ef7c81caad86886177cb57b83f4db9c656f1cc2c012dae71ed710be27ba5a344

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 19:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7dc92af8bc4efd8f3cbe53a17df693e9.exe
Size

613KB
MD5

7dc92af8bc4efd8f3cbe53a17df693e9
SHA1

25ce7b8cb9a0f3518ed2dc95aff9a0235fe5e7a7
SHA256

ef7c81caad86886177cb57b83f4db9c656f1cc2c012dae71ed710be27ba5a344
SHA512

c68ba4ab63a984d60b0a9a4c568b211997c4ce5875ed6d1cce349472c4fe4bd3598d3994a62213b6ff1d72b3095e9e308d7e237b0c47540aef5b38cb5f3b9979
SSDEEP

12288:HhuQzxPesHNimGRnY6OjB9k53Ck3GteLyiCPNwwlHzvYspJ/WqiqCYg8S:HhuQdPesHNiTR7sB9q30iqB0BqHg8S

Score

9^/10

evasion

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	7dc92af8bc4efd8f3cbe53a17df693e9.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5012 set thread context of 2220	5012	7dc92af8bc4efd8f3cbe53a17df693e9.exe	46

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5044	2220	WerFault.exe	46

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2220	7dc92af8bc4efd8f3cbe53a17df693e9.exe
2220	7dc92af8bc4efd8f3cbe53a17df693e9.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 2220	5012	7dc92af8bc4efd8f3cbe53a17df693e9.exe	46
PID 5012 wrote to memory of 2220	5012	7dc92af8bc4efd8f3cbe53a17df693e9.exe	46
PID 5012 wrote to memory of 2220	5012	7dc92af8bc4efd8f3cbe53a17df693e9.exe	46
PID 5012 wrote to memory of 2220	5012	7dc92af8bc4efd8f3cbe53a17df693e9.exe	46
PID 5012 wrote to memory of 2220	5012	7dc92af8bc4efd8f3cbe53a17df693e9.exe	46
PID 5012 wrote to memory of 2220	5012	7dc92af8bc4efd8f3cbe53a17df693e9.exe	46
PID 5012 wrote to memory of 2220	5012	7dc92af8bc4efd8f3cbe53a17df693e9.exe	46
PID 5012 wrote to memory of 2220	5012	7dc92af8bc4efd8f3cbe53a17df693e9.exe	46
PID 5012 wrote to memory of 2220	5012	7dc92af8bc4efd8f3cbe53a17df693e9.exe	46
PID 5012 wrote to memory of 2220	5012	7dc92af8bc4efd8f3cbe53a17df693e9.exe	46
PID 5012 wrote to memory of 2220	5012	7dc92af8bc4efd8f3cbe53a17df693e9.exe	46
PID 5012 wrote to memory of 2220	5012	7dc92af8bc4efd8f3cbe53a17df693e9.exe	46
PID 5012 wrote to memory of 2220	5012	7dc92af8bc4efd8f3cbe53a17df693e9.exe	46
PID 5012 wrote to memory of 2220	5012	7dc92af8bc4efd8f3cbe53a17df693e9.exe	46
PID 5012 wrote to memory of 2220	5012	7dc92af8bc4efd8f3cbe53a17df693e9.exe	46

C:\Users\Admin\AppData\Local\Temp\7dc92af8bc4efd8f3cbe53a17df693e9.exe
"C:\Users\Admin\AppData\Local\Temp\7dc92af8bc4efd8f3cbe53a17df693e9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Users\Admin\AppData\Local\Temp\7dc92af8bc4efd8f3cbe53a17df693e9.exe
  C:\Users\Admin\AppData\Local\Temp\7dc92af8bc4efd8f3cbe53a17df693e9.exe
  2⤵
  - Enumerates VirtualBox registry keys
  - Suspicious behavior: EnumeratesProcesses
  PID:2220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 536
    3⤵
    - Program crash
    PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2220 -ip 2220
1⤵
PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2220-6-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2220-12-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2220-9-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2220-8-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2220-7-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2220-3-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2220-5-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2220-4-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2220-2-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2220-1-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2220-0-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2220-13-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/5012-11-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download