'
metaflows logo
Category Started On Completed On Duration Cuckoo Version
FILE 2018-07-24 20:48:51.938962 2018-07-24 20:49:22.102634 30 seconds 2.0-dev
Machine Label Manager Started On Shutdown On
win7cuckoo win7 Clone 1 VirtualBox 2018-07-24 20:48:52 2018-07-24 20:49:21

File Details

File name c28ae53dcf8493633baca52cbc594230a4d941b5.zip
File size 426486 bytes
File type Zip archive data, at least v2.0 to extract
CRC32 5A5CDDCA
MD5 e23bb042966c544310b293cd0714e967
SHA1 c28ae53dcf8493633baca52cbc594230a4d941b5
SHA256 f5b2722b48845f4cbe8a48dfd737f7b282a8a3608a0701fd72443537c6f99d29
SHA512 497835a72f03a8bfefda061f850e710452f0e02f3e6480a5781004fcef36397a5e37962a0a76e6c2373e616e355b601e52c5d9e67b23b2dd9c46837db64334d0
Ssdeep None
PEiD None matched
Yara None matched
VirusTotal File not found on VirusTotal

MetaFlows Scores

Metaflows Analysis Results (Signatures=75, Anomalies=0, PEiD=0, Yara=0, VT[1532479769]=0): Snort Events=0, AV Events=0
Total Score=75

Dropped File/Buffer Yara Signatures:
mgba_libretro.dll: spyeye

Signatures

nolookup_communication details

Screenshots

No screenshots available.

Static Analysis

Nothing to display.

Dropped Files

mgba_libretro.dll

Network Analysis

Hosts Involved

DNS Requests

HTTP Requests

Behavior Summary

File-Opened
  • C:\Windows\System32\en-US\KERNELBASE.dll.mui
Registry Key-Read
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Processes

registry filesystem process services network synchronization

C:\Windows\system32\lsass.exe PID: 480, Parent PID: 384

"C:\Windows\System32\rundll32.exe" C : \ U s e r s \ H A R R Y D ~ 1 \ A p p D a t a \ L o c a l \ T e m p \ m g b a _ l i b r e t r o . d l l , D l l M a i n PID: 2280, Parent PID: 2252

Volatility

Nothing to display.