5f9e18cc22f806551a5f64466b6b51630fbead6a991823f48e865718e5283d25

Analysis

max time kernel
141s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 11:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f9e18cc22f806551a5f64466b6b51630fbead6a991823f48e865718e5283d25.exe
Size

201KB
MD5

8120fd409e93bf42e104246a45fa4fba
SHA1

356164244ffe6b497d11f2cdb6ad19abdef7f4c4
SHA256

5f9e18cc22f806551a5f64466b6b51630fbead6a991823f48e865718e5283d25
SHA512

6f9130e7406fd87f55f189f0fc2811c3bee5642d00f621964b867943c25c718ad3d4d3488f64e6fd58509a677abfe4e80cdab0725d7f01b0156a3b9bd646a1d4
SSDEEP

3072:nuE9PTnYrwMndodf+GZWkQ0KlQQoisKKa1UCzeaMBR2X5it85e4Jl6yS:nuS/MWf18kQ0KlZoiSw5Kana85e4JM

Score

9^/10

evasion upx

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

5f9e18cc22f806551a5f64466b6b51630fbead6a991823f48e865718e5283d25.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	5f9e18cc22f806551a5f64466b6b51630fbead6a991823f48e865718e5283d25.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4492-0-0x0000000000580000-0x000000000063F000-memory.dmp	upx
behavioral2/memory/4492-1-0x0000000000580000-0x000000000063F000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\5f9e18cc22f806551a5f64466b6b51630fbead6a991823f48e865718e5283d25.exe
"C:\Users\Admin\AppData\Local\Temp\5f9e18cc22f806551a5f64466b6b51630fbead6a991823f48e865718e5283d25.exe"
1⤵
- Enumerates VirtualBox registry keys
PID:4492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4492-0-0x0000000000580000-0x000000000063F000-memory.dmp

Filesize
764KB

Download
memory/4492-1-0x0000000000580000-0x000000000063F000-memory.dmp

Filesize
764KB

Download