Analysis
-
max time kernel
154s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 13:26
General
-
Target
a9d74439c6faac3914351b6c276fcaaaa472eb1dcfc41f3cd8d48bea1a0f6286.exe
-
Size
1.1MB
-
MD5
eb19f41ba69bf9062d964f90ae80adfe
-
SHA1
c7df9cf5a4403ce4242abfb381955909f428e528
-
SHA256
a9d74439c6faac3914351b6c276fcaaaa472eb1dcfc41f3cd8d48bea1a0f6286
-
SHA512
88cd05451e599e8db7d68aae4c21b5452d8e918a15e9c942fa6db6d6742ce943e8c9345ef6907cd22013b9735f9c4be1c17db02db5fb84aadb0b0964aaec288d
-
SSDEEP
24576:q+4IVahSl8iJj7QkU+d7zt9oeB4yXcoe0:qGE4l8iJj7Qkv7B9oV0
Score
9/10
Malware Config
Signatures
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9d74439c6faac3914351b6c276fcaaaa472eb1dcfc41f3cd8d48bea1a0f6286.exe"C:\Users\Admin\AppData\Local\Temp\a9d74439c6faac3914351b6c276fcaaaa472eb1dcfc41f3cd8d48bea1a0f6286.exe"1⤵
- Enumerates VirtualBox registry keys
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB