Cuckoo Sandbox

Category	Started On	Completed On	Duration	Cuckoo Version
FILE	2022-11-24 13:21:06.668012	2022-11-24 13:21:32.548357	25 seconds	2.0-dev

Machine	Label	Manager	Started On	Shutdown On
win7cuckoo	win7 Clone 1	VirtualBox	2022-11-24 13:21:07	2022-11-24 13:21:32

File Details

File name	85a14613cfb9fb8b13d9c7bcd2b8fb6aa73d0b96.exe
File size	939560 bytes
File type	PE32+ executable (GUI) x86-64, for MS Windows
CRC32	675927BA
MD5	2cbebe2799f12effb1c953b01ba9aefc
SHA1	85a14613cfb9fb8b13d9c7bcd2b8fb6aa73d0b96
SHA256	3f28b1bc371dee659e5637556948bde42de7a1398e5dc65373135714ae6d88b8
SHA512	acebf157b76ab4c5f54b70486dbe0e71eb37d292aac0bad40b5d2eed185d88913f1764b4e96bd1c442fa69ff01f1013d07c45fb438d55ec1117fae79329b73c6
Ssdeep	None
PEiD	None matched
Yara	contains_base64 (This rule finds for base64 strings) win_registry (Affect system registries) win_token (Affect system token) win_files_operation (Affect private profile) IsPE64 () IsWindowsGUI () IsPacked (Entropy Check) HasOverlay (Overlay Check) HasDebugData (DebugData Check)
VirusTotal	File not found on VirusTotal

MetaFlows Scores

Metaflows Analysis Results (Signatures=50, Anomalies=0, PEiD=0, Yara=0, VT[1669314100]=0): Snort Events=0, AV Events=0
Total Score=50

Signatures

has_pdb details

antivm_memory_available details

pe_features details

nolookup_communication details

packer_entropy details

Screenshots

No screenshots available.

Static Analysis

Version Infos

LegalCopyright:	Copyright 2022 Google LLC. All rights reserved.
InternalName:	mini_installer
CompanyShortName:	Google
FileVersion:	107.0.5304.108
CompanyName:	Google LLC
ProductShortName:	Chrome Installer
ProductName:	Google Chrome Installer
LastChange:	294f9da25eeda7ddca937d7c70b92d53a71745dc-refs/branch-heads/5304@{#1197}
ProductVersion:	107.0.5304.108
FileDescription:	Google Chrome Installer
Official Build:	1
Translation:	0x0409 0x04b0

Sections

Name	Virtual Address	Virtual Size	Size of Raw Data	Entropy
.text	0x00001000	0x00003125	0x00003200	6.0596542828
.rdata	0x00005000	0x0000136c	0x00001400	4.32759072939
.data	0x00007000	0x000000d0	0x00000200	0.798640562162
.pdata	0x00008000	0x00000264	0x00000400	2.67197774534
.00cfg	0x00009000	0x00000028	0x00000200	0.325533638474
.retplne	0x0000a000	0x0000005c	0x00000200	0.845848782355
.voltbl	0x0000b000	0x0000000c	0x00000200	0.22401940744
.rsrc	0x0000c000	0x000db10c	0x000db200	7.99923961528
.reloc	0x000e8000	0x00000048	0x00000200	0.809340626997

Resources

Name	Offset	Size	Language	Sub-language	File type
B7	0x000e5dbc	0x00000812	LANG_ENGLISH	SUBLANG_ENGLISH_US	7-zip archive data, version 0.3
B7	0x000e5dbc	0x00000812	LANG_ENGLISH	SUBLANG_ENGLISH_US	7-zip archive data, version 0.3
RT_ICON	0x000e65d0	0x000002e8	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_RCDATA	0x000e68b8	0x0000000f	LANG_ENGLISH	SUBLANG_ENGLISH_US	ASCII text, with no line terminators
RT_GROUP_ICON	0x000e68c8	0x00000014	LANG_ENGLISH	SUBLANG_ENGLISH_US	MS Windows icon resource - 1 icon
RT_VERSION	0x000e68dc	0x0000045c	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_MANIFEST	0x000e6d38	0x000003d2	LANG_ENGLISH	SUBLANG_ENGLISH_US	XML document text

Imports

Library SHELL32.dll:

• 0x140005bc8 - CommandLineToArgvW

Library KERNEL32.dll:

