576e6c6ca28f8bf550e2f27296b213b25e76bebae5fa57f82a0acbc2f3cf4a24

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
16/02/2023, 11:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GTA 5 low mod v5 By juanma informatica.rar
Size

27.4MB
MD5

d3553dc56ee5171cdd89e37ab4e641ff
SHA1

5b6e9686f803533e340d8db0ed5cbd8648724086
SHA256

576e6c6ca28f8bf550e2f27296b213b25e76bebae5fa57f82a0acbc2f3cf4a24
SHA512

c977871a8d212d9e1c70e69be309e859b0abf96d7bc2ff5d91903835e9d430c8ab51fee703e4e65911c7472399aeb8c01c4ad575d20467a5c8b6afd029b6125a
SSDEEP

393216:lh/6RLC2PIMk1QlwONLShy70EHXR1G2NE/6VuqxZziEq5G6/eyGiA6XligaoR6g:lhS4TnQNJShy7RHXe2RmGIWusVu

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1924	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1924	vlc.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
1924	vlc.exe
1924	vlc.exe
1924	vlc.exe
1924	vlc.exe
1924	vlc.exe
1924	vlc.exe
1924	vlc.exe
1924	vlc.exe
1924	vlc.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
1924	vlc.exe
1924	vlc.exe
1924	vlc.exe
1924	vlc.exe
1924	vlc.exe
1924	vlc.exe
1924	vlc.exe
1924	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1924	vlc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 1700	628	cmd.exe	28
PID 628 wrote to memory of 1700	628	cmd.exe	28
PID 628 wrote to memory of 1700	628	cmd.exe	28
PID 1700 wrote to memory of 1924	1700	rundll32.exe	29
PID 1700 wrote to memory of 1924	1700	rundll32.exe	29
PID 1700 wrote to memory of 1924	1700	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\GTA 5 low mod v5 By juanma informatica.rar"
1⤵
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\GTA 5 low mod v5 By juanma informatica.rar
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\GTA 5 low mod v5 By juanma informatica.rar"
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:1924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/628-54-0x000007FEFC5A1000-0x000007FEFC5A3000-memory.dmp

Filesize
8KB

Download