Analysis

  • max time kernel
    202s
  • max time network
    208s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 14:29

General

  • Target

    41d920a2661fc7c05b5343679101c87a9dd550665d6a35d85ee93acd7fda4013.exe

  • Size

    594KB

  • MD5

    abbc30d27d267e43ca2f97096271bd63

  • SHA1

    e4755d82bb05d559fb32095836a70a64617c7a9e

  • SHA256

    41d920a2661fc7c05b5343679101c87a9dd550665d6a35d85ee93acd7fda4013

  • SHA512

    e9bc27635d49e20a948e122283c24dd8c04cb9251efa1bd663680d0326245503382fe0b98ea77c62e1f5fdcd06e33efa861927fe6a995e3e56e60b5887fbccce

  • SSDEEP

    12288:0gEFDkRRRRRRRVEpWeoCsstcIStWP/mQkpZkBR62X3tId:h2POs+I9/mQid

Score
9/10

Malware Config

Signatures

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\41d920a2661fc7c05b5343679101c87a9dd550665d6a35d85ee93acd7fda4013.exe
    "C:\Users\Admin\AppData\Local\Temp\41d920a2661fc7c05b5343679101c87a9dd550665d6a35d85ee93acd7fda4013.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1988

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1988-54-0x0000000000400000-0x00000000004D2000-memory.dmp

    Filesize

    840KB

  • memory/1988-55-0x0000000000400000-0x00000000004D2000-memory.dmp

    Filesize

    840KB

  • memory/1988-56-0x0000000000400000-0x00000000004D2000-memory.dmp

    Filesize

    840KB

  • memory/1988-57-0x0000000000400000-0x00000000004D2000-memory.dmp

    Filesize

    840KB

  • memory/1988-58-0x0000000000400000-0x00000000004D2000-memory.dmp

    Filesize

    840KB

  • memory/1988-59-0x0000000076651000-0x0000000076653000-memory.dmp

    Filesize

    8KB