Analysis
-
max time kernel
153s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
11/10/2022, 07:11
General
-
Target
95aa6b314198428580f943740fa11c5b860b7567f0c2f08d2d3e690a995a7219.exe
-
Size
623KB
-
MD5
6f293276b9906b422e25cf024739d3f0
-
SHA1
5b8e3915ce7660eb619120a59ea11ae34643117c
-
SHA256
95aa6b314198428580f943740fa11c5b860b7567f0c2f08d2d3e690a995a7219
-
SHA512
169e754fab58f4ee382dba149d7f73534f315f217b809770f54d14e259bbaa5510bd74bb663bbdf79ae9913b2b01b5dbc0a11fbf21ff2f231b97137726e2c474
-
SSDEEP
12288:GY0Sv/v6GZfilQoDq99rltN3tPckKADsdtp59WbhI8T1RlvKF:G0/v6GZfi2o299JT3tPuADsd7GI8jlvc
Score
9/10
Malware Config
Signatures
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\95aa6b314198428580f943740fa11c5b860b7567f0c2f08d2d3e690a995a7219.exe"C:\Users\Admin\AppData\Local\Temp\95aa6b314198428580f943740fa11c5b860b7567f0c2f08d2d3e690a995a7219.exe"1⤵
- Enumerates VirtualBox registry keys
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
-
Filesize
860KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
860KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
860KB