• 0x140005bd8 - CloseHandle

• 0x140005be0 - CreateDirectoryW

• 0x140005be8 - CreateFileW

• 0x140005bf0 - CreateProcessW

• 0x140005bf8 - DosDateTimeToFileTime

• 0x140005c00 - DuplicateHandle

• 0x140005c08 - EnumResourceNamesW

• 0x140005c10 - ExitProcess

• 0x140005c18 - ExpandEnvironmentStringsW

• 0x140005c20 - FindResourceW

• 0x140005c28 - FreeLibrary

• 0x140005c30 - GetCommandLineW

• 0x140005c38 - GetCurrentProcess

• 0x140005c40 - GetEnvironmentVariableW

• 0x140005c48 - GetExitCodeProcess

• 0x140005c50 - GetFileAttributesW

• 0x140005c58 - GetFileInformationByHandleEx

• 0x140005c60 - GetLastError

• 0x140005c68 - GetModuleFileNameW

• 0x140005c70 - GetModuleHandleW

• 0x140005c78 - GetProcAddress

• 0x140005c80 - GetProcessHeap

• 0x140005c88 - GetSystemInfo

• 0x140005c90 - GetVolumeInformationW

• 0x140005c98 - GetVolumePathNameW

• 0x140005ca0 - HeapAlloc

• 0x140005ca8 - HeapFree

• 0x140005cb0 - LoadLibraryExA

• 0x140005cb8 - LoadLibraryExW

• 0x140005cc0 - LoadResource

• 0x140005cc8 - LocalAlloc

• 0x140005cd0 - LocalFileTimeToFileTime

• 0x140005cd8 - LocalFree

• 0x140005ce0 - LockResource

• 0x140005ce8 - MultiByteToWideChar

• 0x140005cf0 - RaiseException

• 0x140005cf8 - ReadFile

• 0x140005d00 - SetFileInformationByHandle

• 0x140005d08 - SetFilePointer

• 0x140005d10 - SetLastError

• 0x140005d18 - SetProcessWorkingSetSize

• 0x140005d20 - SizeofResource

• 0x140005d28 - Sleep

• 0x140005d30 - VirtualProtect

• 0x140005d38 - VirtualQuery

• 0x140005d40 - WaitForSingleObject

• 0x140005d48 - WideCharToMultiByte

• 0x140005d50 - WriteFile

• 0x140005d58 - lstrcmpiW

• 0x140005d60 - lstrlenW

Strings

Dropped Files

Nothing to display.

Network Analysis

Hosts Involved

IP Address
23.54.60.151
70.186.27.9
8.8.8.8

DNS Requests

Domain	IP Address
armmf.adobe.com	23.1.100.158
dns.msftncsi.com	131.107.255.255
teredo.ipv6.microsoft.com	54.241.176.34
ipv6.msftncsi.com

HTTP Requests

URL	Data
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/3679CA35668772304D30A5FB873B0FA77BB70D54.crt?911320f9b04be75f	GET /msdownload/update/v3/static/trustedr/en/3679CA35668772304D30A5FB873B0FA77BB70D54.crt?911320f9b04be75f HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: ctldl.windowsupdate.com

Behavior Summary

File-Written

C:\Users\Harry Dresden\AppData\Local\Temp\CR_983DA.tmp\CHROME_PATCH.PACKED.7Z
C:\Users\Harry Dresden\AppData\Local\Temp\CR_983DA.tmp\SETUP_PATCH.PACKED.7Z

File-Opened

C:\Users\Harry Dresden\AppData\Local\Temp\CR_983DA.tmp\CHROME_PATCH.PACKED.7Z
C:\Users\Harry Dresden\AppData\Local\Temp\CR_983DA.tmp\
C:\
C:\Users\Harry Dresden\AppData\Local\Temp\CR_983DA.tmp\SETUP_PATCH.PACKED.7Z

Directory-Created

C:\Users\Harry Dresden\AppData\Local\Temp\CR_983DA.tmp

Registry Key-Opened

HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
HKEY_CURRENT_USER\Software\Google

Registry Key-Read

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\MaxRpcSize
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPSampledIn
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SYSTEM\Setup\OOBEInProgress
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName\ComputerName

Processes

registry filesystem process services network synchronization

C:\Windows\system32\lsass.exe PID: 480, Parent PID: 384

"C:\Users\Harry Dresden\AppData\Local\Temp\85a14613cfb9fb8b13d9c7bcd2b8fb6aa73d0b96.exe" PID: 4084, Parent PID: 2664

Volatility

Nothing to display.