0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 07:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908.exe
Size

5.7MB
MD5

8cb44d0f6a6124fa55b340f34c8dabc6
SHA1

87e916376846f6fb1e558e94847885625f63786f
SHA256

0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908
SHA512

d6e2268802ebbe2545904334273e70e37216dafd34e384cc92fff28f583eb8e494959da99c425f941fb800b57d4e6577289f053f58222b56450dc48951fa9b51
SSDEEP

98304:j/6n94bDY2EBcBuq62V///4nAWakrn7S/IhWoaVVfs/VIsMF4JD8iulhq7NmnkVV:mMD+cpvJ/4H3nmghWoa/fsysMF4JD85s

Score

9^/10

evasion

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
1728	0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908.exe
1728	0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908.exe
1728	0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908.exe
1728	0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908.exe
1728	0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908.exe
1728	0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908.exe
1728	0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908.exe
1728	0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908.exe
1728	0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908.exe
1728	0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908.exe
1728	0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908.exe
1728	0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908.exe
1728	0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908.exe
1728	0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908.exe
1728	0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908.exe
1728	0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908.exe
1728	0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1728	0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908.exe
Token: SeShutdownPrivilege	1728	0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908.exe
Token: SeShutdownPrivilege	1728	0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908.exe
Token: SeShutdownPrivilege	1728	0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908.exe
Token: SeShutdownPrivilege	1728	0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1728	0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1728	0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908.exe

C:\Users\Admin\AppData\Local\Temp\0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908.exe
"C:\Users\Admin\AppData\Local\Temp\0cd81c0e9b9df7fe1ff0edb2d40baf88121800b1df2bcea3be8542bebf886908.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\yjs_log\log.log

Filesize
7KB

MD5
8dd80e8a838d151acf9c70cb6a06d541

SHA1
95af75550dca9f83eceefd59e6c56b835ed9c143

SHA256
9afd4e80e5d3da9c7837d0cbe628ed9c09a460dd6c4a6dc9a7076ee46a565876

SHA512
b06022c288aeebfb81b11f1790ec4cf7c685b6951c988ffca771407f6620170c86846d406ee611a21ee4b33a3dd7342bf2abd6c0a4b6aecd682dc950a2a27a12

Download Submit