Overview

overview

9

Static

static

3

b876c7653d...aa.exe

windows7-x64

1

b876c7653d...aa.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-03-2024 10:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b876c7653dac3cc259875172c6bd18aa.exe

  • Size

    570KB

  • MD5

    b876c7653dac3cc259875172c6bd18aa

  • SHA1

    6875efe08920fbc25ac453bebae212e925cfe088

  • SHA256

    55014123e3d43c1885c4f9f0d331990946e0ebc23df4c58175ce1854fb964413

  • SHA512

    6cb219262565d134657e6ef383235f77a89734d03c46226f12fe9a129fc8b1afb990799c9b66e652b5b5a891a6d4b75d3c4dde554a94c38b0bd57545ee40b13e

  • SSDEEP

    12288:WQDz6DeMnsKjKVC/XvLqLrg1YxnEZEquynVJwbCHwppGeMXTn:GsJVW/+rg1fZEJMAC5Rjn

Score
9/10
evasionpersistence

Malware Config

Signatures

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    evasion
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b876c7653dac3cc259875172c6bd18aa.exe
    "C:\Users\Admin\AppData\Local\Temp\b876c7653dac3cc259875172c6bd18aa.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    PID:3484
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:2272

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    Virtualization/Sandbox Evasion

    1
    T1497

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Software Discovery

    1
    T1518

    Query Registry

    1
    T1012

    Virtualization/Sandbox Evasion

    1
    T1497

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3484-0-0x0000000000D80000-0x0000000000D89000-memory.dmp
      Filesize

      36KB

      Download
    • memory/3484-1-0x0000000000D80000-0x0000000000D89000-memory.dmp
      Filesize

      36KB

      Download
    • memory/3484-2-0x0000000000DD0000-0x0000000000EA7000-memory.dmp
      Filesize

      860KB

      Download
    • memory/3484-3-0x0000000000DD0000-0x0000000000EA7000-memory.dmp
      Filesize

      860KB

      Download
    • memory/3484-4-0x0000000000DD0000-0x0000000000EA7000-memory.dmp
      Filesize

      860KB

      Download
    • memory/3484-9-0x0000000000DD0000-0x0000000000EA7000-memory.dmp
      Filesize

      860KB

      Download