Overview
overview
10Static
static
0.9.4/scri...de.pyc
windows7-x64
30.9.4/scri...de.pyc
windows10-2004-x64
30.9.4/scri...ax.pyc
windows7-x64
30.9.4/scri...ax.pyc
windows10-2004-x64
30.9.4/scri...__.pyc
windows7-x64
30.9.4/scri...__.pyc
windows10-2004-x64
30.9.4/scri...ne.pyc
windows7-x64
30.9.4/scri...ne.pyc
windows10-2004-x64
30.9.4/scri...ot.pyc
windows7-x64
30.9.4/scri...ot.pyc
windows10-2004-x64
3StartVanga.exe
windows7-x64
10StartVanga.exe
windows10-2004-x64
10Analysis
-
max time kernel
175s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 00:33
Static task
static1
Behavioral task
behavioral1
Sample
0.9.4/scripts/client/CameraNode.pyc
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0.9.4/scripts/client/CameraNode.pyc
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
0.9.4/scripts/client/mods/Zaraza_LsdMax.pyc
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
0.9.4/scripts/client/mods/Zaraza_LsdMax.pyc
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
0.9.4/scripts/client/mods/__init__.pyc
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
0.9.4/scripts/client/mods/__init__.pyc
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
0.9.4/scripts/client/mods/lsdmax/lsdmaxEngine.pyc
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
0.9.4/scripts/client/mods/lsdmax/lsdmaxEngine.pyc
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
0.9.4/scripts/client/mods/lsdmax/mods/lsdmax_Aimbot.pyc
Resource
win7-20220901-en
Behavioral task
behavioral10
Sample
0.9.4/scripts/client/mods/lsdmax/mods/lsdmax_Aimbot.pyc
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
StartVanga.exe
Resource
win7-20220812-en
General
-
Target
0.9.4/scripts/client/CameraNode.pyc
-
Size
1KB
-
MD5
9abd6201841976af945d1a8b329b40ee
-
SHA1
90b66fa4226f8656d27c26043d6889a68477edd1
-
SHA256
9ce052a6de9ad7acc6a5769610fcf168b667773d9298421ea152ad1600157387
-
SHA512
08b22e1b308637e55ca40347ab3ea188a7094df62756be1e8ce81207c2c4a0fd385addaefa1513e9e2515d74a581563fee58685f2fe21049e811793a9c30f588
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 10 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\pyc_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\pyc_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.pyc rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\pyc_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
AcroRd32.exepid process 1876 AcroRd32.exe 1876 AcroRd32.exe 1876 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1588 wrote to memory of 2032 1588 cmd.exe rundll32.exe PID 1588 wrote to memory of 2032 1588 cmd.exe rundll32.exe PID 1588 wrote to memory of 2032 1588 cmd.exe rundll32.exe PID 2032 wrote to memory of 1876 2032 rundll32.exe AcroRd32.exe PID 2032 wrote to memory of 1876 2032 rundll32.exe AcroRd32.exe PID 2032 wrote to memory of 1876 2032 rundll32.exe AcroRd32.exe PID 2032 wrote to memory of 1876 2032 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\0.9.4\scripts\client\CameraNode.pyc1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\0.9.4\scripts\client\CameraNode.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0.9.4\scripts\client\CameraNode.pyc"3⤵
- Suspicious use of SetWindowsHookEx