Analysis
-
max time kernel
124s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
28/11/2022, 06:20
General
-
Target
ad080d17e52e1aa88bba498f637ca2fccaa8885625bfb9b166b4a4ffd7d442f7.exe
-
Size
851KB
-
MD5
9401898d3cf74ef4ac5dd39c2a92bce4
-
SHA1
e9e9856adfba37d0c0dfbbd14dac0370b3cadccf
-
SHA256
ad080d17e52e1aa88bba498f637ca2fccaa8885625bfb9b166b4a4ffd7d442f7
-
SHA512
e3eb6b14c711256bd1b9b369b495ba7b715e7d088708fc02d05cc5b5d182ed859a83d34a42b83f951116d96d74f07b3e1303a64662298507ae5e46b63b880fab
-
SSDEEP
12288:kxYpBShWTFdrRtL3BGKhe961cFqH1C39doWE1oF:4YpVTFlLDs01L1CXol1o
Score
9/10
Malware Config
Signatures
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad080d17e52e1aa88bba498f637ca2fccaa8885625bfb9b166b4a4ffd7d442f7.exe"C:\Users\Admin\AppData\Local\Temp\ad080d17e52e1aa88bba498f637ca2fccaa8885625bfb9b166b4a4ffd7d442f7.exe"1⤵
- Enumerates VirtualBox registry keys
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
860KB
-
Filesize
492KB
-
Filesize
860KB
-
Filesize
860KB
-
Filesize
860KB
-
Filesize
860KB
-
Filesize
860KB
-
Filesize
860KB
-
Filesize
860KB
-
Filesize
860KB
-
Filesize
860KB
-
Filesize
860KB
-
Filesize
860KB