8ad32fa794edea97fcd1a27dc8f3335c19284dbbcd982ddf8c2051bc4bad0b07

Analysis

max time kernel
135s
max time network
183s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ad32fa794edea97fcd1a27dc8f3335c19284dbbcd982ddf8c2051bc4bad0b07.exe
Size

829KB
MD5

01df07e97f6c63e568e1a66ade389640
SHA1

08ca1396b18704ab19819477a23658423f7d5d96
SHA256

8ad32fa794edea97fcd1a27dc8f3335c19284dbbcd982ddf8c2051bc4bad0b07
SHA512

f6fed611aa49f90aecbc1db8df73cf5778bd67d806b5ac362eafe2c0cb5f4a1468355f7a0552dc3b42d5749ebf91dad1e114492085e22a72ffad954b38379111
SSDEEP

12288:S443XWTM3IGx6LIN1WMZrorgOMq3uCz5fGojdOJl1IOp3ima1EwLj5nAZ04A:gXuMb1orgZMdOJl1rAv1M4

Score

9^/10

evasion

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	8ad32fa794edea97fcd1a27dc8f3335c19284dbbcd982ddf8c2051bc4bad0b07.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1760	8ad32fa794edea97fcd1a27dc8f3335c19284dbbcd982ddf8c2051bc4bad0b07.exe

C:\Users\Admin\AppData\Local\Temp\8ad32fa794edea97fcd1a27dc8f3335c19284dbbcd982ddf8c2051bc4bad0b07.exe
"C:\Users\Admin\AppData\Local\Temp\8ad32fa794edea97fcd1a27dc8f3335c19284dbbcd982ddf8c2051bc4bad0b07.exe"
1⤵
- Enumerates VirtualBox registry keys
- Suspicious behavior: EnumeratesProcesses
PID:1760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1760-54-0x0000000000240000-0x0000000000253000-memory.dmp

Filesize
76KB

Download
memory/1760-55-0x0000000000240000-0x0000000000253000-memory.dmp

Filesize
76KB

Download
memory/1760-56-0x0000000000240000-0x0000000000243000-memory.dmp

Filesize
12KB

Download
memory/1760-57-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/1760-58-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/1760-59-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download