Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
29/05/2024, 03:36
General
-
Target
54a77b45cd6ba395b5c700483e1d64a4d288304de8bc465efd8ab871129aa202.exe
-
Size
5.7MB
-
MD5
c42ec785d752e3863cdce44469185183
-
SHA1
94b0039e75b05e58c2c09bfa68c0f7c82f2a2af6
-
SHA256
54a77b45cd6ba395b5c700483e1d64a4d288304de8bc465efd8ab871129aa202
-
SHA512
bb9af8ad306d67ae7499864e12930724170e2fabc6347e745d15e580f5bcf42db7b28c8cedeaa1c0bc88d35a34029fd7db79f8cc1c17e22de6f3c85aebf49032
-
SSDEEP
98304:j/6n94bDY2EBcBuq62V///4nAWakrn7S/IhWoaVVfs/VIsMF4JD8iulhq7NmqkV8:mMD+cpvJ/4H3nmghWoa/fsysMF4JD85+
Score
9/10
Malware Config
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\54a77b45cd6ba395b5c700483e1d64a4d288304de8bc465efd8ab871129aa202.exe"C:\Users\Admin\AppData\Local\Temp\54a77b45cd6ba395b5c700483e1d64a4d288304de8bc465efd8ab871129aa202.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage