a9939a8c340f63579b97c2cc8f676308bc7546ce3f1fe32c22bb9c54a2d7aecd

Analysis

max time kernel
36s
max time network
42s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
27-07-2022 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9939a8c340f63579b97c2cc8f676308bc7546ce3f1fe32c22bb9c54a2d7aecd.rar
Size

7.4MB
MD5

c382d5e1cef468d4b1c10bf321629d13
SHA1

43a1088c1943c8172d994ec92aab0804479c6e0e
SHA256

a9939a8c340f63579b97c2cc8f676308bc7546ce3f1fe32c22bb9c54a2d7aecd
SHA512

6885924b018814a681836de49ba4d679e1f9f90e3b6536f3ef03e60c7796256e689bcc4ed081666ad4eb8719b65635ae2ae7a2172c24cc0e474a90d7909ecd7f

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

1652 vlc.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vlc.exe

pid process

1652 vlc.exe
Suspicious use of FindShellTrayWindow 10 IoCs

Processes:

vlc.exe

pid process

1652 vlc.exe
1652 vlc.exe
1652 vlc.exe
1652 vlc.exe
1652 vlc.exe
1652 vlc.exe
1652 vlc.exe
1652 vlc.exe
1652 vlc.exe
1652 vlc.exe
Suspicious use of SendNotifyMessage 9 IoCs

Processes:

vlc.exe

pid process

1652 vlc.exe
1652 vlc.exe
1652 vlc.exe
1652 vlc.exe
1652 vlc.exe
1652 vlc.exe
1652 vlc.exe
1652 vlc.exe
1652 vlc.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vlc.exe

pid process

1652 vlc.exe

pid	process
1652	vlc.exe

pid	process
1652	vlc.exe

pid	process
1652	vlc.exe
1652	vlc.exe
1652	vlc.exe
1652	vlc.exe
1652	vlc.exe
1652	vlc.exe
1652	vlc.exe
1652	vlc.exe
1652	vlc.exe
1652	vlc.exe

pid	process
1652	vlc.exe
1652	vlc.exe
1652	vlc.exe
1652	vlc.exe
1652	vlc.exe
1652	vlc.exe
1652	vlc.exe
1652	vlc.exe
1652	vlc.exe

pid	process
1652	vlc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1108 wrote to memory of 1140	1108	cmd.exe	rundll32.exe
PID 1108 wrote to memory of 1140	1108	cmd.exe	rundll32.exe
PID 1108 wrote to memory of 1140	1108	cmd.exe	rundll32.exe
PID 1140 wrote to memory of 1652	1140	rundll32.exe	vlc.exe
PID 1140 wrote to memory of 1652	1140	rundll32.exe	vlc.exe
PID 1140 wrote to memory of 1652	1140	rundll32.exe	vlc.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\a9939a8c340f63579b97c2cc8f676308bc7546ce3f1fe32c22bb9c54a2d7aecd.rar
1⤵
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\a9939a8c340f63579b97c2cc8f676308bc7546ce3f1fe32c22bb9c54a2d7aecd.rar
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1140

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\a9939a8c340f63579b97c2cc8f676308bc7546ce3f1fe32c22bb9c54a2d7aecd.rar"
3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1652

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1108-54-0x000007FEFBDA1000-0x000007FEFBDA3000-memory.dmp

Filesize
8KB

Download
memory/1140-76-0x0000000000000000-mapping.dmp

Download
memory/1652-81-0x0000000000000000-mapping.dmp

Download