Windows
Analysis Report
16879736671.zip
Overview
General Information
Detection
Score: | 0 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Classification
- System is w10x64_ra
- rundll32.exe (PID: 6164 cmdline:
C:\Windows \System32\ rundll32.e xe C:\Wind ows\System 32\shell32 .dll,SHCre ateLocalSe rverRunDll {9aa46009 -3ce0-458a -a354-7156 10a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)
- cleanup
Click to jump to signature section
There are no malicious signatures, click here to show all signatures.
Source: | Classification label: |
Source: | Key opened: |
Source: | Process created: |
Source: | Static file information: |
Source: | Process information set: |
Source: | Thread injection, dropped files, key value created, disk infection and DNS query: |
Source: | Thread injection, dropped files, key value created, disk infection and DNS query: |
Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | Path Interception | Path Interception | 1 Rundll32 | OS Credential Dumping | 1 System Information Discovery | Remote Services | Data from Local System | Data Obfuscation | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Joe Sandbox version: | 40.0.0 Tourmaline |
Analysis ID: | 1431696 |
Start date and time: | 2024-04-25 16:41:55 +02:00 |
Joe Sandbox product: | CloudBasic |
Overall analysis duration: | |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Cookbook file name: | defaultwindowsinteractivecookbook.jbs |
Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
Number of analysed new started processes analysed: | 15 |
Number of new started drivers analysed: | 0 |
Number of existing processes analysed: | 0 |
Number of existing drivers analysed: | 0 |
Number of injected processes analysed: | 0 |
Technologies: |
|
Analysis Mode: | stream |
Analysis stop reason: | Timeout |
Sample name: | 16879736671.zip |
Detection: | CLEAN |
Classification: | clean0.winZIP@1/0@0/0 |
Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe
- Excluded IPs from analysis (whitelisted): 13.107.21.200, 204.79.197.200
- Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
- Not all processes where analyzed, report is missing behavior information
File type: | |
Entropy (8bit): | 7.9998665122588974 |
TrID: |
|
File name: | 16879736671.zip |
File size: | 1'677'840 bytes |
MD5: | 8818cd0ecf6213b9eb05f43101e372fa |
SHA1: | 313c61a6ef2bc3931228a11962526fd4a6f1417a |
SHA256: | 5ea810ea3bb6c7947ee20dbad04c3a223fdf10923c2c55f48a595f8bb4ea2cf3 |
SHA512: | cc5d4da86edb37e81b659d5eed352b2318cd3d663fa7e656ef25acb82f7b706961f2e0f78aef068eb392fef0e9f9f8edd5c9404e0a81c397b5f560640239199e |
SSDEEP: | 49152:YqC1JJTj6604xyX/sQlokV2S+nXRxD9T1Y+D:U1JRuSyX/sQlfozZz |
TLSH: | A375333B1F75B85EEA4042AA1465C4D2F784B2B2BB2E731630736F7E5279CBB26D0405 |
File Content Preview: | PK........................@...4628594aa1caca0f78bf8a9e273815e873a1b56342e6135a79274205c38c583b.#..N.J...*..qAC..._..T..[..+...!.~ .W.]..1]..O.....)36@^...Se.^.#..`...].....".....-.hY..$./e..s.0...$kH.H.....z@"..L..l.hc.t.i9f)....b.0'O..Ay>h..-..w..~#.?... |
Icon Hash: | 1c1c1e4e4ececedc |