Analysis
- user interaction
yes - max time kernel
18s - max time network
17s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/05/2026, 16:04
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://raw.githubusercontent.com/professor9-sys/oldlauncher928/refs/heads/main/woofer.rar
Resource
win11-20260130-en
windows11-21h2-x64
15 signatures
150 seconds
General
- Target https://raw.githubusercontent.com/professor9-sys/oldlauncher928/refs/heads/main/woofer.rar
- Sample260504-th8mlafs6s
Score
6/10
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 raw.githubusercontent.com 6 raw.githubusercontent.com - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2392 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134223842867371053" chrome.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings OpenWith.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\woofer.rar:Zone.Identifier chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1404 chrome.exe 1404 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe - Suspicious use of AdjustPrivilegeToken 34 IoCs
description pid Process Token: SeShutdownPrivilege 1404 chrome.exe Token: SeCreatePagefilePrivilege 1404 chrome.exe Token: SeShutdownPrivilege 1404 chrome.exe Token: SeCreatePagefilePrivilege 1404 chrome.exe Token: SeShutdownPrivilege 1404 chrome.exe Token: SeCreatePagefilePrivilege 1404 chrome.exe Token: SeShutdownPrivilege 1404 chrome.exe Token: SeCreatePagefilePrivilege 1404 chrome.exe Token: SeShutdownPrivilege 1404 chrome.exe Token: SeCreatePagefilePrivilege 1404 chrome.exe Token: SeShutdownPrivilege 1404 chrome.exe Token: SeCreatePagefilePrivilege 1404 chrome.exe Token: SeShutdownPrivilege 1404 chrome.exe Token: SeCreatePagefilePrivilege 1404 chrome.exe Token: SeShutdownPrivilege 1404 chrome.exe Token: SeCreatePagefilePrivilege 1404 chrome.exe Token: SeShutdownPrivilege 1404 chrome.exe Token: SeCreatePagefilePrivilege 1404 chrome.exe Token: SeShutdownPrivilege 1404 chrome.exe Token: SeCreatePagefilePrivilege 1404 chrome.exe Token: SeShutdownPrivilege 1404 chrome.exe Token: SeCreatePagefilePrivilege 1404 chrome.exe Token: SeShutdownPrivilege 1404 chrome.exe Token: SeCreatePagefilePrivilege 1404 chrome.exe Token: SeShutdownPrivilege 1404 chrome.exe Token: SeCreatePagefilePrivilege 1404 chrome.exe Token: SeShutdownPrivilege 1404 chrome.exe Token: SeCreatePagefilePrivilege 1404 chrome.exe Token: SeShutdownPrivilege 1404 chrome.exe Token: SeCreatePagefilePrivilege 1404 chrome.exe Token: SeShutdownPrivilege 1404 chrome.exe Token: SeCreatePagefilePrivilege 1404 chrome.exe Token: SeShutdownPrivilege 1404 chrome.exe Token: SeCreatePagefilePrivilege 1404 chrome.exe - Suspicious use of FindShellTrayWindow 42 IoCs
pid Process 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe 1404 chrome.exe - Suspicious use of SetWindowsHookEx 35 IoCs
pid Process 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe 5292 OpenWith.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1404 wrote to memory of 2656 1404 chrome.exe 80 PID 1404 wrote to memory of 4728 1404 chrome.exe 81 PID 1404 wrote to memory of 2392 1404 chrome.exe 82 PID 1404 wrote to memory of 4728 1404 chrome.exe 81 PID 1404 wrote to memory of 3936 1404 chrome.exe 84 PID 1404 wrote to memory of 3936 1404 chrome.exe 84 PID 1404 wrote to memory of 2996 1404 chrome.exe 86 PID 1404 wrote to memory of 2996 1404 chrome.exe 86 PID 1404 wrote to memory of 2456 1404 chrome.exe 85 PID 1404 wrote to memory of 2456 1404 chrome.exe 85 PID 1404 wrote to memory of 2040 1404 chrome.exe 88 PID 1404 wrote to memory of 2040 1404 chrome.exe 88 PID 1404 wrote to memory of 5076 1404 chrome.exe 89 PID 1404 wrote to memory of 4592 1404 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://raw.githubusercontent.com/professor9-sys/oldlauncher928/refs/heads/main/woofer.rar1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaad4fc728,0x7ffaad4fc734,0x7ffaad4fc7402⤵PID:2656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1588,i,15121901777679814749,12955812078700144308,262144 --field-trial-handle=1988,i,14277520230547301076,8471733367471099304,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1980 /prefetch:22⤵PID:4728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1444,i,4873537038575882808,8734722192301288074,524288 --field-trial-handle=1988,i,14277520230547301076,8471733367471099304,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2112 /prefetch:112⤵
