Overview

overview

10

Static

static

VirtualBox...on.exe

windows7-x64

1

VirtualBox...on.exe

windows10-2004-x64

10

Resubmissions

23-01-2023 13:41

230123-qzjg9add79 10

27-12-2022 17:22

221227-vxl8ksfd97 10

27-12-2022 17:10

221227-vprhbsae8t 10

Analysis

  • max time kernel
    19s
  • max time network
    39s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    27-12-2022 17:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    VirtualBox 7.0-Download_Old_Builds - About - Documentation.exe

  • Size

    727.0MB

  • MD5

    8d10972d8f4c00b6811783823e2e3ec6

  • SHA1

    f6c86e26b6e55c71a02ee932bb0bae7200feaae1

  • SHA256

    ab378c4f2a52e1c4a5e199917e37a4d58a4f2c0d7585bb6f68f353d4018aba8c

  • SHA512

    27636191bd6c1da31cf0fee717c6fd612b2b5aa8b65e9ffa85566852abc6e12860b89baf3e50aeb6b2138a220d3bc737e6fa53b16983de3d04df5a9c239bfb97

  • SSDEEP

    12288:JgWkSNSTtX+5kOzIGgn/5HY5o8e3Fu3R+ZysWra9PtdBtSt6x4fOddti1ySgJly8:fkSy+510TnDPPvit6x4wi1ySgJlWVO

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VirtualBox 7.0-Download_Old_Builds - About - Documentation.exe
    "C:\Users\Admin\AppData\Local\Temp\VirtualBox 7.0-Download_Old_Builds - About - Documentation.exe"
    1⤵
      PID:1992
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:1836
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x234
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1212

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1836-54-0x000007FEFB531000-0x000007FEFB533000-memory.dmp

        Filesize

        8KB

        Download