367ebe48f28acbbee4954dff9408a128035efa074940eb6551b25e63fd52b77e

Analysis

max time kernel
146s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

367ebe48f28acbbee4954dff9408a128035efa074940eb6551b25e63fd52b77e.exe
Size

569KB
MD5

96ac8ec604c3d23a232b73f01be73670
SHA1

e069d618a4184f84cb355f89a933754908516e47
SHA256

367ebe48f28acbbee4954dff9408a128035efa074940eb6551b25e63fd52b77e
SHA512

31a1ba3bd7cbfba1f39ddc1379edb343829a90a2d0e3c27a3a9489abde3c71890d6c9df2042de8e23562106c7f82f8e07f2512a2f632ad0f9997a24f094a15f8
SSDEEP

12288:PQ7QjvUja6+EZ4I2HUkMOMLGazZE4lqm/xXwIxkex:PKQ0a6+FtHUkMVtu4omdxX

Score

9^/10

evasion persistence

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	367ebe48f28acbbee4954dff9408a128035efa074940eb6551b25e63fd52b77e.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	367ebe48f28acbbee4954dff9408a128035efa074940eb6551b25e63fd52b77e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\eI931q9 = "\"C:\\Users\\Admin\\AppData\\Roaming\\eI931q9.exe\" opt"	367ebe48f28acbbee4954dff9408a128035efa074940eb6551b25e63fd52b77e.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4712	367ebe48f28acbbee4954dff9408a128035efa074940eb6551b25e63fd52b77e.exe
4712	367ebe48f28acbbee4954dff9408a128035efa074940eb6551b25e63fd52b77e.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4712	367ebe48f28acbbee4954dff9408a128035efa074940eb6551b25e63fd52b77e.exe

C:\Users\Admin\AppData\Local\Temp\367ebe48f28acbbee4954dff9408a128035efa074940eb6551b25e63fd52b77e.exe
"C:\Users\Admin\AppData\Local\Temp\367ebe48f28acbbee4954dff9408a128035efa074940eb6551b25e63fd52b77e.exe"
1⤵
- Enumerates VirtualBox registry keys
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:4712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4712-132-0x0000000000C40000-0x0000000000C47000-memory.dmp

Filesize
28KB

Download
memory/4712-133-0x0000000000C40000-0x0000000000C43000-memory.dmp

Filesize
12KB

Download
memory/4712-134-0x0000000000520000-0x00000000005F0000-memory.dmp

Filesize
832KB

Download
memory/4712-135-0x0000000000C40000-0x0000000000C47000-memory.dmp

Filesize
28KB

Download
memory/4712-136-0x0000000000C40000-0x0000000000C43000-memory.dmp

Filesize
12KB

Download
memory/4712-137-0x0000000000520000-0x00000000005F0000-memory.dmp

Filesize
832KB

Download