42c053cd225026c1a26fb071b79d2de9137b25099aa843277ef1158c062b0d18

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 11:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5654bbc59e7d5615d04494bb9a93347b.exe
Size

814KB
MD5

5654bbc59e7d5615d04494bb9a93347b
SHA1

7db5c996b9b77c6650822a3e1f6806450787c1d3
SHA256

42c053cd225026c1a26fb071b79d2de9137b25099aa843277ef1158c062b0d18
SHA512

2e2ad40514c5687f15650e3f20bacde54fff1e7b25513b52a7d26fd06033e79495e24ca01ffba925db3282aede4e59a6c76eba0b7360dc4d2e3e57a8d958c5fc
SSDEEP

12288:4uW/t47xKxfifqQtEub2EXudlDxDoAPRps0iyHZnmnK4bZ0jh0KV430FU+8YGJxX:4N/t4FABWF5GlDBl1ZjV4kLyX

Score

9^/10

evasion

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	5654bbc59e7d5615d04494bb9a93347b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1032 set thread context of 2328	1032	5654bbc59e7d5615d04494bb9a93347b.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2328	5654bbc59e7d5615d04494bb9a93347b.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 2328	1032	5654bbc59e7d5615d04494bb9a93347b.exe	28
PID 1032 wrote to memory of 2328	1032	5654bbc59e7d5615d04494bb9a93347b.exe	28
PID 1032 wrote to memory of 2328	1032	5654bbc59e7d5615d04494bb9a93347b.exe	28
PID 1032 wrote to memory of 2328	1032	5654bbc59e7d5615d04494bb9a93347b.exe	28
PID 1032 wrote to memory of 2328	1032	5654bbc59e7d5615d04494bb9a93347b.exe	28
PID 1032 wrote to memory of 2328	1032	5654bbc59e7d5615d04494bb9a93347b.exe	28
PID 1032 wrote to memory of 2328	1032	5654bbc59e7d5615d04494bb9a93347b.exe	28
PID 1032 wrote to memory of 2328	1032	5654bbc59e7d5615d04494bb9a93347b.exe	28
PID 1032 wrote to memory of 2328	1032	5654bbc59e7d5615d04494bb9a93347b.exe	28
PID 1032 wrote to memory of 2328	1032	5654bbc59e7d5615d04494bb9a93347b.exe	28
PID 1032 wrote to memory of 2328	1032	5654bbc59e7d5615d04494bb9a93347b.exe	28
PID 1032 wrote to memory of 2328	1032	5654bbc59e7d5615d04494bb9a93347b.exe	28
PID 1032 wrote to memory of 2328	1032	5654bbc59e7d5615d04494bb9a93347b.exe	28
PID 1032 wrote to memory of 2328	1032	5654bbc59e7d5615d04494bb9a93347b.exe	28
PID 1032 wrote to memory of 2328	1032	5654bbc59e7d5615d04494bb9a93347b.exe	28
PID 1032 wrote to memory of 2328	1032	5654bbc59e7d5615d04494bb9a93347b.exe	28
PID 1032 wrote to memory of 2328	1032	5654bbc59e7d5615d04494bb9a93347b.exe	28

C:\Users\Admin\AppData\Local\Temp\5654bbc59e7d5615d04494bb9a93347b.exe
"C:\Users\Admin\AppData\Local\Temp\5654bbc59e7d5615d04494bb9a93347b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Users\Admin\AppData\Local\Temp\5654bbc59e7d5615d04494bb9a93347b.exe
  C:\Users\Admin\AppData\Local\Temp\5654bbc59e7d5615d04494bb9a93347b.exe
  2⤵
  - Enumerates VirtualBox registry keys
  - Suspicious behavior: EnumeratesProcesses
  PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1032-38-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/2328-22-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/2328-28-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/2328-7-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/2328-10-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/2328-13-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/2328-16-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/2328-4-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/2328-19-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/2328-25-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/2328-0-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/2328-31-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/2328-34-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/2328-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2328-39-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/2328-2-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/2328-41-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download