Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

vce exam simulator 2.2.1 crackk.exe.7z

7-zip archive data, version 0.4

initial sample

Details

Filetype:	7-zip archive data, version 0.4
Entropy:	7.999979303736415
Filename:	vce exam simulator 2.2.1 crackk.exe.7z
Filesize:	10346210
MD5:	378a971a95bb276c228672fdc2a1e595
SHA1:	661a1a821e6315956129d35937097e44c585cb02
SHA256:	69ac649458fa7302cf7dbfd117b8c8852396c000a40bbeb77623aa4dd6dd695a
SHA512:	3d7f7d7fd2515c54dd96fab4fd57703a70e8e331d7f6c3147e48ed9732e48956c2a7c2e82e2d6c3aa49b1dd3fcb647c89298e63bd7fc947b71ddacab76fc8126
SSDEEP:	196608:hbprLNm4W1iKnXsYpJd+GKStmMTF76e0Bep:FprdWUKXsdvS4gF2jcp
Preview:	7z..'.....rT.....................a..Zyl.s..!i.j.....b.:1.."6..bH...]\|.w.,...T.u"..Z\^....SOe%..]M$...NY.l.^7.si...~}h...>.....;....../.H{..;...Q......I.....K...0.....v.....AV.U6..b.C.'......S..L....{..n.......+.R..1..7.....(..u.*z)..}l_....Q.<....([T.....

Signature Hits	Behavior Group	Mitre Attack
Submission file is bigger than most known malware samples	System Summary	Extra Window Memory Injection

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 24 11:45:22 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Category:	dropped
Dump:	Docs.lnk.4.dr
ID:	dr_3
Target ID:	4
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 24 11:45:22 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Entropy:	3.988392388888244
Encrypted:	false
Size:	2677
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Category:	dropped
Dump:	Gmail.lnk.4.dr
ID:	dr_1
Target ID:	4
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 24 11:45:22 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Entropy:	4.00273660478115
Encrypted:	false
Size:	2679
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Category:	dropped
Dump:	Google Drive.lnk.4.dr
ID:	dr_4
Target ID:	4
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Entropy:	4.0147649001890855
Encrypted:	false
Size:	2693
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Category:	dropped
Dump:	Sheets.lnk.4.dr
ID:	dr_0
Target ID:	4
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 24 11:45:22 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Entropy:	4.00109266466456
Encrypted:	false
Size:	2681
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Category:	dropped
Dump:	Slides.lnk.4.dr
ID:	dr_2
Target ID:	4
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 24 11:45:22 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Entropy:	3.9912191262918144
Encrypted:	false
Size:	2681
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 24 11:45:21 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Category:	dropped
Dump:	YouTube.lnk.4.dr
ID:	dr_5
Target ID:	4
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 24 11:45:21 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Entropy:	3.9991840461133465
Encrypted:	false
Size:	2683
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\Downloads\Unconfirmed 381448.crdownload

PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive

dropped

Details

File:	C:\Users\user\Downloads\Unconfirmed 381448.crdownload
Category:	dropped
Dump:	Unconfirmed 381448.crdownload.4.dr
ID:	dr_6
Target ID:	4
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy:	7.991932536974381
Encrypted:	true
Size:	3306944
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior

Domains

Name

Malicious

www.win-rar.com

51.195.68.163

Details

Name:	www.win-rar.com
IP:	51.195.68.163
TargetID:	6
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

play.google.com

172.217.19.206

Details

Name:	play.google.com
IP:	172.217.19.206
TargetID:	6
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

dns-tunnel-check.googlezip.net

216.239.34.159

Details

Name:	dns-tunnel-check.googlezip.net
IP:	216.239.34.159
TargetID:	6
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

tunnel.googlezip.net

216.239.34.157

Details

Name:	tunnel.googlezip.net
IP:	216.239.34.157
TargetID:	6
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

www.google.com

142.250.181.68

Details

Name:	www.google.com
IP:	142.250.181.68
TargetID:	6
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

ytimg.l.google.com

172.217.17.78

img.youtube.com

unknown

IPs

Domain

Country

Malicious

172.217.19.206

play.google.com

United States

1.1.1.1

unknown

Australia

51.195.68.163

www.win-rar.com

France

172.217.17.78

ytimg.l.google.com

United States

172.217.17.35

unknown

United States

192.168.2.17

unknown

142.250.181.142

unknown

United States

216.58.208.227

unknown

United States

192.168.2.18

unknown

172.217.19.202

unknown

United States

142.250.181.106

unknown

United States

142.250.181.104

unknown

United States

239.255.255.250

unknown

Reserved

172.217.19.170

unknown

United States

142.250.181.68

www.google.com

United States

172.217.21.35

unknown

United States

64.233.161.84

unknown

United States

172.217.21.46

unknown

United States

142.250.181.34

unknown

United States

142.250.181.78

unknown

United States

216.239.34.157

tunnel.googlezip.net

United States

There are 11 hidden IPs, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
vce exam simulator 2.2.1 crackk.exe.7z

Files

Domains

IPs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportvce exam simulator 2.2.1 crackk.exe.7z

Files

Domains

IPs

IOC Report
vce exam simulator 2.2.1 crackk.exe.7z