2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad

Resubmissions

18-01-2025 08:14

250118-j45gysxpex 3

18-01-2025 08:13

250118-j4s4xsymcl 1

Analysis

max time kernel
28s
max time network
52s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-01-2025 08:14

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

eicar_com.zip
Size

184B
MD5

6ce6f415d8475545be5ba114f208b0ff
SHA1

d27265074c9eac2e2122ed69294dbc4d7cce9141
SHA256

2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad
SHA512

d9305862fe0bf552718d19db43075d88cffd768974627db60fa1a90a8d45563e035a6449663b8f66aac53791d77f37dbb5035159aa08e69fc473972022f80010

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2788	chrome.exe
2788	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1160	7zFM.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeRestorePrivilege	1160	7zFM.exe
Token: 35	1160	7zFM.exe
Token: SeSecurityPrivilege	1160	7zFM.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1160	7zFM.exe
1160	7zFM.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 2800	2788	chrome.exe	33
PID 2788 wrote to memory of 2800	2788	chrome.exe	33
PID 2788 wrote to memory of 2800	2788	chrome.exe	33
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 2616	2788	chrome.exe	35
PID 2788 wrote to memory of 3064	2788	chrome.exe	36
PID 2788 wrote to memory of 3064	2788	chrome.exe	36
PID 2788 wrote to memory of 3064	2788	chrome.exe	36
PID 2788 wrote to memory of 1108	2788	chrome.exe	37
PID 2788 wrote to memory of 1108	2788	chrome.exe	37
PID 2788 wrote to memory of 1108	2788	chrome.exe	37
PID 2788 wrote to memory of 1108	2788	chrome.exe	37
PID 2788 wrote to memory of 1108	2788	chrome.exe	37
PID 2788 wrote to memory of 1108	2788	chrome.exe	37
PID 2788 wrote to memory of 1108	2788	chrome.exe	37
PID 2788 wrote to memory of 1108	2788	chrome.exe	37
PID 2788 wrote to memory of 1108	2788	chrome.exe	37
PID 2788 wrote to memory of 1108	2788	chrome.exe	37
PID 2788 wrote to memory of 1108	2788	chrome.exe	37
PID 2788 wrote to memory of 1108	2788	chrome.exe	37
PID 2788 wrote to memory of 1108	2788	chrome.exe	37
PID 2788 wrote to memory of 1108	2788	chrome.exe	37
PID 2788 wrote to memory of 1108	2788	chrome.exe	37
PID 2788 wrote to memory of 1108	2788	chrome.exe	37
PID 2788 wrote to memory of 1108	2788	chrome.exe	37
PID 2788 wrote to memory of 1108	2788	chrome.exe	37
PID 2788 wrote to memory of 1108	2788	chrome.exe	37

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\eicar_com.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6949758,0x7fef6949768,0x7fef6949778
  2⤵
  PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1160 --field-trial-handle=1396,i,14736286114234450328,8776060073794877106,131072 /prefetch:2
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1572 --field-trial-handle=1396,i,14736286114234450328,8776060073794877106,131072 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1660 --field-trial-handle=1396,i,14736286114234450328,8776060073794877106,131072 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2336 --field-trial-handle=1396,i,14736286114234450328,8776060073794877106,131072 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2364 --field-trial-handle=1396,i,14736286114234450328,8776060073794877106,131072 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1544 --field-trial-handle=1396,i,14736286114234450328,8776060073794877106,131072 /prefetch:2
  2⤵
  PID:1008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1156 --field-trial-handle=1396,i,14736286114234450328,8776060073794877106,131072 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3652 --field-trial-handle=1396,i,14736286114234450328,8776060073794877106,131072 /prefetch:8
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3528 --field-trial-handle=1396,i,14736286114234450328,8776060073794877106,131072 /prefetch:1
  2⤵
  PID:876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3064 --field-trial-handle=1396,i,14736286114234450328,8776060073794877106,131072 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2536 --field-trial-handle=1396,i,14736286114234450328,8776060073794877106,131072 /prefetch:1
  2⤵
  PID:1296

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2112

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2760

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
3d0d8066154d8b7867f85ca1cae532b7

SHA1
40cb6ccd10af6e43564ba83ee91aa706fbad3b3d

SHA256
df107e0a9985ce75e8770c41458e294316027ef05c4bb77b7e07d02fa9ed0931

SHA512
140c173e9ebc30365fa719807fd759c0859277d54ce45d4ee92bb72afbfe9823fc12f333728a83f930c0615d7ff63366786f7ccfa77226360b0a81cffcf5ec6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
896f4b7c0b6cb92a1d930923fc8ecd55

SHA1
e16769c95a1598442050d07ecbde5da43f540a97

SHA256
be34e1cc58eae44033c102733af183336e90e10cd99c93c4d44f18840c27a887

SHA512
564f5271b12fc4b66c9863abbab5797f3e73127becfefe2c83549af216c0ff0aba74aa3f61385ba62c57d98c770587f27b4d7b4b134e05c03387001e3b28c6a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\CURRENT

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
170KB

MD5
8e82c057c2672b26f82972db8efa76c9

SHA1
e653a897f7424ebadc7d04a5340c6b1e15de4ad2

SHA256
1b33104a456bbc679ef0016754ea4c5e3a225003d61fa87651d5a3d36eb32b4e

SHA512
f96075fb216d1514b9eff49785c081555fec2ecf00b59514df1bbf8034cf74a3fa171bf9de8e235b3df6f76df03c383e895ba5e8f92a1e1dc19a5170012b1bfb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
170KB

MD5
63a1ebc8882e26bdbdd17b34896ace28

SHA1
cb33db5173643fba614098511f1dd81327cc1cfe

SHA256
65aa1516fd778e3dc96393c1839ee0d662a30a3bfe5336158db1cadebd037d4e

SHA512
eaba333dc603225be1f9988be064fdc89ef94e78e9f1e08874bdb21a6fd18ca6112687b20e85192ada5722e22013f6d1ee2780afbb1cdab9dee02204c0634326

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d5429eaa-ccfc-46ea-a69c-8a116b797145.tmp

Filesize
170KB

MD5
0e16cbc3b2726e81a5c3fc237a682d6f

SHA1
71b805acc2e47e4984ea75ba779a2ecd1ba30320

SHA256
2de847e1663a69340187c02badf2fe6c3f3e8cad3b0c02aaa638f465bed7d46e

SHA512
752facfd9ec25965121be42810f5effbd61945fce1d59cf3db698b3ab2ed116b611f47629b1033f0aca8be1dd79bbd2ba512039aebd86aa946a98940756ac64d

Download Submit