metaflows logo
Category Started On Completed On Duration Cuckoo Version
FILE 2025-01-13 11:49:46.555534 2025-01-13 11:51:07.686757 81 seconds 2.0-dev
Machine Label Manager Started On Shutdown On
win7cuckoo win7 Clone 1 VirtualBox 2025-01-13 11:49:47 2025-01-13 11:51:07

File Details

File name 17909997182e24c80cd794a55a583e1a9d192c29.zip
File size 184297 bytes
File type Zip archive data, at least v2.0 to extract
CRC32 76DE398C
MD5 6b96bb39ef36e9843f6f09e297bba6ba
SHA1 17909997182e24c80cd794a55a583e1a9d192c29
SHA256 b54fe4505270adf6482bdcbb01f3be0e11b63c607be7984833478f2eff89d227
SHA512 a896ceae8b6c9fa7517d8085fbc1d87f1630711431222601d46546cc3aa9b506fef8b4248da00b6d71f0ef9a19d935d3abcf9a6144d96bf560665a0604f430c5
Ssdeep None
PEiD None matched
Yara
  • contains_base64 (This rule finds for base64 strings)
VirusTotal File not found on VirusTotal

MetaFlows Scores

Metaflows Analysis Results (Signatures=50, Anomalies=0, PEiD=0, Yara=0, VT[1736844545]=0): Snort Events=0, AV Events=0
Total Score=50

Dropped File/Buffer Yara Signatures:
prunsrv.exe: DebuggerException__ConsoleCtrl

Signatures

console_output details
nolookup_communication details

Screenshots

No screenshots available.

Static Analysis

Nothing to display.

Dropped Files

prunsrv.exe

Network Analysis

Hosts Involved

DNS Requests

HTTP Requests

Behavior Summary

File-Opened
  • C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui
  • C:\Windows\Globalization\Sorting\sortdefault.nls
Directory-Enumerated
  • C:\Users\Harry Dresden\AppData\Local\Temp
  • C:\Users\Harry Dresden\AppData\Local
  • C:\Users\Harry Dresden\AppData\Local\Temp\windows
  • C:\Users
  • C:\Users\Harry Dresden\AppData\Local\Temp\windows\prunsrv.exe
  • C:\Users\Harry Dresden\AppData
Registry Key-Opened
  • HKEY_LOCAL_MACHINE\SOFTWARE\Apache Software Foundation\Procrun 2.0\prunsrv
Registry Key-Read
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CMF\Config\SYSTEM
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US

Processes

registry filesystem process services network synchronization

C:\Windows\system32\lsass.exe PID: 480, Parent PID: 384

"C:\Users\Harry Dresden\AppData\Local\Temp\windows\prunsrv.exe" PID: 3820, Parent PID: 3228

Volatility

Nothing to display.