Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22/02/2025, 16:10
Behavioral task
behavioral1
Sample
main.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
main.exe
Resource
win10v2004-20250217-en
General
-
Target
main.exe
-
Size
17.8MB
-
MD5
9fcf21522322bdb55c8ac10d76c7ede9
-
SHA1
1718f81a21bd592a33d6b8027904f0853027eab0
-
SHA256
85d716f020689526c93aadc77c6d56af3b79a506e8f5db4815f4aee36c64b92c
-
SHA512
9ab9e1d67d47f5fb9e8c161a39f5aadb8df09d98ef65581b97e23d646a7d5480f1330801941460671812c1e512616eacfb39a08aa4c41ef92c6b73409d844f62
-
SSDEEP
393216:GqPnLFXlrPmQ8DOETgsvfGFlgvwLxQvEwoE5X87nXCE9q:rPLFXNOQhEam2jwFEnK
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1728 main.exe -
resource yara_rule behavioral1/files/0x000400000001c91e-111.dat upx behavioral1/memory/1728-113-0x000007FEF5B70000-0x000007FEF5FDE000-memory.dmp upx -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1920 chrome.exe 1920 chrome.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeShutdownPrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 844 wrote to memory of 1728 844 main.exe 32 PID 844 wrote to memory of 1728 844 main.exe 32 PID 844 wrote to memory of 1728 844 main.exe 32 PID 1920 wrote to memory of 1548 1920 chrome.exe 34 PID 1920 wrote to memory of 1548 1920 chrome.exe 34 PID 1920 wrote to memory of 1548 1920 chrome.exe 34 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 2512 1920 chrome.exe 36 PID 1920 wrote to memory of 1332 1920 chrome.exe 37 PID 1920 wrote to memory of 1332 1920 chrome.exe 37 PID 1920 wrote to memory of 1332 1920 chrome.exe 37 PID 1920 wrote to memory of 1692 1920 chrome.exe 38 PID 1920 wrote to memory of 1692 1920 chrome.exe 38 PID 1920 wrote to memory of 1692 1920 chrome.exe 38 PID 1920 wrote to memory of 1692 1920 chrome.exe 38 PID 1920 wrote to memory of 1692 1920 chrome.exe 38 PID 1920 wrote to memory of 1692 1920 chrome.exe 38 PID 1920 wrote to memory of 1692 1920 chrome.exe 38 PID 1920 wrote to memory of 1692 1920 chrome.exe 38 PID 1920 wrote to memory of 1692 1920 chrome.exe 38 PID 1920 wrote to memory of 1692 1920 chrome.exe 38 PID 1920 wrote to memory of 1692 1920 chrome.exe 38 PID 1920 wrote to memory of 1692 1920 chrome.exe 38 PID 1920 wrote to memory of 1692 1920 chrome.exe 38 PID 1920 wrote to memory of 1692 1920 chrome.exe 38 PID 1920 wrote to memory of 1692 1920 chrome.exe 38 PID 1920 wrote to memory of 1692 1920 chrome.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\main.exe"C:\Users\Admin\AppData\Local\Temp\main.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\main.exe"C:\Users\Admin\AppData\Local\Temp\main.exe"2⤵
- Loads dropped DLL
PID:1728
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2684
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef66f9758,0x7fef66f9768,0x7fef66f97782⤵PID:1548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1120 --field-trial-handle=1304,i,6521518282545380679,6451035330663418936,131072 /prefetch:22⤵PID:2512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1512 --field-trial-handle=1304,i,6521518282545380679,6451035330663418936,131072 /prefetch:82⤵PID:1332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1584 --field-trial-handle=1304,i,6521518282545380679,6451035330663418936,131072 /prefetch:82⤵PID:1692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2324 --field-trial-handle=1304,i,6521518282545380679,6451035330663418936,131072 /prefetch:12⤵PID:1236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2332 --field-trial-handle=1304,i,6521518282545380679,6451035330663418936,131072 /prefetch:12⤵PID:2796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2672 --field-trial-handle=1304,i,6521518282545380679,6451035330663418936,131072 /prefetch:22⤵PID:2652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3248 --field-trial-handle=1304,i,6521518282545380679,6451035330663418936,131072 /prefetch:12⤵PID:2952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3484 --field-trial-handle=1304,i,6521518282545380679,6451035330663418936,131072 /prefetch:82⤵PID:3036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3616 --field-trial-handle=1304,i,6521518282545380679,6451035330663418936,131072 /prefetch:82⤵PID:2320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3896 --field-trial-handle=1304,i,6521518282545380679,6451035330663418936,131072 /prefetch:82⤵PID:2416
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2848
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2496
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
355KB
MD5c6bd08086d7fe436d1ca4ea35b95e98f
SHA13e5717d2742c940ee82553a920b6a36d22f2d846
SHA2566999b66aa43959784e4f25b92ab7f1e5eb9a364b3b11245ce513128de516fd07
SHA5126c15ce2e77d29af382d8041e0885644874c4672c251462114d8011271fbc75b92be8f40a487785d0fffe4043626e045f2a68237b590cf12d9a4a03a8c25c2637
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
4KB
MD547e51868392040a667a4df18b4918474
SHA1080c340a86cf128d014729cbb93b47b3f24d957d
SHA2568474b1bce29bfe89edbfbba052fd5c1943793d3921a111ae92c6ebcc57b23497
SHA512e1c3d7ce5d9196e55ec5c7c404a3063aae9fc8123c38e208145f3431dbe3a5ca0fa91049526d06344a23b13a0339b5398a5d676effba03c7a7b15e78bad7f61a
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
355KB
MD55fade87e380dfd4e37dc07e4bfbc4d09
SHA1bc06ea3b82f0063bb1d77a7d479a5f3e9c13e812
SHA2568f79351ca8f7472293c1780736f01d98073f99fe5d7546663d05164971918dfe
SHA512978415f8afda29d6818fcd177905ec4b35a26aa3599321e78f1c1527dd3af4b75e873f32eadb1228fe93eaf02aef2b9d3471b95635ed0b771ba2aea7dfb6f2bd
-
Filesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378