Analysis
-
max time kernel
201s -
max time network
209s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
28/11/2022, 05:06
General
-
Target
32b670c390a5d2ccd57615b448052c4425cbba77e894205ec8cd3547debd9a62.exe
-
Size
1.7MB
-
MD5
f0bbab3157f4449ca351557d5831296b
-
SHA1
9df273af889fe341ace0c141c4b2eae790d04759
-
SHA256
32b670c390a5d2ccd57615b448052c4425cbba77e894205ec8cd3547debd9a62
-
SHA512
57e8378d216431dad61b3b4ef390b3ed502297b27d853757c6158cb9caf73ddd528fe4e7023e1dd666ec49a759e4c46ee39594847c0ae2b87406f4016b648732
-
SSDEEP
24576:CMlR7xnnalkQk8ql5rvwbxmhRHWNY4mLxgPOh:CM/n+qzrKERHWNhm1z
Score
9/10
Malware Config
Signatures
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\32b670c390a5d2ccd57615b448052c4425cbba77e894205ec8cd3547debd9a62.exe"C:\Users\Admin\AppData\Local\Temp\32b670c390a5d2ccd57615b448052c4425cbba77e894205ec8cd3547debd9a62.exe"1⤵
- Enumerates VirtualBox registry keys
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
916KB
-
Filesize
916KB
-
Filesize
20KB
-
Filesize
1.7MB
-
Filesize
916KB
-
Filesize
20KB
-
Filesize
1.7MB
-
Filesize
1.7MB