683878aceb76f06987f2ef80ba7f6ebd4dfe9fdc53b151c4c0f7d97d0af72924

Analysis

max time kernel
134s
max time network
168s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 18:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

683878aceb76f06987f2ef80ba7f6ebd4dfe9fdc53b151c4c0f7d97d0af72924.exe
Size

743KB
MD5

deee50043202753b82cad51bb7588076
SHA1

f17939f9aedcadadf870b60ffe537fbb12e3dc9e
SHA256

683878aceb76f06987f2ef80ba7f6ebd4dfe9fdc53b151c4c0f7d97d0af72924
SHA512

c0994f5d7f3d6d61f26c7f7101d16ada490bc0e9b832495839f644f3f211db4fcf6d685c4dd52b65cd09f85c89a78c9c8de72f63a36de5b8b5b458caa35a7a33
SSDEEP

12288:ICMaZ3Y8XiQFtgBOZm3XuXNDOXKs2+Y9Jf9ywTmEVXCa6Jl6AzqNE+wNE:zM3IjFtgomH0kH2+Y9V0ObCa63VONE+w

Score

9^/10

discovery evasion

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	683878aceb76f06987f2ef80ba7f6ebd4dfe9fdc53b151c4c0f7d97d0af72924.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1240	683878aceb76f06987f2ef80ba7f6ebd4dfe9fdc53b151c4c0f7d97d0af72924.exe
1240	683878aceb76f06987f2ef80ba7f6ebd4dfe9fdc53b151c4c0f7d97d0af72924.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1240	683878aceb76f06987f2ef80ba7f6ebd4dfe9fdc53b151c4c0f7d97d0af72924.exe
Token: SeCreateGlobalPrivilege	1240	683878aceb76f06987f2ef80ba7f6ebd4dfe9fdc53b151c4c0f7d97d0af72924.exe

C:\Users\Admin\AppData\Local\Temp\683878aceb76f06987f2ef80ba7f6ebd4dfe9fdc53b151c4c0f7d97d0af72924.exe
"C:\Users\Admin\AppData\Local\Temp\683878aceb76f06987f2ef80ba7f6ebd4dfe9fdc53b151c4c0f7d97d0af72924.exe"
1⤵
- Enumerates VirtualBox registry keys
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1240-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1240-55-0x00000000001B0000-0x00000000001C5000-memory.dmp

Filesize
84KB

Download
memory/1240-56-0x0000000000400000-0x0000000000543000-memory.dmp

Filesize
1.3MB

Download