrote to memory of 2928	568	chrome.exe	36
PID 568 wrote to memory of 2928	568	chrome.exe	36
PID 568 wrote to memory of 2928	568	chrome.exe	36
PID 568 wrote to memory of 2928	568	chrome.exe	36
PID 568 wrote to memory of 2928	568	chrome.exe	36
PID 568 wrote to memory of 2928	568	chrome.exe	36
PID 568 wrote to memory of 2928	568	chrome.exe	36
PID 568 wrote to memory of 2928	568	chrome.exe	36
PID 568 wrote to memory of 2928	568	chrome.exe	36

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\RangerHack (pass 2024).zip"
1⤵
PID:2704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6649758,0x7fef6649768,0x7fef6649778
  2⤵
  PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1180 --field-trial-handle=1408,i,5883888150329015882,2091922411795413426,131072 /prefetch:2
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1476 --field-trial-handle=1408,i,5883888150329015882,2091922411795413426,131072 /prefetch:8
  2⤵
  PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 --field-trial-handle=1408,i,5883888150329015882,2091922411795413426,131072 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2272 --field-trial-handle=1408,i,5883888150329015882,2091922411795413426,131072 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2288 --field-trial-handle=1408,i,5883888150329015882,2091922411795413426,131072 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1180 --field-trial-handle=1408,i,5883888150329015882,2091922411795413426,131072 /prefetch:2
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3192 --field-trial-handle=1408,i,5883888150329015882,2091922411795413426,131072 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3628 --field-trial-handle=1408,i,5883888150329015882,2091922411795413426,131072 /prefetch:8
  2⤵
  PID:1308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=2340 --field-trial-handle=1408,i,5883888150329015882,2091922411795413426,131072 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=1188 --field-trial-handle=1408,i,5883888150329015882,2091922411795413426,131072 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2824 --field-trial-handle=1408,i,5883888150329015882,2091922411795413426,131072 /prefetch:1
  2⤵
  PID:2068

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
361B

MD5
916fc127ef139c1515e293693f4a9027

SHA1
467a11a5415910f54ac5c920e54ee5c54e53c2a4

SHA256
43c7d457aac6a9a61cf9a17d455ba07dd96668070a78520cb4095ce3ed747374

SHA512
8f55ecf5dc5b454e08f103d77d2cc58f732440b5002315233b2692030d5b42d6cb6ed79de9996af2e491036b16450dae5ae4c1fcfb54088f046d5a894157a0e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
281adc781b473b1070fc7ee93b5f47c0

SHA1
5d3993ddbe72143ee846192983ef724761f6ef56

SHA256
d67cb69d666c10b3e7139e90e97ee1ec8ad935b22a7545b6f7dd77493c2f9378

SHA512
92e9eb316ad46b603f57a5b0a049c61609c77e86367943ba86692a7724f7211195e2903e88207f5b5ecaca1b4dabeab53ee2f00a8b49fdb83438f864aa37a4da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
ca5bc55dcc6f44f6dc01084a7d2c3476

SHA1
62e88197c6d240c0d4c4adb173f7dcdef0614c60

SHA256
e9b53aacab22a5cca121bb34ea16e2769b87392b1e37fa55411ce68f7e897489

SHA512
cdb1c6539b9fcbfc367e98b0a0a06cc12bf24bac1a932de64cf265c25d7728da0ec5700cd0e619f3737820b0532b2dd2aa1ae416fd82bd60df3098ad4d12ccaa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
9fd48cfd9755278b541178f1a0321f6c

SHA1
1e468b438fef3f77b2376ec271d16884f1cbe2af

SHA256
75f6501f5eb0d19f54b0dd63223dae7dc27f23dc27a84dfc6194776e7dca2da6

SHA512
b8f0edb152aafb1479ca6f55a8bb2850ec68ff80cc3003a73f7abe93199b5dd3ad7106f5fd58c5bba0800756898c7fa265bbc180f679ee4a5308185932f521e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit