Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

file.exe

PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy:	7.987637848509426
Filename:	file.exe
Filesize:	4482048
MD5:	08f54694fcdf9433d8f3aa581903c4ca
SHA1:	08d738cc1c80c55c2835b23e24e8e211b4fb437c
SHA256:	3c87e8c4b46af6850934553b22a5bd2d0d1b648938fec52cd2f3b664b1dceb68
SHA512:	ff582e5e8a6e1f711a8b0f2a108acf49965cae3bcdbf68ecbfce0f90590673b961ad1325b5cdbfb4295db820a8093031279e841a9ebad67dea5585421a281ec5
SSDEEP:	98304:AHIAyqMizZRk5UCZcVd97K5mJeg/HcEG9XcEasYcrcoYvwopIusCPl0Y2Va:8N7k5UvXHPyVasYcovrxN0BVa
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...eIIg...............(.JO...x..2...........`O...@..................................{D...@... ............................

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection	Extra Window Memory Injection
Attempt to bypass Chrome Application-Bound Encryption	Remote Access Functionality	Extra Window Memory Injection Remote Access Software
Found malware configuration	AV Detection	Extra Window Memory Injection
Multi AV Scanner detection for submitted file	AV Detection
Drops large PE files	System Summary	Extra Window Memory Injection
Hides threads from debuggers	Anti Debugging	Extra Window Memory Injection
Machine Learning detection for sample	AV Detection
PE file contains section with special chars	System Summary
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)	Boot Survival	Extra Window Memory Injection
Tries to detect sandboxes / dynamic malware analysis system (registry check)	Malware Analysis System Evasion	Extra Window Memory Injection
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion
Tries to detect sandboxes and other dynamic analysis tools (window names)	Anti Debugging	Virtualization/Sandbox Evasion Security Software Discovery
Tries to detect virtualization through RDTSC time measurements	Malware Analysis System Evasion	Native API Extra Window Memory Injection
Tries to evade debugger and weak emulator (self modifying code)	Malware Analysis System Evasion	Extra Window Memory Injection
Tries to harvest and steal browser information (history, passwords, etc)	Stealing of Sensitive Information	Extra Window Memory Injection OS Credential Dumping Data from Local System
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival	Scheduled Task/Job
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings
Abnormal high CPU Usage	System Summary	Extra Window Memory Injection
Checks for debuggers (devices)	Anti Debugging
Checks if the current process is being debugged	Anti Debugging
Contains capabilities to detect virtual machines	Malware Analysis System Evasion
Drops PE files	Persistence and Installation Behavior	Extra Window Memory Injection
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion	Extra Window Memory Injection
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion
One or more processes crash	System Summary	Extra Window Memory Injection
PE file contains an invalid checksum	Data Obfuscation	Extra Window Memory Injection
PE file contains sections with non-standard names	Data Obfuscation	Extra Window Memory Injection
Queries information about the installed CPU (vendor, model number etc)	Language, Device and Operating System Detection	Native API
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	Native API
Uses 32bit PE files	Compliance, System Summary	Masquerading
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)	System Summary	Native API
Checks the free space of harddrives	Malware Analysis System Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates temporary files	System Summary
Enumerates the file system	Spreading, Malware Analysis System Evasion	Extra Window Memory Injection File and Directory Discovery
Public key (encryption) found	Cryptography
Queries a list of all running drivers	Malware Analysis System Evasion
Queries a list of all running processes	Malware Analysis System Evasion	Extra Window Memory Injection Process Discovery
Queries the cryptographic machine GUID	Language, Device and Operating System Detection
Reads software policies	System Summary
Reads the hosts file	System Summary	Remote System Discovery
Sample is known by Antivirus	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading Extra Window Memory Injection
URLs found in memory or binary data	Networking
PE file has a big raw section	System Summary	Extra Window Memory Injection
Submission file is bigger than most known malware samples	System Summary	Extra Window Memory Injection

