Analysis
-
max time kernel
75s -
max time network
81s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
16/02/2023, 17:07
Static task
static1
Behavioral task
behavioral1
Sample
Warzone 2 Unlocker (updated).rar
Resource
win7-20220812-en
windows7-x64
9 signatures
1800 seconds
Behavioral task
behavioral2
Sample
Warzone 2 Unlocker (updated).rar
Resource
win10v2004-20220901-en
windows10-2004-x64
4 signatures
1800 seconds
General
-
Target
Warzone 2 Unlocker (updated).rar
-
Size
115KB
-
MD5
8f20239218de795b97a40a93d512930f
-
SHA1
743cfc4121455cccec7d62253502d1652899d50b
-
SHA256
44f20123cdb32da5d96178f98305a5a13185a2d3eede4af626ecaf97316af2c0
-
SHA512
f62c2617c6b7df1021d797af951094f892c5e23507ce1299ae01a18523cbdb343e258ce461e7b75c7441c6ac936f08ee01912257296cf6327cbdb6cca9fecf87
-
SSDEEP
1536:lgfwqmgfs6LR/OXjBwVXKOZIwz7NXzybuxdqUPM6HLQ6JM9SEZ391GNtFArLzHzZ:l/dgfs6LKdwVnIc1G6eMklj1G+LTcwJj
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 824 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 824 vlc.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 576 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 576 AUDIODG.EXE Token: 33 576 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 576 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 57 IoCs
pid Process 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe -
Suspicious use of SendNotifyMessage 56 IoCs
pid Process 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe 824 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 824 vlc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1404 wrote to memory of 1512 1404 cmd.exe 29 PID 1404 wrote to memory of 1512 1404 cmd.exe 29 PID 1404 wrote to memory of 1512 1404 cmd.exe 29 PID 1512 wrote to memory of 824 1512 rundll32.exe 30 PID 1512 wrote to memory of 824 1512 rundll32.exe 30 PID 1512 wrote to memory of 824 1512 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Warzone 2 Unlocker (updated).rar"1⤵
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Warzone 2 Unlocker (updated).rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Warzone 2 Unlocker (updated).rar"3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:824
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1572
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5541⤵
- Suspicious use of AdjustPrivilegeToken
PID:576