Overview
overview
7Static
static
7Vape_V4.zip
windows7-x64
6Vape_V4.zip
windows10-2004-x64
1Vape V4/fi...sl.dll
windows7-x64
1Vape V4/fi...sl.dll
windows10-2004-x64
1Vape V4/fi...0u.dll
windows7-x64
1Vape V4/fi...0u.dll
windows10-2004-x64
1Vape V4/fi...64.dll
windows7-x64
1Vape V4/fi...64.dll
windows10-2004-x64
1Vape V4/fi...64.dll
windows7-x64
1Vape V4/fi...64.dll
windows10-2004-x64
1Vape V4/fi...64.dll
windows7-x64
1Vape V4/fi...64.dll
windows10-2004-x64
1Vape V4/fi...64.dll
windows7-x64
1Vape V4/fi...64.dll
windows10-2004-x64
1Vape V4/fi...ml.tpl
windows7-x64
3Vape V4/fi...ml.tpl
windows10-2004-x64
3Vape V4/fi...le.tpl
windows7-x64
3Vape V4/fi...le.tpl
windows10-2004-x64
3Vape V4/fi...le.tpl
windows7-x64
3Vape V4/fi...le.tpl
windows10-2004-x64
3Vape V4/fi...ex.tpl
windows7-x64
3Vape V4/fi...ex.tpl
windows10-2004-x64
3Vape V4/fi...le.tpl
windows7-x64
3Vape V4/fi...le.tpl
windows10-2004-x64
3Vape V4/fi...le.tpl
windows7-x64
3Vape V4/fi...le.tpl
windows10-2004-x64
3Vape V4/fi...TALLER
windows7-x64
1Vape V4/fi...TALLER
windows10-2004-x64
1Vape V4/fi...SE.txt
windows7-x64
1Vape V4/fi...SE.txt
windows10-2004-x64
1Vape V4/fi...TADATA
windows7-x64
1Vape V4/fi...TADATA
windows10-2004-x64
1Analysis
-
max time kernel
138s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2023 16:14
Behavioral task
behavioral1
Sample
Vape_V4.zip
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Vape_V4.zip
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
Vape V4/fix/cryptography/hazmat/bindings/_openssl.dll
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Vape V4/fix/cryptography/hazmat/bindings/_openssl.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
Vape V4/fix/mfc140u.dll
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
Vape V4/fix/mfc140u.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
Vape V4/fix/numpy/core/_multiarray_tests.cp38-win_amd64.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
Vape V4/fix/numpy/core/_multiarray_tests.cp38-win_amd64.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
Vape V4/fix/numpy/core/_multiarray_umath.cp38-win_amd64.dll
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
Vape V4/fix/numpy/core/_multiarray_umath.cp38-win_amd64.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral11
Sample
Vape V4/fix/numpy/fft/_pocketfft_internal.cp38-win_amd64.dll
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
Vape V4/fix/numpy/fft/_pocketfft_internal.cp38-win_amd64.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
Vape V4/fix/numpy/linalg/_umath_linalg.cp38-win_amd64.dll
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
Vape V4/fix/numpy/linalg/_umath_linalg.cp38-win_amd64.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
Vape V4/fix/pandas/io/formats/templates/html.tpl
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
Vape V4/fix/pandas/io/formats/templates/html.tpl
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
Vape V4/fix/pandas/io/formats/templates/html_style.tpl
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
Vape V4/fix/pandas/io/formats/templates/html_style.tpl
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
Vape V4/fix/pandas/io/formats/templates/html_table.tpl
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
Vape V4/fix/pandas/io/formats/templates/html_table.tpl
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
Vape V4/fix/pandas/io/formats/templates/latex.tpl
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
Vape V4/fix/pandas/io/formats/templates/latex.tpl
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
Vape V4/fix/pandas/io/formats/templates/latex_longtable.tpl
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
Vape V4/fix/pandas/io/formats/templates/latex_longtable.tpl
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
Vape V4/fix/pandas/io/formats/templates/latex_table.tpl
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
Vape V4/fix/pandas/io/formats/templates/latex_table.tpl
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
Vape V4/fix/pip-20.2.3.dist-info/INSTALLER
Resource
win7-20230220-en
Behavioral task
behavioral28
Sample
Vape V4/fix/pip-20.2.3.dist-info/INSTALLER
Resource
win10v2004-20230220-en
Behavioral task
behavioral29
Sample
Vape V4/fix/pip-20.2.3.dist-info/LICENSE.txt
Resource
win7-20230220-en
Behavioral task
behavioral30
Sample
Vape V4/fix/pip-20.2.3.dist-info/LICENSE.txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral31
Sample
Vape V4/fix/pip-20.2.3.dist-info/METADATA
Resource
win7-20230220-en
Behavioral task
behavioral32
Sample
Vape V4/fix/pip-20.2.3.dist-info/METADATA
Resource
win10v2004-20230220-en
General
-
Target
Vape V4/fix/pandas/io/formats/templates/html.tpl
-
Size
428B
-
MD5
91745eab0ffd42bf7b601420f9c6a1f6
-
SHA1
57480cd65757f8d341c92880761784d8e0eef507
-
SHA256
79b00950bcfcb6de1e48ac9f1597f6906dfe5fe8671e320830ae034feda0f541
-
SHA512
6a9b8de0395cd62f44bab4a1c36fdd33d0cc28347c9829eb0955887efcf278e721b2fc5e72a5dbe66750f8bfc98da9d9693014f2a6feebfac41a6301a3d34ecf
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 2932 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Vape V4\fix\pandas\io\formats\templates\html.tpl"1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx