8691a0d225712f70682533da5b8f2fcaade368aa132e913d851d1f08b0200465

Analysis

max time kernel
92s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 06:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8691a0d225712f70682533da5b8f2fcaade368aa132e913d851d1f08b0200465.exe
Size

458KB
MD5

a854b3f819d376c5484a43473b00ef21
SHA1

00b7e2dccdbf720ce18e412e8299113156c35280
SHA256

8691a0d225712f70682533da5b8f2fcaade368aa132e913d851d1f08b0200465
SHA512

87c92ea2ae7bf7b015c6dd6eb0f2919a2f9284e6dc4abb254063814b9c6eeab34b4440f8de00b59433e774ce3598c00009d4134252fedd06b9e3b2638d949323
SSDEEP

12288:06vbIvcoFguoPuOin3covR1W6z/gXOY5JZ:04acoFXolin3ZW6z/nYnZ

Score

9^/10

evasion persistence

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	8691a0d225712f70682533da5b8f2fcaade368aa132e913d851d1f08b0200465.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	8691a0d225712f70682533da5b8f2fcaade368aa132e913d851d1f08b0200465.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\sKU9mYW = "\"C:\\Users\\Admin\\AppData\\Roaming\\sKU9mYW.exe\" opt"	8691a0d225712f70682533da5b8f2fcaade368aa132e913d851d1f08b0200465.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1168	8691a0d225712f70682533da5b8f2fcaade368aa132e913d851d1f08b0200465.exe
1168	8691a0d225712f70682533da5b8f2fcaade368aa132e913d851d1f08b0200465.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1168	8691a0d225712f70682533da5b8f2fcaade368aa132e913d851d1f08b0200465.exe

C:\Users\Admin\AppData\Local\Temp\8691a0d225712f70682533da5b8f2fcaade368aa132e913d851d1f08b0200465.exe
"C:\Users\Admin\AppData\Local\Temp\8691a0d225712f70682533da5b8f2fcaade368aa132e913d851d1f08b0200465.exe"
1⤵
- Enumerates VirtualBox registry keys
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:1168

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1168-132-0x0000000000620000-0x0000000000627000-memory.dmp

Filesize
28KB

Download
memory/1168-134-0x0000000000620000-0x0000000000623000-memory.dmp

Filesize
12KB

Download
memory/1168-133-0x0000000000620000-0x0000000000627000-memory.dmp

Filesize
28KB

Download
memory/1168-135-0x00000000002C0000-0x000000000038F000-memory.dmp

Filesize
828KB

Download
memory/1168-136-0x00000000002C0000-0x000000000038F000-memory.dmp

Filesize
828KB

Download