Analysis
-
max time kernel
167s -
max time network
183s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
27-11-2022 01:17
General
-
Target
96288a7239e1b2d755a6a1023cb6f97d959d8d3078d321898e7e2d9e1062f8d9.exe
-
Size
769KB
-
MD5
bc6ac384e14dcba7c9ab1cb79e55af2b
-
SHA1
5d435f0825112ae161bd7f05cba77c83c69f80ab
-
SHA256
96288a7239e1b2d755a6a1023cb6f97d959d8d3078d321898e7e2d9e1062f8d9
-
SHA512
808c62ab2a18f4ddf675c34a6beea6c57ce2a3e9237785664f712e819de02e0ca9c58d2830dfb825ac0eef9b371992864ed3dde74cece770e3d4d907e29e0f96
-
SSDEEP
6144:n4wum29joq1lZMQpdNhqom6E9+T+yfKdwkFuJqwkJsTyvkjOBQGt53qCmwOLOJPu:uV1o2Bq9+T+Jd9u7z4x5a1LI/5mCVc
Score
9/10
Malware Config
Signatures
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\96288a7239e1b2d755a6a1023cb6f97d959d8d3078d321898e7e2d9e1062f8d9.exe"C:\Users\Admin\AppData\Local\Temp\96288a7239e1b2d755a6a1023cb6f97d959d8d3078d321898e7e2d9e1062f8d9.exe"1⤵
- Enumerates VirtualBox registry keys
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
540KB
-
Filesize
8KB
-
Filesize
792KB