Analysis
-
max time kernel
44s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
27-07-2022 18:52
Behavioral task
behavioral1
Sample
57d2eb5dae4dd6a0a3f972adb4dbd27262e1155b839acaaa9ee72657d6d58c31.rar
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
57d2eb5dae4dd6a0a3f972adb4dbd27262e1155b839acaaa9ee72657d6d58c31.rar
Resource
win10v2004-20220722-en
Behavioral task
behavioral3
Sample
Setup/Setup.exe
Resource
win7-20220718-en
General
-
Target
57d2eb5dae4dd6a0a3f972adb4dbd27262e1155b839acaaa9ee72657d6d58c31.rar
-
Size
7.8MB
-
MD5
dd41905013365151acce0fb08d1eb0de
-
SHA1
a25b70dc55692569b19e571e8cfce96a0d30cccd
-
SHA256
57d2eb5dae4dd6a0a3f972adb4dbd27262e1155b839acaaa9ee72657d6d58c31
-
SHA512
461f524cfd83072da284839032fc15e93fdd044142b30008f20ecbdae068afb184757a00b12118515d978b92ec2c3b10e3a8575daf13c6f6589e5cbf8278037f
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 556 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid process 556 vlc.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
Processes:
vlc.exepid process 556 vlc.exe 556 vlc.exe 556 vlc.exe 556 vlc.exe 556 vlc.exe 556 vlc.exe 556 vlc.exe 556 vlc.exe 556 vlc.exe -
Suspicious use of SendNotifyMessage 8 IoCs
Processes:
vlc.exepid process 556 vlc.exe 556 vlc.exe 556 vlc.exe 556 vlc.exe 556 vlc.exe 556 vlc.exe 556 vlc.exe 556 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 556 vlc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 916 wrote to memory of 1940 916 cmd.exe rundll32.exe PID 916 wrote to memory of 1940 916 cmd.exe rundll32.exe PID 916 wrote to memory of 1940 916 cmd.exe rundll32.exe PID 1940 wrote to memory of 556 1940 rundll32.exe vlc.exe PID 1940 wrote to memory of 556 1940 rundll32.exe vlc.exe PID 1940 wrote to memory of 556 1940 rundll32.exe vlc.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\57d2eb5dae4dd6a0a3f972adb4dbd27262e1155b839acaaa9ee72657d6d58c31.rar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\57d2eb5dae4dd6a0a3f972adb4dbd27262e1155b839acaaa9ee72657d6d58c31.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\57d2eb5dae4dd6a0a3f972adb4dbd27262e1155b839acaaa9ee72657d6d58c31.rar"3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx