Cuckoo Sandbox

Category	Started On	Completed On	Duration	Cuckoo Version
FILE	2025-01-30 18:27:12.750041	2025-01-30 18:30:00.329509	167 seconds	2.0-dev

Machine	Label	Manager	Started On	Shutdown On
win7cuckoo2	win7 Clone 2	VirtualBox	2025-01-30 18:27:13	2025-01-30 18:30:00

File Details

File name	95eeb4d98b4ab6c69635a25d9630c0664904c29d.zip
File size	184293 bytes
File type	Zip archive data, at least v2.0 to extract
CRC32	47B64315
MD5	dd6fd11575a013ae46f78fdc0cb0d043
SHA1	95eeb4d98b4ab6c69635a25d9630c0664904c29d
SHA256	cce6bf7f5fde2b050e4f3e27333bf33f1b472709379e8a3cbc42f722cb0fe25b
SHA512	7808f1ad51628809fb9661331a53fd00ba1128440118bb2e07c82d0323a21fe0fc1d32741287fee45009c1c552f89048d58371c9892ed9b1f886a355d1f86699
Ssdeep	None
PEiD	None matched
Yara	contains_base64 (This rule finds for base64 strings)
VirusTotal	File not found on VirusTotal

MetaFlows Scores

Metaflows Analysis Results (Signatures=50, Anomalies=0, PEiD=0, Yara=0, VT[1738279805]=0): Snort Events=0, AV Events=0
Total Score=50

Dropped File/Buffer Yara Signatures:
prunsrv.exe: DebuggerException__ConsoleCtrl

Signatures

console_output details

nolookup_communication details

Screenshots

No screenshots available.

Static Analysis

Nothing to display.

Dropped Files

prunsrv.exe

File name	prunsrv.exe
File size	96168 bytes
File type	PE32 executable (console) Intel 80386, for MS Windows
MD5	518aa04e7c0d1f9ceb41cd1830492c7e
SHA1	7bba86cf0906f14979cf3c756560e8e6c37fa96f
SHA256	b5a53d3c6a544d1f8316375f301500e6910928e7a2d9afae84ad71af0fbad1f5
SHA512	19009a70cac2fede16fc328be96c834fb21041cbcd5754288a9f9fbff0d2dc2e3ac9e79e7319c3b5226a9c541993c998ae0b228cd95d1bf7be17996acc678848
Ssdeep	None
Yara	DebuggerException__ConsoleCtrl () DebuggerException__SetConsoleCtrl () SEH_Save () SEH_Init () anti_dbg (Checks if being debugged) contains_base64 (This rule finds for base64 strings) create_service (Create a windows service) win_registry (Affect system registries) win_token (Affect system token) win_files_operation (Affect private profile) IsPE32 () IsConsole () HasOverlay (Overlay Check) HasDigitalSignature (DigitalSignature Check) HasRichSignature (Rich Signature Check) Visual_Cpp_2005_Release_Microsoft () VC8_Microsoft_Corporation () Microsoft_Visual_Cpp_8 () Dropper_Strings (May have dropper capabilities)
VirusTotal	Search for Analysis

Network Analysis

Hosts Involved

IP Address
23.13.145.132
23.206.229.167
23.97.150.21
23.99.109.44
8.8.8.8

DNS Requests

Domain	IP Address
teredo.ipv6.microsoft.com	54.156.11.120
nexus.officeapps.live.com	52.111.229.47
watson.microsoft.com	104.208.16.93
ipv6.msftncsi.com
dns.msftncsi.com	131.107.255.255
nexusrules.officeapps.live.com	52.111.229.43
cacerts.digicert.com	23.13.145.132
ctldl.windowsupdate.com	84.201.221.23

