Analysis

  • max time kernel
    121s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    22/02/2025, 16:10

General

  • Target

    main.exe

  • Size

    17.8MB

  • MD5

    9fcf21522322bdb55c8ac10d76c7ede9

  • SHA1

    1718f81a21bd592a33d6b8027904f0853027eab0

  • SHA256

    85d716f020689526c93aadc77c6d56af3b79a506e8f5db4815f4aee36c64b92c

  • SHA512

    9ab9e1d67d47f5fb9e8c161a39f5aadb8df09d98ef65581b97e23d646a7d5480f1330801941460671812c1e512616eacfb39a08aa4c41ef92c6b73409d844f62

  • SSDEEP

    393216:GqPnLFXlrPmQ8DOETgsvfGFlgvwLxQvEwoE5X87nXCE9q:rPLFXNOQhEam2jwFEnK

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:844
    • C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      2⤵
      • Loads dropped DLL
      PID:1728
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2684
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1920
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef66f9758,0x7fef66f9768,0x7fef66f9778
        2⤵
          PID:1548
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1120 --field-trial-handle=1304,i,6521518282545380679,6451035330663418936,131072 /prefetch:2
          2⤵
            PID:2512
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1512 --field-trial-handle=1304,i,6521518282545380679,6451035330663418936,131072 /prefetch:8
            2⤵
              PID:1332
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1584 --field-trial-handle=1304,i,6521518282545380679,6451035330663418936,131072 /prefetch:8
              2⤵
                PID:1692
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2324 --field-trial-handle=1304,i,6521518282545380679,6451035330663418936,131072 /prefetch:1
                2⤵
                  PID:1236
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2332 --field-trial-handle=1304,i,6521518282545380679,6451035330663418936,131072 /prefetch:1
                  2⤵
                    PID:2796
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2672 --field-trial-handle=1304,i,6521518282545380679,6451035330663418936,131072 /prefetch:2
                    2⤵
                      PID:2652
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3248 --field-trial-handle=1304,i,6521518282545380679,6451035330663418936,131072 /prefetch:1
                      2⤵
                        PID:2952
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3484 --field-trial-handle=1304,i,6521518282545380679,6451035330663418936,131072 /prefetch:8
                        2⤵
                          PID:3036
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3616 --field-trial-handle=1304,i,6521518282545380679,6451035330663418936,131072 /prefetch:8
                          2⤵
                            PID:2320
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3896 --field-trial-handle=1304,i,6521518282545380679,6451035330663418936,131072 /prefetch:8
                            2⤵
                              PID:2416
                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                            1⤵
                              PID:2848
                            • C:\Windows\explorer.exe
                              "C:\Windows\explorer.exe"
                              1⤵
                                PID:2496

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\501b149d-247d-499f-afeb-ae3b923e52c2.tmp

                                Filesize

                                355KB

                                MD5

                                c6bd08086d7fe436d1ca4ea35b95e98f

                                SHA1

                                3e5717d2742c940ee82553a920b6a36d22f2d846

                                SHA256

                                6999b66aa43959784e4f25b92ab7f1e5eb9a364b3b11245ce513128de516fd07

                                SHA512

                                6c15ce2e77d29af382d8041e0885644874c4672c251462114d8011271fbc75b92be8f40a487785d0fffe4043626e045f2a68237b590cf12d9a4a03a8c25c2637

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                Filesize

                                264KB

                                MD5

                                f50f89a0a91564d0b8a211f8921aa7de

                                SHA1

                                112403a17dd69d5b9018b8cede023cb3b54eab7d

                                SHA256

                                b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                SHA512

                                bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                4KB

                                MD5

                                47e51868392040a667a4df18b4918474

                                SHA1

                                080c340a86cf128d014729cbb93b47b3f24d957d

                                SHA256

                                8474b1bce29bfe89edbfbba052fd5c1943793d3921a111ae92c6ebcc57b23497

                                SHA512

                                e1c3d7ce5d9196e55ec5c7c404a3063aae9fc8123c38e208145f3431dbe3a5ca0fa91049526d06344a23b13a0339b5398a5d676effba03c7a7b15e78bad7f61a

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\CURRENT

                                Filesize

                                16B

                                MD5

                                18e723571b00fb1694a3bad6c78e4054

                                SHA1

                                afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                SHA256

                                8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                SHA512

                                43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                355KB

                                MD5

                                5fade87e380dfd4e37dc07e4bfbc4d09

                                SHA1

                                bc06ea3b82f0063bb1d77a7d479a5f3e9c13e812

                                SHA256

                                8f79351ca8f7472293c1780736f01d98073f99fe5d7546663d05164971918dfe

                                SHA512

                                978415f8afda29d6818fcd177905ec4b35a26aa3599321e78f1c1527dd3af4b75e873f32eadb1228fe93eaf02aef2b9d3471b95635ed0b771ba2aea7dfb6f2bd

                              • C:\Users\Admin\AppData\Local\Temp\_MEI8442\python310.dll

                                Filesize

                                1.4MB

                                MD5

                                69d4f13fbaeee9b551c2d9a4a94d4458

                                SHA1

                                69540d8dfc0ee299a7ff6585018c7db0662aa629

                                SHA256

                                801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046

                                SHA512

                                8e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378

                              • memory/1728-113-0x000007FEF5B70000-0x000007FEF5FDE000-memory.dmp

                                Filesize

                                4.4MB