8c0df7236a57d8eb100a24ab25bcdfb6520ef4e8a2f4f6298dfef2e68d44d5b3

Analysis

max time kernel
147s
max time network
139s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30/11/2022, 23:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c0df7236a57d8eb100a24ab25bcdfb6520ef4e8a2f4f6298dfef2e68d44d5b3.exe
Size

678KB
MD5

a4c8149e443aeab93067ab99c97c8f8f
SHA1

616e70ceb6f593a40d2be082459c14e2f677df83
SHA256

8c0df7236a57d8eb100a24ab25bcdfb6520ef4e8a2f4f6298dfef2e68d44d5b3
SHA512

81d9d8328eebd16e27f7446564012a46f3f25e0a810379fbf8e2b81b6c5599a1e3766d155b55502adafae1980f2fca81f136056c64252806585a8b6ed7aeb15b
SSDEEP

12288:qzj/iWCKH0fkStuhp8f3DoVs7fBi2dnnm++J8Vhmp0+VGhcRNfy+Tp:ujqWxF4Cp8/rBi2hv88O/l5Tp

Score

9^/10

evasion persistence

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	8c0df7236a57d8eb100a24ab25bcdfb6520ef4e8a2f4f6298dfef2e68d44d5b3.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	8c0df7236a57d8eb100a24ab25bcdfb6520ef4e8a2f4f6298dfef2e68d44d5b3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\q7931m9 = "\"C:\\Users\\Admin\\AppData\\Roaming\\q7931m9.exe\" opt"	8c0df7236a57d8eb100a24ab25bcdfb6520ef4e8a2f4f6298dfef2e68d44d5b3.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1752	8c0df7236a57d8eb100a24ab25bcdfb6520ef4e8a2f4f6298dfef2e68d44d5b3.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1752	8c0df7236a57d8eb100a24ab25bcdfb6520ef4e8a2f4f6298dfef2e68d44d5b3.exe

C:\Users\Admin\AppData\Local\Temp\8c0df7236a57d8eb100a24ab25bcdfb6520ef4e8a2f4f6298dfef2e68d44d5b3.exe
"C:\Users\Admin\AppData\Local\Temp\8c0df7236a57d8eb100a24ab25bcdfb6520ef4e8a2f4f6298dfef2e68d44d5b3.exe"
1⤵
- Enumerates VirtualBox registry keys
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:1752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1752-54-0x0000000000020000-0x000000000002D000-memory.dmp

Filesize
52KB

Download
memory/1752-55-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download
memory/1752-56-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/1752-58-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/1752-57-0x0000000000020000-0x000000000002D000-memory.dmp

Filesize
52KB

Download
memory/1752-59-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download