22e5bc726793a68e6c56b2ca49f321f6503b90737547db20f6e153e747d63276

Analysis

max time kernel
28s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
31/01/2023, 02:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Mirillis Action! By Maykerstar Games.rar
Size

104.0MB
MD5

72eeae3beb295372b5e55e8d5c35257b
SHA1

b46bfa8b1ba75ba3e74b25c06d47ca3c96c229e5
SHA256

22e5bc726793a68e6c56b2ca49f321f6503b90737547db20f6e153e747d63276
SHA512

51f06ee5a2d3d43234931a7115657fc339ad873c9f36497cb5f4ff9bb8c8db269bce41c0e12e2ee66c468c5e7e0cef066297c2ba0de6b542e7d2ba3a9e4bdf0d
SSDEEP

3145728:wHEH9Q3NZd2fFAwQ16J6Rrekxnev9Cdws7iOmpiV5mS:wW9iNZd2NAwuzRrheCWPw71

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1792	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1792	vlc.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
1792	vlc.exe
1792	vlc.exe
1792	vlc.exe
1792	vlc.exe
1792	vlc.exe
1792	vlc.exe
1792	vlc.exe
1792	vlc.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
1792	vlc.exe
1792	vlc.exe
1792	vlc.exe
1792	vlc.exe
1792	vlc.exe
1792	vlc.exe
1792	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1792	vlc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1904	1992	cmd.exe	29
PID 1992 wrote to memory of 1904	1992	cmd.exe	29
PID 1992 wrote to memory of 1904	1992	cmd.exe	29
PID 1904 wrote to memory of 1792	1904	rundll32.exe	30
PID 1904 wrote to memory of 1792	1904	rundll32.exe	30
PID 1904 wrote to memory of 1792	1904	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Mirillis Action! By Maykerstar Games.rar"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Mirillis Action! By Maykerstar Games.rar
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Mirillis Action! By Maykerstar Games.rar"
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:1792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1992-54-0x000007FEFC361000-0x000007FEFC363000-memory.dmp

Filesize
8KB

Download