Overview
overview
7Static
static
7Vape_V4.zip
windows7-x64
6Vape_V4.zip
windows10-2004-x64
1Vape V4/fi...sl.dll
windows7-x64
1Vape V4/fi...sl.dll
windows10-2004-x64
1Vape V4/fi...0u.dll
windows7-x64
1Vape V4/fi...0u.dll
windows10-2004-x64
1Vape V4/fi...64.dll
windows7-x64
1Vape V4/fi...64.dll
windows10-2004-x64
1Vape V4/fi...64.dll
windows7-x64
1Vape V4/fi...64.dll
windows10-2004-x64
1Vape V4/fi...64.dll
windows7-x64
1Vape V4/fi...64.dll
windows10-2004-x64
1Vape V4/fi...64.dll
windows7-x64
1Vape V4/fi...64.dll
windows10-2004-x64
1Vape V4/fi...ml.tpl
windows7-x64
3Vape V4/fi...ml.tpl
windows10-2004-x64
3Vape V4/fi...le.tpl
windows7-x64
3Vape V4/fi...le.tpl
windows10-2004-x64
3Vape V4/fi...le.tpl
windows7-x64
3Vape V4/fi...le.tpl
windows10-2004-x64
3Vape V4/fi...ex.tpl
windows7-x64
3Vape V4/fi...ex.tpl
windows10-2004-x64
3Vape V4/fi...le.tpl
windows7-x64
3Vape V4/fi...le.tpl
windows10-2004-x64
3Vape V4/fi...le.tpl
windows7-x64
3Vape V4/fi...le.tpl
windows10-2004-x64
3Vape V4/fi...TALLER
windows7-x64
1Vape V4/fi...TALLER
windows10-2004-x64
1Vape V4/fi...SE.txt
windows7-x64
1Vape V4/fi...SE.txt
windows10-2004-x64
1Vape V4/fi...TADATA
windows7-x64
1Vape V4/fi...TADATA
windows10-2004-x64
1Analysis
-
max time kernel
142s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2023 16:14
Behavioral task
behavioral1
Sample
Vape_V4.zip
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Vape_V4.zip
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
Vape V4/fix/cryptography/hazmat/bindings/_openssl.dll
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Vape V4/fix/cryptography/hazmat/bindings/_openssl.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
Vape V4/fix/mfc140u.dll
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
Vape V4/fix/mfc140u.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
Vape V4/fix/numpy/core/_multiarray_tests.cp38-win_amd64.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
Vape V4/fix/numpy/core/_multiarray_tests.cp38-win_amd64.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
Vape V4/fix/numpy/core/_multiarray_umath.cp38-win_amd64.dll
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
Vape V4/fix/numpy/core/_multiarray_umath.cp38-win_amd64.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral11
Sample
Vape V4/fix/numpy/fft/_pocketfft_internal.cp38-win_amd64.dll
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
Vape V4/fix/numpy/fft/_pocketfft_internal.cp38-win_amd64.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
Vape V4/fix/numpy/linalg/_umath_linalg.cp38-win_amd64.dll
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
Vape V4/fix/numpy/linalg/_umath_linalg.cp38-win_amd64.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
Vape V4/fix/pandas/io/formats/templates/html.tpl
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
Vape V4/fix/pandas/io/formats/templates/html.tpl
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
Vape V4/fix/pandas/io/formats/templates/html_style.tpl
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
Vape V4/fix/pandas/io/formats/templates/html_style.tpl
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
Vape V4/fix/pandas/io/formats/templates/html_table.tpl
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
Vape V4/fix/pandas/io/formats/templates/html_table.tpl
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
Vape V4/fix/pandas/io/formats/templates/latex.tpl
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
Vape V4/fix/pandas/io/formats/templates/latex.tpl
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
Vape V4/fix/pandas/io/formats/templates/latex_longtable.tpl
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
Vape V4/fix/pandas/io/formats/templates/latex_longtable.tpl
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
Vape V4/fix/pandas/io/formats/templates/latex_table.tpl
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
Vape V4/fix/pandas/io/formats/templates/latex_table.tpl
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
Vape V4/fix/pip-20.2.3.dist-info/INSTALLER
Resource
win7-20230220-en
Behavioral task
behavioral28
Sample
Vape V4/fix/pip-20.2.3.dist-info/INSTALLER
Resource
win10v2004-20230220-en
Behavioral task
behavioral29
Sample
Vape V4/fix/pip-20.2.3.dist-info/LICENSE.txt
Resource
win7-20230220-en
Behavioral task
behavioral30
Sample
Vape V4/fix/pip-20.2.3.dist-info/LICENSE.txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral31
Sample
Vape V4/fix/pip-20.2.3.dist-info/METADATA
Resource
win7-20230220-en
Behavioral task
behavioral32
Sample
Vape V4/fix/pip-20.2.3.dist-info/METADATA
Resource
win10v2004-20230220-en
General
-
Target
Vape V4/fix/pandas/io/formats/templates/latex_longtable.tpl
-
Size
2KB
-
MD5
c42cefcdeee5b1ece13c560d90ad64f1
-
SHA1
50b47777d8f75a43dcad5ef59f5480e02490ec6a
-
SHA256
3dd9c11b329f8a99358efde35f37004c4da3aa3c113d07f285634749fa863ff2
-
SHA512
362e0ea4e894225b4d61226cbc189bf6ede02587104a0decefefbd99137c93b12058fef207789c7eda2f8fe6eb5dbec67618697be1bd75d93d0a747728c6b77e
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 4148 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Vape V4\fix\pandas\io\formats\templates\latex_longtable.tpl"1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx