3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b

General

Target

3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe
Size

1.4MB
MD5

2c73472ca6af27172da352f0b98ae1df
SHA1

f483e1c4929faee0ec20063131c139dfb5a2cc9e
SHA256

3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b
SHA512

3502b2bb7b5b20c40aa713a55728072893236edd0edae0aea4ddb8c8be8778a4b5e73c5a086a4f1f452b39bbed587beebe1a700a6780c957094cc4ff910d2af5
SSDEEP

12288:fw8KMCe95rbz52+rhs5SQCVcW3D+YGj2T7M2H8a5fyoX9bQtWk3tBj184j3xNdNC:sMjDnw+r/h3n42TrHRfbW3t780jHu9

Score

9^/10

evasion

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation	3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1516	3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe
1516	3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1516	3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe
Token: SeSecurityPrivilege	1516	3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe
Token: SeTakeOwnershipPrivilege	1516	3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe
Token: SeLoadDriverPrivilege	1516	3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe
Token: SeSystemProfilePrivilege	1516	3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe
Token: SeSystemtimePrivilege	1516	3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe
Token: SeProfSingleProcessPrivilege	1516	3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe
Token: SeIncBasePriorityPrivilege	1516	3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe
Token: SeCreatePagefilePrivilege	1516	3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe
Token: SeBackupPrivilege	1516	3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe
Token: SeRestorePrivilege	1516	3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe
Token: SeShutdownPrivilege	1516	3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe
Token: SeDebugPrivilege	1516	3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe
Token: SeSystemEnvironmentPrivilege	1516	3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe
Token: SeChangeNotifyPrivilege	1516	3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe
Token: SeRemoteShutdownPrivilege	1516	3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe
Token: SeUndockPrivilege	1516	3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe
Token: SeManageVolumePrivilege	1516	3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe
Token: SeImpersonatePrivilege	1516	3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe
Token: SeCreateGlobalPrivilege	1516	3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe
Token: 33	1516	3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe
Token: 34	1516	3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe
Token: 35	1516	3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe

C:\Users\Admin\AppData\Local\Temp\3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe
"C:\Users\Admin\AppData\Local\Temp\3ad0b40277470b245a455fce2d56cbe370df8f0371df1d619afdb587ff21e61b.exe"
1⤵
- Enumerates VirtualBox registry keys
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

Software Discovery

System Information Discovery

1

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1516-54-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download
memory/1516-55-0x00000000002B0000-0x0000000000315000-memory.dmp

Filesize
404KB

Download
memory/1516-56-0x0000000000400000-0x0000000002D64000-memory.dmp

Filesize
41.4MB

Download
memory/1516-57-0x0000000000400000-0x0000000002D64000-memory.dmp

Filesize
41.4MB

Download
memory/1516-58-0x00000000002B0000-0x0000000000315000-memory.dmp

Filesize
404KB

Download
memory/1516-59-0x00000000002B0000-0x00000000002B5000-memory.dmp

Filesize
20KB

Download
memory/1516-60-0x0000000000400000-0x0000000002D64000-memory.dmp

Filesize
41.4MB

Download
memory/1516-62-0x00000000002B0000-0x00000000002B5000-memory.dmp

Filesize
20KB

Download
memory/1516-61-0x00000000002B0000-0x0000000000315000-memory.dmp

Filesize
404KB

Download
memory/1516-63-0x0000000000400000-0x0000000002D64000-memory.dmp

Filesize
41.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads