Analysis
-
max time kernel
146s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
29/10/2022, 10:16
General
-
Target
1eb486bd7970a4d3a074e029cbe3f206e474da99288d7bc131e87b059e76e051.exe
-
Size
1.1MB
-
MD5
a57d56eb954892cc3d0b6fa9ff861872
-
SHA1
7f7813072d9807128cc563d22eee1863b82fa170
-
SHA256
1eb486bd7970a4d3a074e029cbe3f206e474da99288d7bc131e87b059e76e051
-
SHA512
8a58bda23c0993a485091504eea1c8b8f95324e1cbb7db9ff384fa21a004bd11038a2f4f52c84e4772bea6d443e3786a389db5daba0ab0313d54eeec1dc37b04
-
SSDEEP
24576:EqM/183ffiGJxCvrJGz5gE4qJUJ279tclhFYUpx6yP2LAMg4iaDKKDB:EqMW3XdsYz2RqYlIm8y+rPDh
Score
9/10
Malware Config
Signatures
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1eb486bd7970a4d3a074e029cbe3f206e474da99288d7bc131e87b059e76e051.exe"C:\Users\Admin\AppData\Local\Temp\1eb486bd7970a4d3a074e029cbe3f206e474da99288d7bc131e87b059e76e051.exe"1⤵
- Enumerates VirtualBox registry keys
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
-
Filesize
1.4MB
-
Filesize
1.6MB
-
Filesize
1.6MB