'
metaflows logo
Category Started On Completed On Duration Cuckoo Version
FILE 2016-09-16 07:48:37.116297 2016-09-16 07:50:05.746119 88 seconds 2.0-dev
Machine Label Manager Started On Shutdown On
win7cuckoo win7 Clone 1 VirtualBox 2016-09-16 07:48:39 2016-09-16 07:50:04

File Details

File name 13fd2b769cc37d5df20c0d290ad9ff4030ecc495.zip
File size 10657246 bytes
File type Zip archive data, at least v1.0 to extract
CRC32 CF7FACC6
MD5 695922aeb073554f4100b828a54ac72b
SHA1 13fd2b769cc37d5df20c0d290ad9ff4030ecc495
SHA256 7965644ec9e621dd4b13fee70796fe75046083e55f705484fc5abd18f404b48a
SHA512 949264d09b630aaba0ea601ff3e8f5ae9f1ddc8418abbcab5d3a639100a9503f563eaa0227aeb63e56b619c87210fa240240140aca2292f42fd1e0ec1f34ff59
Ssdeep 196608:V+ZAFV21iSn1Dmw8h2Bp5wCQF3CiDnl6ZmDPCVci7/9b/PnbdoQtWxhfOwcjjoIf:qw04SxqMDwCcxDnl9mcGJnoUwcj0IRoi
PEiD None matched
Yara
  • shellcode (Matched shellcode byte patterns)
VirusTotal File not found on VirusTotal

MetaFlows Scores

Metaflows Analysis Results (Signatures=0, Anomalies=0, PEiD=0, Yara=2, VT[1474012217]=0): Snort Events=0, AV Events=13
Total Score=25

CLAMAV DETECTED:
PhishTank.Phishing.4031174.UNOFFICIAL FOUND
PhishTank.Phishing.4031174.UNOFFICIAL FOUND
PhishTank.Phishing.4031174.UNOFFICIAL FOUND
PhishTank.Phishing.4031174.UNOFFICIAL FOUND
PhishTank.Phishing.4031174.UNOFFICIAL FOUND
PhishTank.Phishing.4031174.UNOFFICIAL FOUND
PhishTank.Phishing.4031174.UNOFFICIAL FOUND
PhishTank.Phishing.4031174.UNOFFICIAL FOUND
PhishTank.Phishing.4031174.UNOFFICIAL FOUND
PhishTank.Phishing.4031174.UNOFFICIAL FOUND
PhishTank.Phishing.4031174.UNOFFICIAL FOUND
PhishTank.Phishing.4031174.UNOFFICIAL FOUND
PhishTank.Phishing.4031174.UNOFFICIAL FOUND

Dropped File/Buffer Yara Signatures:
STDeployerCore.dll: Str_Win32_Winsock2_Library


Zipped File Yara Signatures:
metaData/products.xml: vmdetect
metaData/patchBulletinMetaData.xml: embedded_win_api
deployment/urls.obf: shellcode
deployment/vendorCertificates.xml: vmdetect
deployment/STDeployerCore.dll: Str_Win32_Winsock2_Library
metaData/cvePatches.xml: embedded_win_api

Signatures

No signatures matched

Screenshots

No screenshots available.

Static Analysis

Nothing to display.

Dropped Files

STDeployerCore.dll

Network Analysis

Hosts Involved

DNS Requests

Behavior Summary

File-Opened
  • C:\Windows\System32\en-US\KERNELBASE.dll.mui
Registry Key-Read
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Processes

registry filesystem process services network synchronization

C:\Windows\system32\lsass.exe PID: 456, Parent PID: 352

"C:\Windows\System32\rundll32.exe" C : \ U s e r s \ H A R R Y D ~ 1 \ A p p D a t a \ L o c a l \ T e m p \ d e p l o y m e n t / S T D e p l o y e r C o r e . d l l , D l l M a i n PID: 5000, Parent PID: 4848

Volatility

Nothing to display.