dbdd38479854515348488b9bbc94698710b2edf2245bef0ad15defce1d9f4580

Analysis

max time kernel
28s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14/09/2022, 02:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12551/NOISE_FULL_B_24/precopy.rar
Size

13KB
MD5

07f43f757f085e6c3fd52e015d18f6ad
SHA1

76fa2cced7038db9bef6e42636d2c12ee3205357
SHA256

8ba0b23a47b037afa9c5463433f45ddd77b2f6620d33d466b5cb6e7ac4971005
SHA512

81661db9a8b79179139fb731701410c20c775c9839b7226ad1f4e08281bbfdfc6517cf593686abb149662f3a22da463d18249d0a81575f1354b74650cd66e7f0
SSDEEP

384:W4I6OcJPV2rfano3p4LzDGWDa1F+06+Jnrt:26OsNsn3E3Gr1FO+Jp

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1756	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1756	vlc.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
1756	vlc.exe
1756	vlc.exe
1756	vlc.exe
1756	vlc.exe
1756	vlc.exe
1756	vlc.exe
1756	vlc.exe
1756	vlc.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
1756	vlc.exe
1756	vlc.exe
1756	vlc.exe
1756	vlc.exe
1756	vlc.exe
1756	vlc.exe
1756	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1756	vlc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1116	1652	cmd.exe	28
PID 1652 wrote to memory of 1116	1652	cmd.exe	28
PID 1652 wrote to memory of 1116	1652	cmd.exe	28
PID 1116 wrote to memory of 1756	1116	rundll32.exe	29
PID 1116 wrote to memory of 1756	1116	rundll32.exe	29
PID 1116 wrote to memory of 1756	1116	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\12551\NOISE_FULL_B_24\precopy.rar
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\12551\NOISE_FULL_B_24\precopy.rar
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\12551\NOISE_FULL_B_24\precopy.rar"
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:1756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1652-54-0x000007FEFB591000-0x000007FEFB593000-memory.dmp

Filesize
8KB

Download