Analysis
-
max time kernel
36s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
27-07-2022 18:51
Behavioral task
behavioral1
Sample
3f302fd58e30e4708afc25f56cbc448542ab7d0a77a0c122804c502cc932c61a.rar
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
3f302fd58e30e4708afc25f56cbc448542ab7d0a77a0c122804c502cc932c61a.rar
Resource
win10v2004-20220721-en
Behavioral task
behavioral3
Sample
Setup/Setup.exe
Resource
win7-20220718-en
General
-
Target
3f302fd58e30e4708afc25f56cbc448542ab7d0a77a0c122804c502cc932c61a.rar
-
Size
7.0MB
-
MD5
f6b8435fa2a8b06d1a01d0aa79e83f88
-
SHA1
bc8ebd59069fee6a371f0f43ea6be911449cd247
-
SHA256
3f302fd58e30e4708afc25f56cbc448542ab7d0a77a0c122804c502cc932c61a
-
SHA512
7475ac87e1a01dd6cddecbd110850402d19678ccc75e8cbbc59f211aa1b1dbfb8425b4fbb0604c80bcce0786a2793c53311895e34231608d8aa77bd127dafa96
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 240 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid process 240 vlc.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
Processes:
vlc.exepid process 240 vlc.exe 240 vlc.exe 240 vlc.exe 240 vlc.exe 240 vlc.exe 240 vlc.exe 240 vlc.exe 240 vlc.exe 240 vlc.exe -
Suspicious use of SendNotifyMessage 8 IoCs
Processes:
vlc.exepid process 240 vlc.exe 240 vlc.exe 240 vlc.exe 240 vlc.exe 240 vlc.exe 240 vlc.exe 240 vlc.exe 240 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 240 vlc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1992 wrote to memory of 1336 1992 cmd.exe rundll32.exe PID 1992 wrote to memory of 1336 1992 cmd.exe rundll32.exe PID 1992 wrote to memory of 1336 1992 cmd.exe rundll32.exe PID 1336 wrote to memory of 240 1336 rundll32.exe vlc.exe PID 1336 wrote to memory of 240 1336 rundll32.exe vlc.exe PID 1336 wrote to memory of 240 1336 rundll32.exe vlc.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\3f302fd58e30e4708afc25f56cbc448542ab7d0a77a0c122804c502cc932c61a.rar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\3f302fd58e30e4708afc25f56cbc448542ab7d0a77a0c122804c502cc932c61a.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\3f302fd58e30e4708afc25f56cbc448542ab7d0a77a0c122804c502cc932c61a.rar"3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx