52635463d833711ea1cd1c5db3cd22407fa5c45b74327cde14bde9bb9aa54754

General

Target

Vape_v4.08/dumper/mitm_server.py
Size

4KB
MD5

fb2ea3294517bab463df4273e7c6bcd6
SHA1

1a5eb75bff26c1d8a8cfefa57a8ea7fe366b7546
SHA256

bc130c050da31bc55f7d6aa1c7a7e0817f289fa0eaf72ffa253cbaa10c45aff7
SHA512

ef56b9000dca93f34a5badb94299f27cd0cca267decf9c99b60dfe7b60d5df748900da7a422882a80f0a26a552bcb0588298096aa56d80c2026e190da862dfa7

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 10 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

1108 AcroRd32.exe
1108 AcroRd32.exe
1108 AcroRd32.exe

pid	process
1108	AcroRd32.exe
1108	AcroRd32.exe
1108	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 776 wrote to memory of 1720	776	cmd.exe	rundll32.exe
PID 776 wrote to memory of 1720	776	cmd.exe	rundll32.exe
PID 776 wrote to memory of 1720	776	cmd.exe	rundll32.exe
PID 1720 wrote to memory of 1108	1720	rundll32.exe	AcroRd32.exe
PID 1720 wrote to memory of 1108	1720	rundll32.exe	AcroRd32.exe
PID 1720 wrote to memory of 1108	1720	rundll32.exe	AcroRd32.exe
PID 1720 wrote to memory of 1108	1720	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Vape_v4.08\dumper\mitm_server.py
1⤵
- Suspicious use of WriteProcessMemory
PID:776

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Vape_v4.08\dumper\mitm_server.py
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1720

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Vape_v4.08\dumper\mitm_server.py"
3⤵
- Suspicious use of SetWindowsHookEx
PID:1108

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/776-54-0x000007FEFB801000-0x000007FEFB803000-memory.dmp

Filesize
8KB

Download
memory/1108-81-0x0000000000000000-mapping.dmp

Download
memory/1108-82-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1720-76-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing