metaflows logo
Category Started On Completed On Duration Cuckoo Version
FILE 2025-01-13 13:07:41.083547 2025-01-13 13:08:23.908017 42 seconds 2.0-dev
Machine Label Manager Started On Shutdown On
win7cuckoo win7 Clone 1 VirtualBox 2025-01-13 13:07:41 2025-01-13 13:08:23

File Details

File name 63178b8cb82fcefca1307f2ea36202356f613e1e.zip
File size 184304 bytes
File type Zip archive data, at least v2.0 to extract
CRC32 B7AB1E2A
MD5 6a8a0f55eb7fcee916bbedcf8ae1101a
SHA1 63178b8cb82fcefca1307f2ea36202356f613e1e
SHA256 80414a634b470178165818bc48b5b4852f9a42dcf1ee44a4774a8b3a449b0a63
SHA512 390d8fb1cd8ee0b943373fd750bafc9146f55738b9e1f05d8cdd055298a61526a0c842c50325934dcd69d6e656e1c449b6ffdd25f8ab832ad0b97db592217ff8
Ssdeep None
PEiD None matched
Yara
  • contains_base64 (This rule finds for base64 strings)
VirusTotal File not found on VirusTotal

MetaFlows Scores

Metaflows Analysis Results (Signatures=50, Anomalies=0, PEiD=0, Yara=0, VT[1736847987]=0): Snort Events=0, AV Events=0
Total Score=50

Dropped File/Buffer Yara Signatures:
prunsrv.exe: DebuggerException__ConsoleCtrl

Signatures

console_output details
nolookup_communication details

Screenshots

No screenshots available.

Static Analysis

Nothing to display.

Dropped Files

prunsrv.exe

Network Analysis

Hosts Involved

DNS Requests

HTTP Requests

Behavior Summary

File-Opened
  • C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui
  • C:\Windows\Globalization\Sorting\sortdefault.nls
Directory-Enumerated
  • C:\Users\Harry Dresden\AppData\Local\Temp
  • C:\Users\Harry Dresden\AppData\Local
  • C:\Users\Harry Dresden\AppData\Local\Temp\windows
  • C:\Users
  • C:\Users\Harry Dresden\AppData\Local\Temp\windows\prunsrv.exe
  • C:\Users\Harry Dresden\AppData
Registry Key-Opened
  • HKEY_LOCAL_MACHINE\SOFTWARE\Apache Software Foundation\Procrun 2.0\prunsrv
Registry Key-Read
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CMF\Config\SYSTEM
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US

Processes

registry filesystem process services network synchronization

C:\Windows\system32\lsass.exe PID: 480, Parent PID: 384

"C:\Users\Harry Dresden\AppData\Local\Temp\windows\prunsrv.exe" PID: 108, Parent PID: 3508

Volatility

Nothing to display.