Analysis
-
max time kernel
42s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
27-07-2022 18:51
Behavioral task
behavioral1
Sample
e42b4c09ae3105de7d09722b26d60fa1268771d46907c36e2dbc57b4f8a22227.rar
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
e42b4c09ae3105de7d09722b26d60fa1268771d46907c36e2dbc57b4f8a22227.rar
Resource
win10v2004-20220721-en
Behavioral task
behavioral3
Sample
Setup/Setup.exe
Resource
win7-20220715-en
General
-
Target
e42b4c09ae3105de7d09722b26d60fa1268771d46907c36e2dbc57b4f8a22227.rar
-
Size
7.6MB
-
MD5
57eb3b48fc86d1739c946a024270128f
-
SHA1
6fe9aa7ecfcdf575c033821d51ce5e9c7ba1b4bb
-
SHA256
e42b4c09ae3105de7d09722b26d60fa1268771d46907c36e2dbc57b4f8a22227
-
SHA512
6f1e38e1bda51e08a6d3084677329690665a540f9ffbbd56c99c8343b5dd3182048359609cd4369e86609dc31e093b68af1e94515e5dff7cf44c7c83265aabfa
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 1364 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid process 1364 vlc.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
Processes:
vlc.exepid process 1364 vlc.exe 1364 vlc.exe 1364 vlc.exe 1364 vlc.exe 1364 vlc.exe 1364 vlc.exe 1364 vlc.exe 1364 vlc.exe -
Suspicious use of SendNotifyMessage 7 IoCs
Processes:
vlc.exepid process 1364 vlc.exe 1364 vlc.exe 1364 vlc.exe 1364 vlc.exe 1364 vlc.exe 1364 vlc.exe 1364 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 1364 vlc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1996 wrote to memory of 1468 1996 cmd.exe rundll32.exe PID 1996 wrote to memory of 1468 1996 cmd.exe rundll32.exe PID 1996 wrote to memory of 1468 1996 cmd.exe rundll32.exe PID 1468 wrote to memory of 1364 1468 rundll32.exe vlc.exe PID 1468 wrote to memory of 1364 1468 rundll32.exe vlc.exe PID 1468 wrote to memory of 1364 1468 rundll32.exe vlc.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\e42b4c09ae3105de7d09722b26d60fa1268771d46907c36e2dbc57b4f8a22227.rar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\e42b4c09ae3105de7d09722b26d60fa1268771d46907c36e2dbc57b4f8a22227.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\e42b4c09ae3105de7d09722b26d60fa1268771d46907c36e2dbc57b4f8a22227.rar"3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx