metaflows logo
Category Started On Completed On Duration Cuckoo Version
FILE 2025-01-13 11:12:24.212310 2025-01-13 11:13:15.410873 51 seconds 2.0-dev
Machine Label Manager Started On Shutdown On
win7cuckoo win7 Clone 1 VirtualBox 2025-01-13 11:12:25 2025-01-13 11:13:15

File Details

File name b542f8cf6b52e409c91e562b3fabb498aa069ae0.zip
File size 184290 bytes
File type Zip archive data, at least v2.0 to extract
CRC32 8C13EA90
MD5 ae78be8e73f71a8471187b389ac7269b
SHA1 b542f8cf6b52e409c91e562b3fabb498aa069ae0
SHA256 e2fa2ae8ba77d04d18139204fdcd90e4f785291d7aecf17bb2a8573fdd3678e2
SHA512 d95f143a159d96c8900d8a805c8fce6ad0e235a446b88db2b6fa238b424b8e2555d319a96acec859572c18b22701c99b13dece73217e4a85da95367435177eb8
Ssdeep None
PEiD None matched
Yara
  • contains_base64 (This rule finds for base64 strings)
VirusTotal File not found on VirusTotal

MetaFlows Scores

Metaflows Analysis Results (Signatures=50, Anomalies=0, PEiD=0, Yara=0, VT[1736842410]=0): Snort Events=0, AV Events=0
Total Score=50

Dropped File/Buffer Yara Signatures:
prunsrv.exe: DebuggerException__ConsoleCtrl

Signatures

console_output details
nolookup_communication details

Screenshots

No screenshots available.

Static Analysis

Nothing to display.

Dropped Files

prunsrv.exe

Network Analysis

Hosts Involved

DNS Requests

HTTP Requests

Behavior Summary

File-Opened
  • C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui
  • C:\Windows\Globalization\Sorting\sortdefault.nls
Directory-Enumerated
  • C:\Users\Harry Dresden\AppData\Local\Temp
  • C:\Users\Harry Dresden\AppData\Local
  • C:\Users\Harry Dresden\AppData\Local\Temp\windows
  • C:\Users
  • C:\Users\Harry Dresden\AppData\Local\Temp\windows\prunsrv.exe
  • C:\Users\Harry Dresden\AppData
Registry Key-Opened
  • HKEY_LOCAL_MACHINE\SOFTWARE\Apache Software Foundation\Procrun 2.0\prunsrv
Registry Key-Read
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CMF\Config\SYSTEM
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US

Processes

registry filesystem process services network synchronization

C:\Windows\system32\lsass.exe PID: 480, Parent PID: 384

"C:\Users\Harry Dresden\AppData\Local\Temp\windows\prunsrv.exe" PID: 1480, Parent PID: 4028

Volatility

Nothing to display.