Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

file.exe

PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy:	7.987453527446022
Filename:	file.exe
Filesize:	4479488
MD5:	245042b39f7fe432daf72c046d5000d3
SHA1:	f3ae48a9bd52536b83b76ed988558e5681009e96
SHA256:	1c4b207bb8d58a6068ed2be0eb27653a7245dfe8fee548c4720d14510453c27c
SHA512:	fedb81cb96239c8e2456872914155d54d2cb9c5c98b2a59554113de6b8987df01d2e4dd7bdadc26c8749020cf59d74fd4d2229806882bcf62b5b4083bc98622c
SSDEEP:	98304:kTa0XUeEUwjOh4/MorxpB01cG3uZcO48mCQueAD0r7s:WICh4/MorxH014cBulAr7
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P.Gg...............(..H...v..2........... H...@..........................@........D...@... ............................

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection	Extra Window Memory Injection
Attempt to bypass Chrome Application-Bound Encryption	Remote Access Functionality	Extra Window Memory Injection Remote Access Software
Multi AV Scanner detection for submitted file	AV Detection
Drops large PE files	System Summary	Extra Window Memory Injection
Hides threads from debuggers	Anti Debugging	Extra Window Memory Injection
Machine Learning detection for sample	AV Detection
PE file contains section with special chars	System Summary	Clipboard Data
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)	Boot Survival	Extra Window Memory Injection
Tries to detect sandboxes / dynamic malware analysis system (registry check)	Malware Analysis System Evasion	Extra Window Memory Injection Security Software Discovery
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Tries to detect sandboxes and other dynamic analysis tools (window names)	Anti Debugging
Tries to detect virtualization through RDTSC time measurements	Malware Analysis System Evasion	Native API Extra Window Memory Injection Security Software Discovery
Tries to evade debugger and weak emulator (self modifying code)	Malware Analysis System Evasion	Extra Window Memory Injection
Tries to harvest and steal browser information (history, passwords, etc)	Stealing of Sensitive Information	Extra Window Memory Injection OS Credential Dumping Security Software Discovery Data from Local System
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival	Scheduled Task/Job
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Abnormal high CPU Usage	System Summary	Extra Window Memory Injection
Checks for debuggers (devices)	Anti Debugging	Security Software Discovery
Checks if the current process is being debugged	Anti Debugging
Contains capabilities to detect virtual machines	Malware Analysis System Evasion
Drops PE files	Persistence and Installation Behavior	Extra Window Memory Injection
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion	Extra Window Memory Injection
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion	Virtualization/Sandbox Evasion Security Software Discovery
One or more processes crash	System Summary	Extra Window Memory Injection
PE file contains an invalid checksum	Data Obfuscation	Extra Window Memory Injection Security Software Discovery
PE file contains sections with non-standard names	Data Obfuscation	Extra Window Memory Injection
Queries information about the installed CPU (vendor, model number etc)	Language, Device and Operating System Detection	Native API Security Software Discovery
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	Native API Security Software Discovery
Uses 32bit PE files	Compliance, System Summary	Masquerading
Binary may include packed or encrypted code	Data Obfuscation
PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)	System Summary	Native API Software Packing Security Software Discovery
PE file has a high occurrence of arithmetic instructions at the PE entrypoint (possbibily packed)	System Summary
Checks the free space of harddrives	Malware Analysis System Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates temporary files	System Summary	Security Software Discovery
Enumerates the file system	Spreading, Malware Analysis System Evasion	Extra Window Memory Injection File and Directory Discovery
Public key (encryption) found	Cryptography	Archive Collected Data
Queries a list of all running drivers	Malware Analysis System Evasion	System Information Discovery
Queries a list of all running processes	Malware Analysis System Evasion	Extra Window Memory Injection Process Discovery
Queries the cryptographic machine GUID	Language, Device and Operating System Detection
Reads software policies	System Summary
Reads the hosts file	System Summary	Security Software Discovery Remote System Discovery
Sample is known by Antivirus	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading Extra Window Memory Injection
URLs found in memory or binary data	Networking	Security Software Discovery
PE file has a big raw section	System Summary	Extra Window Memory Injection
Submission file is bigger than most known malware samples	System Summary	Extra Window Memory Injection