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_8b6bc30ae81dc2afea68c3eabac594fb8e9329_ac3115bf_13acbd2a-08b8-421e-b81f-57c23bf42259\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_8b6bc30ae81dc2afea68c3eabac594fb8e9329_ac3115bf_13acbd2a-08b8-421e-b81f-57c23bf42259\Report.wer
Category:	dropped
Dump:	Report.wer.12.dr
ID:	dr_4
Target ID:	12
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	1.105297263195012
Encrypted:	false
Ssdeep:	192:ch2RSvcP50BU/7E3ju0ZrPMttMydzuiF2Z24IO8ThBZ:ycyBU/Aj/WzuiF2Y4IO8rZ
Size:	65536
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
PE file contains section with special chars	System Summary
PE file contains an invalid checksum	Data Obfuscation
PE file contains sections with non-standard names	Data Obfuscation
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)	System Summary	Software Packing
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
Sample is known by Antivirus	System Summary
PE file has a big raw section	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\ProgramData\Microsoft\Windows\WER\Temp\WER73F3.tmp.dmp

Mini DuMP crash report, 15 streams, Sat Nov 30 04:01:54 2024, 0x1205a4 type

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER73F3.tmp.dmp
Category:	dropped
Dump:	WER73F3.tmp.dmp.12.dr
ID:	dr_6
Target ID:	12
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Mini DuMP crash report, 15 streams, Sat Nov 30 04:01:54 2024, 0x1205a4 type
Entropy:	1.4944416097988364
Encrypted:	false
Ssdeep:	768:9ZgUX7mwjrEqetNiBpEyoOQjkIxCRk7Z9HzF9FGx1qYdiko0Ovb6wsp9STI1h0+e:AUXSwj8DiUpTR3Msia
Size:	271598
Whitelisted:	false
Reputation:	timeout

C:\ProgramData\Microsoft\Windows\WER\Temp\WER754B.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER754B.tmp.WERInternalMetadata.xml
Category:	dropped
Dump:	WER754B.tmp.WERInternalMetadata.xml.12.dr
ID:	dr_2
Target ID:	12
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.6947753869291704
Encrypted:	false
Ssdeep:	192:R6l7wVeJ0Cw60q6YEIISUvIgmfBhb7pr689bHhasfnlxm:R6lXJM6Z6YEnSUggmfnbFHh5flM
Size:	8340
Whitelisted:	false
Reputation:	timeout

C:\ProgramData\Microsoft\Windows\WER\Temp\WER756C.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER756C.tmp.xml
Category:	dropped
Dump:	WER756C.tmp.xml.12.dr
ID:	dr_3
Target ID:	12
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	4.438031055439276
Encrypted:	false
Ssdeep:	48:cvIwWl8zsZdJg77aI96tWpW8VYwYm8M4Jpt5FR6+q8WWHxqRhQd:uIjfpI7Yc7VcJp/6jgxqRhQd
Size:	4564
Whitelisted:	false
Reputation:	timeout

C:\Users\user\AppData\Local\Temp\HFInUAYNqgsnDSwNdDpz.dll

PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\HFInUAYNqgsnDSwNdDpz.dll
Category:	dropped
Dump:	HFInUAYNqgsnDSwNdDpz.dll.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\file.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy:	0.05434898985209837
Encrypted:	false
Ssdeep:	24576:1PqvNaBu/aiRGix1AK3LA1jmsW5wzn0WWnnp2fv+VjB3UlMVE:1IAWC4WWnQf2VjtUlMVE
Size:	315803136
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior

