Analysis

  • max time kernel
    140s
  • max time network
    30s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    21-03-2023 23:12

General

  • Target

    APT 37 Previous Commits 1/2022.04.27.rar

  • Size

    34KB

  • MD5

    9d85c8378b5f1edefb1e9837b3abb74f

  • SHA1

    260aa9a8dd981f3e9b4372275e7b9a6cb5fb9b40

  • SHA256

    360512254b342558d8f17305b673b75c7d7986f12aae2f602952298cacf5d238

  • SHA512

    d3491f75d1f8d09a6aacbde5b9035b23c7aa2e8c73e38b9445a91f58b419a3015e4a7d2fe06488193fe831c419ca04564404fef993c2499dff18ad444037cdbe

  • SSDEEP

    768:VfONuc4JWVJrzPWGnXJoMU83dg2HErxGDtU7Vy1j7I6iVGtNP:lTkDrb5d9Ng2o8tB66oup

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\APT 37 Previous Commits 1\2022.04.27.rar"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\APT 37 Previous Commits 1\2022.04.27.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:520
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\APT 37 Previous Commits 1\2022.04.27.rar"
        3⤵
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:976

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/976-83-0x000000013F460000-0x000000013F558000-memory.dmp
    Filesize

    992KB

  • memory/976-84-0x000007FEFB620000-0x000007FEFB654000-memory.dmp
    Filesize

    208KB

  • memory/976-85-0x000007FEF6C30000-0x000007FEF6EE4000-memory.dmp
    Filesize

    2.7MB

  • memory/976-86-0x000007FEFBBD0000-0x000007FEFBBE8000-memory.dmp
    Filesize

    96KB

  • memory/976-87-0x000007FEFB570000-0x000007FEFB587000-memory.dmp
    Filesize

    92KB

  • memory/976-88-0x000007FEFB550000-0x000007FEFB561000-memory.dmp
    Filesize

    68KB

  • memory/976-89-0x000007FEFB330000-0x000007FEFB347000-memory.dmp
    Filesize

    92KB

  • memory/976-90-0x000007FEFB310000-0x000007FEFB321000-memory.dmp
    Filesize

    68KB

  • memory/976-91-0x000007FEFB2F0000-0x000007FEFB30D000-memory.dmp
    Filesize

    116KB

  • memory/976-92-0x000007FEFB000000-0x000007FEFB011000-memory.dmp
    Filesize

    68KB

  • memory/976-93-0x000007FEF5B00000-0x000007FEF6BAB000-memory.dmp
    Filesize

    16.7MB

  • memory/976-94-0x000007FEF5900000-0x000007FEF5B00000-memory.dmp
    Filesize

    2.0MB

  • memory/976-102-0x000007FEF7060000-0x000007FEF7071000-memory.dmp
    Filesize

    68KB

  • memory/976-107-0x000007FEF6C10000-0x000007FEF6C21000-memory.dmp
    Filesize

    68KB

  • memory/976-106-0x000007FEF5820000-0x000007FEF588F000-memory.dmp
    Filesize

    444KB

  • memory/976-105-0x000007FEF5890000-0x000007FEF58F7000-memory.dmp
    Filesize

    412KB

  • memory/976-108-0x000007FEF57C0000-0x000007FEF5816000-memory.dmp
    Filesize

    344KB

  • memory/976-104-0x000007FEF7010000-0x000007FEF7040000-memory.dmp
    Filesize

    192KB

  • memory/976-103-0x000007FEF7040000-0x000007FEF7058000-memory.dmp
    Filesize

    96KB

  • memory/976-109-0x000007FEF5790000-0x000007FEF57B8000-memory.dmp
    Filesize

    160KB

  • memory/976-112-0x000007FEF5730000-0x000007FEF5753000-memory.dmp
    Filesize

    140KB

  • memory/976-116-0x000007FEF56A0000-0x000007FEF56B3000-memory.dmp
    Filesize

    76KB

  • memory/976-119-0x000007FEF5510000-0x000007FEF553C000-memory.dmp
    Filesize

    176KB

  • memory/976-121-0x000007FEF52F0000-0x000007FEF534C000-memory.dmp
    Filesize

    368KB

  • memory/976-120-0x000007FEF5350000-0x000007FEF5502000-memory.dmp
    Filesize

    1.7MB

  • memory/976-123-0x000007FEF5230000-0x000007FEF52C7000-memory.dmp
    Filesize

    604KB

