1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 04:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe
Size

5.7MB
MD5

036cf662f5a2920f880475e3295dc99a
SHA1

bea1bb2c877403a97bbb29b6664ebb4b1fcb2a0e
SHA256

1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918
SHA512

83a04806a8e02ba388ae72d680c0bc1ab03d393b0b4716c4fc0658ad4934297a7175794a6d75cce656e60051ce5d73428083177b575469b8c26c881311c9a33f
SSDEEP

98304:j/6n94bDY2EBcBuq62V///4nAWakrn7S/IhWoaVVfs/VIsMF4JD8iulhq7NmDkV6:mMD+cpvJ/4H3nmghWoa/fsysMF4JD855

Score

9^/10

evasion

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe

pid	process
1936	1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe
1936	1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe
1936	1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe
1936	1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe
1936	1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe
1936	1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe
1936	1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe
1936	1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe
1936	1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe
1936	1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe
1936	1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe
1936	1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe
1936	1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe
1936	1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe
1936	1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe
1936	1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe
1936	1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe

description	pid	process
Token: SeShutdownPrivilege	1936	1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe
Token: SeShutdownPrivilege	1936	1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe
Token: SeShutdownPrivilege	1936	1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe
Token: SeShutdownPrivilege	1936	1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe
Token: SeShutdownPrivilege	1936	1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe

pid process

1936 1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe

pid process

1936 1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe

C:\Users\Admin\AppData\Local\Temp\1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe
"C:\Users\Admin\AppData\Local\Temp\1b6d49a8fac845180aabff07bcd017045b3266b3163a1ed0030bcb91cfe29918.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\yjs_log\log.log

Filesize
650B

MD5
7abe37435c630f56a7015a6a4f80a8c6

SHA1
3f7f2ea6794abe282c522e541e52f088447ff251

SHA256
601c6293c993bdaf39525d9e4453525d1b776c6a2af6a1e793790a2ce58b858f

SHA512
2546cacdcbc3122f86716ef200175266b46e61072c5fb0f78bc17f5ba0907b9955459bc9ac83b8e64f8f4cbb86506f472e4157173683d0b5067528edc0b0ed34

Download Submit
C:\Users\Admin\AppData\Local\Temp\yjs_log\log.log

Filesize
250B

MD5
c56f96cc918d0891f19a41b1965637ec

SHA1
684d8664e32369ef461ab4dd4daa98bb33e1c3b7

SHA256
b561791fab3f9cc231ad79820a743cd07a8005e60beaa8ec1294e8b5cf600445

SHA512
f21c52312688002c83d8c3d526dc2f3e6ba141c13176150d39acc1e9923f2d23eeb994906ec82ca98d321fa1d7fcaca9dc02f272d015fd8bb9fe8f7eab50598b

Download Submit