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_5c68b29bb6b465bad180a68d35c62438a01da7_fff46f69_ec5e8cc4-da29-4dcd-9f55-dbe6e1ad8662\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_5c68b29bb6b465bad180a68d35c62438a01da7_fff46f69_ec5e8cc4-da29-4dcd-9f55-dbe6e1ad8662\Report.wer
Category:	dropped
Dump:	Report.wer.13.dr
ID:	dr_4
Target ID:	13
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	1.104948836880501
Encrypted:	false
Ssdeep:	192:/L+S1UBvzPG0BU/fI3ju0ZrPMttMKdzuiF2Z24IO8TVB:kzlBU/Yj/+zuiF2Y4IO8X
Size:	65536
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
PE file contains section with special chars	System Summary
PE file contains an invalid checksum	Data Obfuscation
PE file contains sections with non-standard names	Data Obfuscation
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)	System Summary	Software Packing
PE file has a high occurrence of arithmetic instructions at the PE entrypoint (possbibily packed)	System Summary	Obfuscated Files or Information
Sample is known by Antivirus	System Summary
PE file has a big raw section	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Local\Temp\service123.exe

PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\service123.exe
Category:	dropped
Dump:	service123.exe.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\file.exe
Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy:	0.002340578315718116
Encrypted:	false
Size:	314617856
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Found evasive API chain (may stop execution after checking mutex)	Malware Analysis System Evasion	Native API
Found stalling execution ending in API Sleep call	Malware Analysis System Evasion
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection	System Information Discovery
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Detected potential crypto function	System Summary	Encrypted Channel Archive Collected Data
Drops PE files	Persistence and Installation Behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Found inlined nop instructions (likely shell or obfuscated code)	Software Vulnerabilities	Obfuscated Files or Information
Found large amount of non-executed APIs	Malware Analysis System Evasion
Found potential string decryption / allocating functions	System Summary	Obfuscated Files or Information Deobfuscate/Decode Files or Information
Sample execution stops while process was sleeping (likely an evasion)	Malware Analysis System Evasion
Uses Microsoft's Enhanced Cryptographic Provider	Cryptography	Encrypted Channel
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Contains functionality to register its own exception handler	Anti Debugging
Creates mutexes	System Summary
Creates temporary files	System Summary
Spawns processes	System Summary	Process Injection
Tries to load missing DLLs	System Summary	DLL Side-Loading

C:\ProgramData\Microsoft\Windows\WER\Temp\WER20B3.tmp.dmp

Mini DuMP crash report, 15 streams, Sat Nov 30 04:01:55 2024, 0x1205a4 type

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER20B3.tmp.dmp
Category:	dropped
Dump:	WER20B3.tmp.dmp.13.dr
ID:	dr_6
Target ID:	13
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Mini DuMP crash report, 15 streams, Sat Nov 30 04:01:55 2024, 0x1205a4 type
Entropy:	1.4887443239215186
Encrypted:	false
Ssdeep:	768:klR2sHEqC1Te0oQAHzVZIuCN8OQ2F6rnza9:6RHo1ToQGY7Nrgrnza9
Size:	267872
Whitelisted:	false
Reputation:	timeout

C:\ProgramData\Microsoft\Windows\WER\Temp\WER222B.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER222B.tmp.WERInternalMetadata.xml
Category:	dropped
Dump:	WER222B.tmp.WERInternalMetadata.xml.13.dr
ID:	dr_2
Target ID:	13
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.6923391325205865
Encrypted:	false
Ssdeep:	192:R6l7wVeJ3C96rA6Y90SUTgmfB8bvprp89bHYZsfplum:R6lXJo6c6YOSUTgmfWbUHYyf73
Size:	8340
Whitelisted:	false
Reputation:	timeout