- System Time Discovery
PID:2392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,13863006903977185475,258165398120492682,524288 --field-trial-handle=1988,i,14277520230547301076,8471733367471099304,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2532 /prefetch:132⤵PID:3936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,11386916592384241745,17165409982683388472,2097152 --field-trial-handle=1988,i,14277520230547301076,8471733367471099304,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:2456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,3176967978839194245,3141131446253742119,2097152 --field-trial-handle=1988,i,14277520230547301076,8471733367471099304,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:2996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4192,i,15378993534324110661,7185106870661576444,2097152 --field-trial-handle=1988,i,14277520230547301076,8471733367471099304,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4196 /prefetch:92⤵PID:2040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,4749072898474720952,4194607090469853305,524288 --field-trial-handle=1988,i,14277520230547301076,8471733367471099304,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5344 /prefetch:142⤵PID:5076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,11778224287520786838,14809306576864812597,524288 --field-trial-handle=1988,i,14277520230547301076,8471733367471099304,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5592 /prefetch:142⤵
- NTFS ADS
PID:4592
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4880
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3656
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3296
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5292
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 c654b494bbcbb493e7fb54fbbc770fec619ae14d75ce4c4482bf6d318b9c8f87
- MD5 0d74ee6a464ef880b391f1d542618ed7
- SHA1 101c966eb3d1b5a27e76dd52adc9386d043d0216
- SHA512 c26c9e4cbb5324a3ce4adbe95c9b01ac306f12a10e19de17ee0e02152650785b6ad722ad95e942aa21d02dec902fbf1ba52102e1badfc6d35c0eecfc3da11ad3
- TLSH T114E02BAACC219C370CFD172964548747F74013572741985F3B3E420D4FB1277054185C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 a08027435f242806581caf9a0d8dcc58287ee926980ebf69cf24012c7969ec65
- MD5 6ed5470aaef349dd5eebf76593718e47
- SHA1 5a979d96633d5bf9ea3bf1bad8deaa14a5a5ec2f
- SHA512 d9409633a15293915389285ccd502a3335e2ed5416f52692f6858e6c3a4f6091c0f85a8c7d972c95b2ab15ac4f156917b0be3f3e4de0f61c44c53cc10a7b077d
- SSDEEP 192:GRzD8BUmHdbzRKv7spAPRp229AHsb+WNnwwPJbeM7PdarVyIsnAUge:GRzDkBdxGgUX92wXPhFate
- TLSH T16A42E72DB954793B9CD6C22AFE25B793E3F6203170842E84E6FC8A5C15E75CD212B41B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 5ab444414a02d4891c7cbb4db3735bec720facb3265bdedc915a68f6beef1cd9
- MD5 191a425abbe14997e55d6c34d96395de
- SHA1 567b4a799716eb9b3db36abe7163a0aaec1148fd
- SHA512 d0c7f690ea61add197a2dbd706250b5de93bf454a11e6e82e25faa2759a36b7158f1e02247d411bcd65234e3d4eb5605c539a97b277b15db18786f9fbc17ab4a
- SSDEEP 384:UujAr7KxkXqKf/pUZNCgVLH2Hfgsl+m7pLuLcifmnXODAH+ErU3xWHGWmvhxVtfC:UeAr7KxkXqKf/pUZNCgVLH2Hfgsgm7p/
- TLSH T15D720A677C4C9E770F94CACCD8167A4FADF6024B65E9889583FA982903C5ACF11061FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 40b3b935159a3c9e4241493f310dcdfe5c97edc5285f50dafd83a7c05b995f40
- MD5 0fce17a44a46b3e0a760c76ca98da121
- SHA1 0831fcdca5ab272ff0b2b7c4bc8e3bf362b909d1
- SHA512 78af0192565862cba634a72754ac79c1b095fdf208f94d2def23b65317eb5b598b38e451b73fadc8e8530841774bff2e87bf655ab200346b4d3ef37cddcf2533
- SSDEEP 1536:4LKP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNxZ:gQ++J3qUQm08KMWF0bFTcVHr6zgZ
- TLSH T1039312B9991E7D39636ED396A0079CAC8CD3DCCE2510617C30C76F0E14BA393A31B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 ac6e3ae5da58326b6f23b3c27c89f7b193884f596b377be903104afeec5f0c42
- MD5 3fbb94d3369ebaf8280da15c9689f262
- SHA1 cd88357ccf67d6b4a257bedde4c81f76370fc424
- SHA512 1079bc6d41c129e271ab9a3967719042c6b682840083cc0f363e4814ea0e719e1d8c2694c19c5f2b19a84ab2bd7c3f56d73808a5e9c26a522c21479a4bbde63d
- SSDEEP 1536:tLWP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNxZ:lM++J3qUQm08KMWF0bFTcVHr6zgZ
- TLSH T1D29302B9991E7C3963AFD3A690079CEC4CD39CCE2514657C30C75F1E14BA392A35B8A1
- MD5 SHA1 SHA512 SSDEEP TLSH