  • memory/976-124-0x000007FEF5210000-0x000007FEF5222000-memory.dmp
    Filesize

    72KB

  • memory/976-125-0x000007FEF4FD0000-0x000007FEF5201000-memory.dmp
    Filesize

    2.2MB

  • memory/976-129-0x000007FEF4E00000-0x000007FEF4E11000-memory.dmp
    Filesize

    68KB

  • memory/976-130-0x000007FEF4D90000-0x000007FEF4DF1000-memory.dmp
    Filesize

    388KB

  • memory/976-132-0x000007FEF4C80000-0x000007FEF4C92000-memory.dmp
    Filesize

    72KB

  • memory/976-131-0x000007FEF4CA0000-0x000007FEF4CB1000-memory.dmp
    Filesize

    68KB

  • memory/976-128-0x000007FEF4E20000-0x000007FEF4E45000-memory.dmp
    Filesize

    148KB

  • memory/976-127-0x000007FEF4E50000-0x000007FEF4E85000-memory.dmp
    Filesize

    212KB

  • memory/976-126-0x000007FEF4EB0000-0x000007FEF4FC2000-memory.dmp
    Filesize

    1.1MB

  • memory/976-133-0x000007FEF4C60000-0x000007FEF4C73000-memory.dmp
    Filesize

    76KB

  • memory/976-136-0x000007FEF4A90000-0x000007FEF4B92000-memory.dmp
    Filesize

    1.0MB

  • memory/976-137-0x000007FEF4A70000-0x000007FEF4A81000-memory.dmp
    Filesize

    68KB

  • memory/976-135-0x000007FEF4BA0000-0x000007FEF4BB1000-memory.dmp
    Filesize

    68KB

  • memory/976-140-0x000007FEF4970000-0x000007FEF4982000-memory.dmp
    Filesize

    72KB

  • memory/976-139-0x000007FEF4A30000-0x000007FEF4A41000-memory.dmp
    Filesize

    68KB

  • memory/976-138-0x000007FEF4A50000-0x000007FEF4A61000-memory.dmp
    Filesize

    68KB

  • memory/976-141-0x000007FEF4950000-0x000007FEF4968000-memory.dmp
    Filesize

    96KB

  • memory/976-134-0x000007FEF4BC0000-0x000007FEF4C5F000-memory.dmp
    Filesize

    636KB

  • memory/976-142-0x000007FEF4930000-0x000007FEF4946000-memory.dmp
    Filesize

    88KB

  • memory/976-122-0x000007FEF52D0000-0x000007FEF52E1000-memory.dmp
    Filesize

    68KB

  • memory/976-118-0x000007FEF5540000-0x000007FEF567B000-memory.dmp
    Filesize

    1.2MB

  • memory/976-117-0x000007FEF5680000-0x000007FEF5692000-memory.dmp
    Filesize

    72KB

  • memory/976-143-0x000007FEF4900000-0x000007FEF4929000-memory.dmp
    Filesize

    164KB

  • memory/976-115-0x000007FEF56C0000-0x000007FEF56E1000-memory.dmp
    Filesize

    132KB

  • memory/976-146-0x000007FEF48A0000-0x000007FEF48B1000-memory.dmp
    Filesize

    68KB

  • memory/976-145-0x000007FEF48C0000-0x000007FEF48D1000-memory.dmp
    Filesize

    68KB

  • memory/976-144-0x000007FEF48E0000-0x000007FEF48F2000-memory.dmp
    Filesize

    72KB

  • memory/976-114-0x000007FEF56F0000-0x000007FEF5702000-memory.dmp
    Filesize

    72KB

  • memory/976-113-0x000007FEF5710000-0x000007FEF5721000-memory.dmp
    Filesize

    68KB

  • memory/976-111-0x000007FEF6BF0000-0x000007FEF6C07000-memory.dmp
    Filesize

    92KB

  • memory/976-110-0x000007FEF5760000-0x000007FEF5784000-memory.dmp
    Filesize

    144KB

  • memory/976-101-0x000007FEF7080000-0x000007FEF709B000-memory.dmp
    Filesize

    108KB

  • memory/976-100-0x000007FEF7640000-0x000007FEF7651000-memory.dmp
    Filesize

    68KB

  • memory/976-99-0x000007FEF7660000-0x000007FEF7671000-memory.dmp
    Filesize

    68KB

  • memory/976-98-0x000007FEF7680000-0x000007FEF7691000-memory.dmp
    Filesize

    68KB

  • memory/976-97-0x000007FEFAF70000-0x000007FEFAF88000-memory.dmp
    Filesize

    96KB

  • memory/976-96-0x000007FEFAF90000-0x000007FEFAFB1000-memory.dmp
    Filesize

    132KB

  • memory/976-95-0x000007FEFAFC0000-0x000007FEFAFFF000-memory.dmp
    Filesize

    252KB