C:\ProgramData\Microsoft\Windows\WER\Temp\WER22B9.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER22B9.tmp.xml
Category:	dropped
Dump:	WER22B9.tmp.xml.13.dr
ID:	dr_3
Target ID:	13
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	4.435493221007022
Encrypted:	false
Ssdeep:	48:cvIwWl8zsZdJg77aI9oLWpW8VY4Ym8M4JI5FU+q8WqTEpzWd:uIjfpI7G67VwJL8EJWd
Size:	4564
Whitelisted:	false
Reputation:	timeout

C:\Users\user\AppData\Local\Temp\rnCMinwLHbrEjcomyVjl.dll

PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\rnCMinwLHbrEjcomyVjl.dll
Category:	dropped
Dump:	rnCMinwLHbrEjcomyVjl.dll.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\file.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy:	0.05435488843184411
Encrypted:	false
Ssdeep:	24576:6USlFSB+/tOZuqxtgCff+Kz2MGR6XHIWGnnxOfOeV1nY8lCVE:6+LG04WGngfdVJY8lCVE
Size:	315803136
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior

C:\Windows\appcompat\Programs\Amcache.hve

MS Windows registry file, NT/2000 or above

dropped

Details

File:	C:\Windows\appcompat\Programs\Amcache.hve
Category:	dropped
Dump:	Amcache.hve.13.dr
ID:	dr_5
Target ID:	13
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	MS Windows registry file, NT/2000 or above
Entropy:	4.465301356723021
Encrypted:	false
Size:	1835008
Whitelisted:	false
Reputation:	timeout

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\file.exe

"C:\Users\user\Desktop\file.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2340,i,1016166225095006826,12192068235695981454,262144 /prefetch:8

C:\Users\user\AppData\Local\Temp\service123.exe

"C:\Users\user\AppData\Local\Temp\service123.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f

C:\Users\user\AppData\Local\Temp\service123.exe

C:\Users\user\AppData\Local\Temp\/service123.exe

C:\Users\user\AppData\Local\Temp\service123.exe

C:\Users\user\AppData\Local\Temp\/service123.exe

C:\Users\user\AppData\Local\Temp\service123.exe

C:\Users\user\AppData\Local\Temp\/service123.exe

C:\Users\user\AppData\Local\Temp\service123.exe

C:\Users\user\AppData\Local\Temp\/service123.exe

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 1844

There are 1 hidden processes, click here to show them.

URLs

Name

Malicious

https://duckduckgo.com/chrome_newtab

unknown

https://gcc.gnu.org/bugs/):

unknown

https://mail.google.com/mail/?usp=installed_webapp

unknown

https://duckduckgo.com/ac/?q=

unknown

https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing

unknown

https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b

unknown

https://docs.google.com/document/J

unknown

https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone

unknown

http://anglebug.com/4633

unknown

https://anglebug.com/7382

unknown

http://home.fvtekx5pt.top/RrlNvinfLqYZQoxgChZr17

unknown

https://issuetracker.google.com/284462263

unknown

https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly

unknown

https://crbug.com/368855.)

unknown

https://docs.google.com/

unknown

https://docs.google.com/document/:

unknown

https://photos.google.com/settings?referrer=CHROME_NTP

unknown

https://anglebug.com/7714

unknown

https://www.google.com/speech-api/v2/synthesize?

unknown

http://unisolated.invalid/

unknown

https://www.google.com/chrome/tips/

unknown

https://drive.google.com/?lfhs=2

unknown

http://anglebug.com/35862

unknown

http://anglebug.com/6248

unknown

http://anglebug.com/6929

unknown

http://anglebug.com/5281

unknown

https://www.youtube.com/?feature=ytca

unknown

http://home.fvtekx5pt.top/RrlNvinfLqYZQoxgChZr1732768478

141.8.197.146

https://issuetracker.google.com/255411748

unknown

https://docs.google.com/document/u/0/create?usp=chrome_actions

unknown

https://anglebug.com/7246

unknown

https://anglebug.com/7369

unknown

https://anglebug.com/7489

unknown

https://duckduckgo.com/?q=

unknown

https://chrome.google.com/webstore

unknown

https://drive-daily-2.corp.google.com/

unknown

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
file.exe

Files

Processes

URLs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportfile.exe

Files

Processes

URLs

IOC Report
file.exe