'
metaflows logo
Category Started On Completed On Duration Cuckoo Version
FILE 2018-08-28 13:53:54.140192 2018-08-28 13:54:24.208276 30 seconds 2.0-dev
Machine Label Manager Started On Shutdown On
win7cuckoo win7 Clone 1 VirtualBox 2018-08-28 13:53:54 2018-08-28 13:54:23

File Details

File name 6b8802489eefcec141c3d3f3ef7620cacd370306.zip
File size 2897299 bytes
File type Zip archive data, at least v2.0 to extract
CRC32 5BC5C1E5
MD5 2c18a7b099b1d8488b18ec147b9cea0f
SHA1 6b8802489eefcec141c3d3f3ef7620cacd370306
SHA256 f26bed65f5832111dbc11ab75a6647f0217241780e57b134b5763a84ce244101
SHA512 c39d794518b89284813b443201c0da1ebb72487e38b76e95658d025a0be551d65c7f1fba6be0623122d7dca43d93984eff784dc012c12b7e48dce798a56619dd
Ssdeep None
PEiD None matched
Yara None matched
VirusTotal File not found on VirusTotal

MetaFlows Scores

Metaflows Analysis Results (Signatures=75, Anomalies=0, PEiD=0, Yara=0, VT[1535478872]=0): Snort Events=0, AV Events=0
Total Score=75

Dropped File/Buffer Yara Signatures:
dolphin_libretro.dll: embedded_macho

Signatures

nolookup_communication details

Screenshots

No screenshots available.

Static Analysis

Nothing to display.

Dropped Files

dolphin_libretro.dll

Network Analysis

Hosts Involved

DNS Requests

HTTP Requests

Behavior Summary

File-Opened
  • C:\Windows\System32\en-US\KERNELBASE.dll.mui
Registry Key-Read
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Processes

registry filesystem process services network synchronization

C:\Windows\system32\lsass.exe PID: 480, Parent PID: 384

"C:\Windows\System32\rundll32.exe" C : \ U s e r s \ H A R R Y D ~ 1 \ A p p D a t a \ L o c a l \ T e m p \ d o l p h i n _ l i b r e t r o . d l l , D l l M a i n PID: 2328, Parent PID: 2212

Volatility

Nothing to display.