HTTP Requests

URL	Data
http://192.168.148.99:2869/upnphost/udhisapi.dll?content=uuid:e85cc7df-5cde-4f66-a850-89e532215d4e	GET /upnphost/udhisapi.dll?content=uuid:e85cc7df-5cde-4f66-a850-89e532215d4e HTTP/1.1 Cache-Control: no-cache Connection: Close Pragma: no-cache Accept: text/xml, application/xml Host: 192.168.148.99:2869 User-Agent: Microsoft-Windows/6.1 UPnP/1.0 Windows-Media-Player-DMS/12.0.7601.17514 DLNADOC/1.50
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?cffb0f1010bf897f	GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?cffb0f1010bf897f HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: ctldl.windowsupdate.com
http://192.168.148.99:2869/upnphost/udhisapi.dll?content=uuid:86077033-7f85-4853-859b-9aa5b6b54306	GET /upnphost/udhisapi.dll?content=uuid:86077033-7f85-4853-859b-9aa5b6b54306 HTTP/1.1 Connection: Keep-Alive User-Agent: Windows-Media-Player-DMS/12.0.7601.17514 Host: 192.168.148.99:2869
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?fc45288e4140d351	GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?fc45288e4140d351 HTTP/1.1 Connection: Keep-Alive Accept: / If-Modified-Since: Fri, 15 Apr 2016 17:23:18 GMT If-None-Match: "0c730803b97d11:0" User-Agent: Microsoft-CryptoAPI/6.1 Host: ctldl.windowsupdate.com
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?1337e49e26735e30	GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?1337e49e26735e30 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: ctldl.windowsupdate.com
http://192.168.148.98:2869/upnphost/udhisapi.dll?content=uuid:269b569f-a61f-4dee-945d-6f1267c6a2cc	GET /upnphost/udhisapi.dll?content=uuid:269b569f-a61f-4dee-945d-6f1267c6a2cc HTTP/1.1 Connection: Keep-Alive User-Agent: Windows-Media-Player-DMS/12.0.7601.17514 Host: 192.168.148.98:2869
http://cacerts.digicert.com/DigiCertGlobalRootG2.crt	GET /DigiCertGlobalRootG2.crt HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com
http://192.168.148.98:5357/f2a51a56-14f7-49cf-a685-0458ce6e1d4a/	POST /f2a51a56-14f7-49cf-a685-0458ce6e1d4a/ HTTP/1.1 Cache-Control: no-cache Connection: Close Pragma: no-cache Content-Type: application/soap+xml User-Agent: WSDAPI Content-Length: 733 Host: 192.168.148.98:5357
http://192.168.148.98:2869/upnphost/udhisapi.dll?content=uuid:e85cc7df-5cde-4f66-a850-89e532215d4e	GET /upnphost/udhisapi.dll?content=uuid:e85cc7df-5cde-4f66-a850-89e532215d4e HTTP/1.1 Cache-Control: no-cache Connection: Close Pragma: no-cache Accept: text/xml, application/xml Host: 192.168.148.98:2869 User-Agent: Microsoft-Windows/6.1 UPnP/1.0 Windows-Media-Player-DMS/12.0.7601.17514 DLNADOC/1.50

Behavior Summary

File-Opened

C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui
C:\Windows\Globalization\Sorting\sortdefault.nls

Directory-Enumerated

C:\Users\Harry Dresden\AppData\Local\Temp
C:\Users\Harry Dresden\AppData\Local
C:\Users\Harry Dresden\AppData\Local\Temp\windows
C:\Users
C:\Users\Harry Dresden\AppData\Local\Temp\windows\prunsrv.exe
C:\Users\Harry Dresden\AppData

Registry Key-Opened

HKEY_LOCAL_MACHINE\SOFTWARE\Apache Software Foundation\Procrun 2.0\prunsrv

Registry Key-Read

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CMF\Config\SYSTEM
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US

Processes

registry filesystem process services network synchronization

C:\Windows\system32\lsass.exe PID: 484, Parent PID: 388

"C:\Users\Harry Dresden\AppData\Local\Temp\windows\prunsrv.exe" PID: 4680, Parent PID: 4672

Volatility

Nothing to display.