C:\Users\user\AppData\Local\Temp\service123.exe

PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\service123.exe
Category:	dropped
Dump:	service123.exe.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\file.exe
Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy:	0.0023405923668540145
Encrypted:	false
Size:	314617856
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection	System Information Discovery
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Detected potential crypto function	System Summary	Encrypted Channel Archive Collected Data
Drops PE files	Persistence and Installation Behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Found inlined nop instructions (likely shell or obfuscated code)	Software Vulnerabilities	Obfuscated Files or Information
Found large amount of non-executed APIs	Malware Analysis System Evasion
Found potential string decryption / allocating functions	System Summary	Obfuscated Files or Information Deobfuscate/Decode Files or Information
Sample execution stops while process was sleeping (likely an evasion)	Malware Analysis System Evasion
Uses Microsoft's Enhanced Cryptographic Provider	Cryptography	Encrypted Channel
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Contains functionality to register its own exception handler	Anti Debugging
Creates mutexes	System Summary
Creates temporary files	System Summary
Spawns processes	System Summary	Process Injection
Tries to load missing DLLs	System Summary	DLL Side-Loading

C:\Windows\appcompat\Programs\Amcache.hve

MS Windows registry file, NT/2000 or above

dropped

Details

File:	C:\Windows\appcompat\Programs\Amcache.hve
Category:	dropped
Dump:	Amcache.hve.12.dr
ID:	dr_5
Target ID:	12
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	MS Windows registry file, NT/2000 or above
Entropy:	4.421346630747871
Encrypted:	false
Size:	1835008
Whitelisted:	false
Reputation:	timeout

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\file.exe

"C:\Users\user\Desktop\file.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 --field-trial-handle=2360,i,13484378935357473721,8351465032550903243,262144 /prefetch:8

C:\Users\user\AppData\Local\Temp\service123.exe

"C:\Users\user\AppData\Local\Temp\service123.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f

C:\Users\user\AppData\Local\Temp\service123.exe

C:\Users\user\AppData\Local\Temp\/service123.exe

C:\Users\user\AppData\Local\Temp\service123.exe

C:\Users\user\AppData\Local\Temp\/service123.exe

C:\Users\user\AppData\Local\Temp\service123.exe

C:\Users\user\AppData\Local\Temp\/service123.exe

C:\Users\user\AppData\Local\Temp\service123.exe

C:\Users\user\AppData\Local\Temp\/service123.exe

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 1296

There are 1 hidden processes, click here to show them.

URLs

Name

Malicious

http://home.twentykx20pt.top/bugEWhhZIPIipxajeFfO1732855736?argument=WPLtZeXDD4KyKIMk1732939208

34.118.84.150

home.twentykx20pt.top

https://duckduckgo.com/chrome_newtab

unknown

https://gcc.gnu.org/bugs/):

unknown

https://mail.google.com/mail/?usp=installed_webapp

unknown

https://duckduckgo.com/ac/?q=

unknown

https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing

unknown

https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b

unknown

https://docs.google.com/document/J

unknown

https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone

unknown

http://anglebug.com/4633

unknown

https://anglebug.com/7382

unknown

https://issuetracker.google.com/284462263

unknown

https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly

unknown

http://polymer.github.io/AUTHORS.txt

unknown

https://docs.google.com/

unknown

https://docs.google.com/document/:

unknown

https://photos.google.com/settings?referrer=CHROME_NTP

unknown

https://anglebug.com/7714

unknown

http://unisolated.invalid/

unknown

https://www.google.com/chrome/tips/

unknown

https://drive.google.com/?lfhs=2

unknown

http://anglebug.com/6248

unknown

http://anglebug.com/6929

unknown

http://anglebug.com/5281

unknown

https://www.youtube.com/?feature=ytca

unknown

https://docs.googl0

unknown

https://issuetracker.google.com/255411748

unknown

https://docs.google.com/document/u/0/create?usp=chrome_actions

unknown

https://anglebug.com/7246

unknown

https://anglebug.com/7369

unknown

https://anglebug.com/7489

unknown

https://docs.google.com/presentation/

unknown

https://duckduckgo.com/?q=

unknown

https://chrome.google.com/webstore

unknown

https://drive-daily-2.corp.google.com/

unknown

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
file.exe

Files

Processes

URLs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportfile.exe

Files

Processes

URLs

IOC Report
file.exe