2e104eab7b0a3da0b429304eb0e738fd75f7c99dfb368a3a0c70ffd1d4206c01

Analysis

max time kernel
39s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 08:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PROFORMA INVOICE 103321.rar
Size

804KB
MD5

4eb79c4fa6acd6d50d82b2f3cc6ae1c5
SHA1

e14a3d0ee909418f534e9c457d0c8e8a4f1416ca
SHA256

2e104eab7b0a3da0b429304eb0e738fd75f7c99dfb368a3a0c70ffd1d4206c01
SHA512

2306e493d03f52ef217bd0b550788e55dc4be7b023da47a4f8b99203b0d90c569d3186aa8ed6a48cfb8806fff108e3656c8cc3ec85c76d3acc7747bfd7e3c0ca
SSDEEP

12288:HmDIqmgXdq5tPOpsAfOpy7lG4Roh81TZP9STlukqBYn+so6sFyD1xrlukYjp:HgINgXdqjOGAfOZis83P9tiXtD1xR2jp

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

1816 vlc.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vlc.exe

pid process

1816 vlc.exe
Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

vlc.exe

pid process

1816 vlc.exe
1816 vlc.exe
1816 vlc.exe
1816 vlc.exe
1816 vlc.exe
1816 vlc.exe
1816 vlc.exe
1816 vlc.exe
Suspicious use of SendNotifyMessage 7 IoCs

Processes:

vlc.exe

pid process

1816 vlc.exe
1816 vlc.exe
1816 vlc.exe
1816 vlc.exe
1816 vlc.exe
1816 vlc.exe
1816 vlc.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vlc.exe

pid process

1816 vlc.exe

pid	process
1816	vlc.exe

pid	process
1816	vlc.exe

pid	process
1816	vlc.exe
1816	vlc.exe
1816	vlc.exe
1816	vlc.exe
1816	vlc.exe
1816	vlc.exe
1816	vlc.exe
1816	vlc.exe

pid	process
1816	vlc.exe
1816	vlc.exe
1816	vlc.exe
1816	vlc.exe
1816	vlc.exe
1816	vlc.exe
1816	vlc.exe

pid	process
1816	vlc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1504 wrote to memory of 952	1504	cmd.exe	rundll32.exe
PID 1504 wrote to memory of 952	1504	cmd.exe	rundll32.exe
PID 1504 wrote to memory of 952	1504	cmd.exe	rundll32.exe
PID 952 wrote to memory of 1816	952	rundll32.exe	vlc.exe
PID 952 wrote to memory of 1816	952	rundll32.exe	vlc.exe
PID 952 wrote to memory of 1816	952	rundll32.exe	vlc.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE 103321.rar"
1⤵
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE 103321.rar
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:952

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE 103321.rar"
3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1816

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/952-76-0x0000000000000000-mapping.dmp

Download
memory/1504-54-0x000007FEFC141000-0x000007FEFC143000-memory.dmp

Filesize
8KB

Download
memory/1816-81-0x0000000000000000-mapping.dmp

Download