005fe74d7320b7a2ef97d8131acc7f7287c8076a42d99221cea59f1c4caa1eb6

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-12-2024 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

spoofer_permV2.exe
Size

7.7MB
MD5

a105bc4243b0ce0915900a3565558f34
SHA1

1b4cb9862c6945b6e33f8a53e9ca0288d734e9e9
SHA256

005fe74d7320b7a2ef97d8131acc7f7287c8076a42d99221cea59f1c4caa1eb6
SHA512

58d8cadd12e4a983f5cce584ea7cf12830bf3a30782a4ce37653bbde25db5e51bad5df012781168ce435ae4ac26155bea777ffcb8b3e98284d93037d6a9e13f7
SSDEEP

196608:E7HYLwfI9jUCzi4H1qSiXLGVi7DMgpZ3Q0VMwICEc/jE:OIHziK1piXLGVE4Ue0VJY

Score

7^/10

discovery upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2708	spoofer_permV2.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000500000001964b-21.dat	upx
behavioral1/memory/2708-23-0x000007FEF61A0000-0x000007FEF6803000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
272	chrome.exe
272	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2708	2032	spoofer_permV2.exe	31
PID 2032 wrote to memory of 2708	2032	spoofer_permV2.exe	31
PID 2032 wrote to memory of 2708	2032	spoofer_permV2.exe	31
PID 272 wrote to memory of 900	272	chrome.exe	35
PID 272 wrote to memory of 900	272	chrome.exe	35
PID 272 wrote to memory of 900	272	chrome.exe	35
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 1132	272	chrome.exe	37
PID 272 wrote to memory of 2636	272	chrome.exe	38
PID 272 wrote to memory of 2636	272	chrome.exe	38
PID 272 wrote to memory of 2636	272	chrome.exe	38
PID 272 wrote to memory of 2928	272	chrome.exe	39
PID 272 wrote to memory of 2928	272	chrome.exe	39
PID 272 wrote to memory of 2928	272	chrome.exe	39
PID 272 wrote to memory of 2928	272	chrome.exe	39
PID 272 wrote to memory of 2928	272	chrome.exe	39
PID 272 wrote to memory of 2928	272	chrome.exe	39
PID 272 wrote to memory of 2928	272	chrome.exe	39
PID 272 wrote to memory of 2928	272	chrome.exe	39
PID 272 wrote to memory of 2928	272	chrome.exe	39
PID 272 wrote to memory of 2928	272	chrome.exe	39
PID 272 wrote to memory of 2928	272	chrome.exe	39
PID 272 wrote to memory of 2928	272	chrome.exe	39
PID 272 wrote to memory of 2928	272	chrome.exe	39
PID 272 wrote to memory of 2928	272	chrome.exe	39
PID 272 wrote to memory of 2928	272	chrome.exe	39
PID 272 wrote to memory of 2928	272	chrome.exe	39

C:\Users\Admin\AppData\Local\Temp\spoofer_permV2.exe
"C:\Users\Admin\AppData\Local\Temp\spoofer_permV2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Local\Temp\spoofer_permV2.exe
  "C:\Users\Admin\AppData\Local\Temp\spoofer_permV2.exe"
  2⤵
  - Loads dropped DLL
  PID:2708

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6de9758,0x7fef6de9768,0x7fef6de9778
  2⤵
  PID:900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1304,i,5195415609180610805,8374020748387111493,131072 /prefetch:2
  2⤵
  PID:1132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1528 --field-trial-handle=1304,i,5195415609180610805,8374020748387111493,131072 /prefetch:8
  2⤵
  PID:2636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1608 --field-trial-handle=1304,i,5195415609180610805,8374020748387111493,131072 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2184 --field-trial-handle=1304,i,5195415609180610805,8374020748387111493,131072 /prefetch:1
  2⤵
  PID:604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2188 --field-trial-handle=1304,i,5195415609180610805,8374020748387111493,131072 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1464 --field-trial-handle=1304,i,5195415609180610805,8374020748387111493,131072 /prefetch:2
  2⤵
  PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2880 --field-trial-handle=1304,i,5195415609180610805,8374020748387111493,131072 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3672 --field-trial-handle=1304,i,5195415609180610805,8374020748387111493,131072 /prefetch:8
  2⤵
  PID:2324

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
2ac5629524e4bd12c1daf6901367b288

SHA1
ace3796a19c6dcf0d927a8b5f5f148abfcd5f19a

SHA256
af7b5ad6fc8f3e5c6e2fc31e9dc0315a5babfd4c881948d41fd30875a8c61364

SHA512
a9ce96632903237be165eb2fca40f68a564b334c7a40c92c3e6a86b59cb3102212b77f9fb84a80bcb3d13cdab9cb3268afd7b3e0dc3ae8efaf1341e8dbdfdefd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
1618782207c9c2adc69264c6466a9a2f

SHA1
5e03df27e74271fe04ad961f35d9ab798ea79436

SHA256
188851022e2dc1f858886085528e9d827c75f59a04f8d2d160e63bd9fa28f52d

SHA512
91cf95133617f6db28d352774e3db5295ab7cee05f22689a2be06cd98212c59e5c5e2379df6e0d6b1fc0fe1cd7b9ad57b37468f41562b3a8b14540efdf03e264

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
347KB

MD5
edc88d00b524231497afb93c93d230e0

SHA1
60d45c7abf2857f8d91438f4f420f54b015ede7e

SHA256
44f7dc31aa1286d865407425964216f04a53c472b75ba14bfb05bcfe82a2c3c9

SHA512
cf59ece3eca1a02b83419f96850a5a176bb62dd2345a8bf2994c39aaf6e8f537cf64594d2b73adcd439132aa0333bdfe7165651eac14f39c859289f116b5988b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e8f897fc-69dc-497d-8467-27cdf6d3d14e.tmp

Filesize
347KB

MD5
aad12577f7dd208c92239e278f49b87f

SHA1
67032699104f03ac06644a77012bb648ecd7a4b6

SHA256
008735dc6bd6a84efbe0083c4325e821811c461d73e3e56309a2c86c11a5b82b

SHA512
2b9168e3700cdbeca27fa0c9921e47de7ffb020a99ed95ee97e7ce6efcce8e545023b9def215e365b9ad4988b9cd220e383e451b76b10458a3a53a2ef91a929a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20322\python313.dll

Filesize
1.8MB

MD5
6ef5d2f77064df6f2f47af7ee4d44f0f

SHA1
0003946454b107874aa31839d41edcda1c77b0af

SHA256
ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367

SHA512
1662cc02635d63b8114b41d11ec30a2af4b0b60209196aac937c2a608588fee47c6e93163ea6bf958246c32759ac5c82a712ea3d690e796e2070ac0ff9104266

Download Submit
memory/2708-23-0x000007FEF61A0000-0x000007FEF6803000-memory.dmp

Filesize
6.4MB

Download
memory/2708-92-0x000007FEF61A0000-0x000007FEF6803000-memory.dmp

Filesize
6.4MB

Download