5e8e9911fe0ce559ab5b61787f57c47d51e05303591acf5f0c5be1b656b0270c

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 06:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e8e9911fe0ce559ab5b61787f57c47d51e05303591acf5f0c5be1b656b0270c.exe
Size

5.7MB
MD5

f19caa4a3524364acfc4c4c66e9d3bdc
SHA1

fa6f874b16377cbec597bcc2593e54edf5dea2ef
SHA256

5e8e9911fe0ce559ab5b61787f57c47d51e05303591acf5f0c5be1b656b0270c
SHA512

1a947ddc29505771ef4d46bbf7fc8f6ccb58cd1c53c56283650fa0a59c8bb4165e2ebcfd53c502a5e71a895f4b88d3c5fdd7dba2a89351422052f8e28e65aed6
SSDEEP

98304:j/6n94bDY2EBcBuq62V///4nAWakrn7S/IhWoaVVfs/VIsMF4JD8iulhq7Nm3kVR:mMD+cpvJ/4H3nmghWoa/fsysMF4JD856

Score

9^/10

evasion

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	5e8e9911fe0ce559ab5b61787f57c47d51e05303591acf5f0c5be1b656b0270c.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1704	5e8e9911fe0ce559ab5b61787f57c47d51e05303591acf5f0c5be1b656b0270c.exe
1704	5e8e9911fe0ce559ab5b61787f57c47d51e05303591acf5f0c5be1b656b0270c.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1704	5e8e9911fe0ce559ab5b61787f57c47d51e05303591acf5f0c5be1b656b0270c.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1704	5e8e9911fe0ce559ab5b61787f57c47d51e05303591acf5f0c5be1b656b0270c.exe

C:\Users\Admin\AppData\Local\Temp\5e8e9911fe0ce559ab5b61787f57c47d51e05303591acf5f0c5be1b656b0270c.exe
"C:\Users\Admin\AppData\Local\Temp\5e8e9911fe0ce559ab5b61787f57c47d51e05303591acf5f0c5be1b656b0270c.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\yjs_log\log.log

Filesize
650B

MD5
194fb9ba9a55b56e2b056a9baba6edbb

SHA1
f071e7adb582cb011c0184aa8f700170042f45f2

SHA256
04fc31cfb7993c8ab16be3bf2cb98a6cf8d731d526670a4399db1c3499c7d4a6

SHA512
a4bd0355c82c8b554bc27288b35e97da4a6152aea3175d13c506e3c3468b5088e5346933561bab232339583d08d8321cb2227244b011b7657dc3f3075a7943e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\yjs_log\log.log

Filesize
250B

MD5
8723dfa8237a2251fb24522806d4f61b

SHA1
d66585306828c5f10d672005bdece4dc76fe9360

SHA256
c15990a5f52aa458d12adf2a3e2c3a44968cef41eb08d39f79c62ffaacb14f4a

SHA512
ccde6855e434a94fdd3b3ea25b76f978716bef8a1eb4133764ab67fba50aec32fd62c38ff058eea4e39f92d89a2dc0cbeed02392a988419fa4ce1380a70d1c3d

Download Submit