Overview

overview

10

Static

static

10

e1dcb9ba72...29.exe

windows7-x64

3

e1dcb9ba72...29.exe

windows10-2004-x64

3

e2071b429e...5c.exe

windows7-x64

10

e2071b429e...5c.exe

windows10-2004-x64

10

e249dbf0ac...f4.exe

windows7-x64

8

e249dbf0ac...f4.exe

windows10-2004-x64

8

e277271cc7...e8.exe

windows7-x64

10

e277271cc7...e8.exe

windows10-2004-x64

10

e282def0d2...89.exe

windows7-x64

10

e282def0d2...89.exe

windows10-2004-x64

10

e29645b977...39.exe

windows7-x64

7

e29645b977...39.exe

windows10-2004-x64

7

e2bfb9c5da...0c.exe

windows7-x64

1

e2bfb9c5da...0c.exe

windows10-2004-x64

1

e316eea789...fa.exe

windows7-x64

1

e316eea789...fa.exe

windows10-2004-x64

1

e3250ba3e9...f9.exe

windows7-x64

10

e3250ba3e9...f9.exe

windows10-2004-x64

10

e34a914ca2...b1.exe

windows7-x64

10

e34a914ca2...b1.exe

windows10-2004-x64

10

e37b2913aa...c6.exe

windows7-x64

10

e37b2913aa...c6.exe

windows10-2004-x64

10

e37c63b72b...0d.exe

windows7-x64

10

e37c63b72b...0d.exe

windows10-2004-x64

10

e37cf80804...e0.exe

windows7-x64

10

e37cf80804...e0.exe

windows10-2004-x64

10

e3a2f6c598...82.exe

windows7-x64

1

e3a2f6c598...82.exe

windows10-2004-x64

1

e3a86fc42d...62.exe

windows7-x64

9

e3a86fc42d...62.exe

windows10-2004-x64

9

e3e3053d34...10.exe

windows7-x64

10

e3e3053d34...10.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    138s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2025, 06:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e3a86fc42dbea243f01ab5183b1e1f0c1907b4b6d46428df1d055ceb3dc9f662.exe

  • Size

    1.7MB

  • MD5

    45506195502850453db17be2edddf4f9

  • SHA1

    d855f331d09e07dae83e5419c15e886c19063782

  • SHA256

    e3a86fc42dbea243f01ab5183b1e1f0c1907b4b6d46428df1d055ceb3dc9f662

  • SHA512

    4463c77ece9d370aa35a99157d8b80e01893839e02b68b95b4e777aded5485c9e98c9bf3e8df47b69eaabfa1ee6c3b85b3b0fd3369d6e047875c111e92817bfa

  • SSDEEP

    24576:euzyFoBkkAqm3NHx0t71N/otyCgfdt6oP4pPTxShHhsCMafaO1n:euWanoR0vNgtyhyj2vCO1

Score
9/10
defense_evasiondiscovery

Malware Config

Signatures

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    defense_evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e3a86fc42dbea243f01ab5183b1e1f0c1907b4b6d46428df1d055ceb3dc9f662.exe
    "C:\Users\Admin\AppData\Local\Temp\e3a86fc42dbea243f01ab5183b1e1f0c1907b4b6d46428df1d055ceb3dc9f662.exe"
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5928

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5928-0-0x000000007520E000-0x000000007520F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/5928-1-0x0000000000DD0000-0x0000000000F86000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/5928-2-0x0000000005890000-0x00000000058A2000-memory.dmp

    Filesize

    72KB

    Download

  • memory/5928-3-0x0000000005920000-0x00000000059C0000-memory.dmp

    Filesize

    640KB

    Download

  • memory/5928-4-0x0000000075200000-0x00000000759B0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/5928-5-0x00000000059E0000-0x00000000059EA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/5928-6-0x0000000075200000-0x00000000759B0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/5928-7-0x0000000006B70000-0x0000000006BAC000-memory.dmp

    Filesize

    240KB

    Download

  • memory/5928-8-0x000000007520E000-0x000000007520F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/5928-9-0x0000000075200000-0x00000000759B0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/5928-10-0x0000000075200000-0x00000000759B0000-memory.dmp

    Filesize

    7.7MB

    Download