Analysis
-
max time kernel
298s -
max time network
312s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
26-11-2022 22:48
General
-
Target
e445a981e5e59ae51feafd3e0f2d5a3fcea319d632d3b23a4bf9303957727794.exe
-
Size
1.4MB
-
MD5
7e00a7134e0446bd2ff0998e60094fa6
-
SHA1
bd3116964c0bde14192cd1028a6dbc818c53625a
-
SHA256
e445a981e5e59ae51feafd3e0f2d5a3fcea319d632d3b23a4bf9303957727794
-
SHA512
e53067b85df365808efc60d319584b39b0dd2ce1b8ee0c0073617b6bc6c00556e1019e9d11428a9736e1b38ce26cfe83d8e78ab3ebe8e236e4dacc3072bad661
-
SSDEEP
24576:8KuIVsXqarDGV/Dn67Tair2gwnEc9wqA3/Chc:/dRDOzjvqhc
Score
9/10
Malware Config
Signatures
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e445a981e5e59ae51feafd3e0f2d5a3fcea319d632d3b23a4bf9303957727794.exe"C:\Users\Admin\AppData\Local\Temp\e445a981e5e59ae51feafd3e0f2d5a3fcea319d632d3b23a4bf9303957727794.exe"1⤵
- Enumerates VirtualBox registry keys
- Checks computer location settings
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
20KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
524KB