Overview
overview
10Static
static
1Victoria537.zip
windows7-x64
Victoria537.zip
windows10-2004-x64
1Victoria53...mo.rtf
windows7-x64
4Victoria53...mo.rtf
windows10-2004-x64
1Victoria53...lp.rtf
windows7-x64
4Victoria53...lp.rtf
windows10-2004-x64
1Victoria53...ew.rtf
windows7-x64
4Victoria53...ew.rtf
windows10-2004-x64
1Victoria53...mo.rtf
windows7-x64
4Victoria53...mo.rtf
windows10-2004-x64
1Victoria53...lp.rtf
windows7-x64
4Victoria53...lp.rtf
windows10-2004-x64
1Victoria53...ew.rtf
windows7-x64
4Victoria53...ew.rtf
windows10-2004-x64
10Victoria53...mo.rtf
windows7-x64
4Victoria53...mo.rtf
windows10-2004-x64
1Victoria53...lp.rtf
windows7-x64
4Victoria53...lp.rtf
windows10-2004-x64
1Victoria53...ew.rtf
windows7-x64
4Victoria53...ew.rtf
windows10-2004-x64
1Victoria53...sh.lng
windows7-x64
3Victoria53...sh.lng
windows10-2004-x64
3Victoria53...ol.lng
windows7-x64
3Victoria53...ol.lng
windows10-2004-x64
3Victoria53...ne.lng
windows7-x64
3Victoria53...ne.lng
windows10-2004-x64
3Victoria53...й.lng
windows7-x64
3Victoria53...й.lng
windows10-2004-x64
3Victoria53...st.rtf
windows7-x64
4Victoria53...st.rtf
windows10-2004-x64
1Victoria53...ia.exe
windows7-x64
6Victoria53...ia.exe
windows10-2004-x64
6Analysis
-
max time kernel
93s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20230220-es -
resource tags
arch:x64arch:x86image:win7-20230220-eslocale:es-esos:windows7-x64systemwindows -
submitted
27-03-2023 16:15
Static task
static1
Behavioral task
behavioral1
Sample
Victoria537.zip
Resource
win7-20230220-es
Behavioral task
behavioral2
Sample
Victoria537.zip
Resource
win10v2004-20230220-es
Behavioral task
behavioral3
Sample
Victoria537/Help/English/dcomemo.rtf
Resource
win7-20230220-es
Behavioral task
behavioral4
Sample
Victoria537/Help/English/dcomemo.rtf
Resource
win10v2004-20230221-es
Behavioral task
behavioral5
Sample
Victoria537/Help/English/vichlp.rtf
Resource
win7-20230220-es
Behavioral task
behavioral6
Sample
Victoria537/Help/English/vichlp.rtf
Resource
win10v2004-20230220-es
Behavioral task
behavioral7
Sample
Victoria537/Help/English/whatsnew.rtf
Resource
win7-20230220-es
Behavioral task
behavioral8
Sample
Victoria537/Help/English/whatsnew.rtf
Resource
win10v2004-20230221-es
Behavioral task
behavioral9
Sample
Victoria537/Help/Ukraine/dcomemo.rtf
Resource
win7-20230220-es
Behavioral task
behavioral10
Sample
Victoria537/Help/Ukraine/dcomemo.rtf
Resource
win10v2004-20230220-es
Behavioral task
behavioral11
Sample
Victoria537/Help/Ukraine/vichlp.rtf
Resource
win7-20230220-es
Behavioral task
behavioral12
Sample
Victoria537/Help/Ukraine/vichlp.rtf
Resource
win10v2004-20230220-es
Behavioral task
behavioral13
Sample
Victoria537/Help/Ukraine/whatsnew.rtf
Resource
win7-20230220-es
Behavioral task
behavioral14
Sample
Victoria537/Help/Ukraine/whatsnew.rtf
Resource
win10v2004-20230220-es
Behavioral task
behavioral15
Sample
Victoria537/Help/Русский/dcomemo.rtf
Resource
win7-20230220-es
Behavioral task
behavioral16
Sample
Victoria537/Help/Русский/dcomemo.rtf
Resource
win10v2004-20230221-es
Behavioral task
behavioral17
Sample
Victoria537/Help/Русский/vichlp.rtf
Resource
win7-20230220-es
Behavioral task
behavioral18
Sample
Victoria537/Help/Русский/vichlp.rtf
Resource
win10v2004-20230220-es
Behavioral task
behavioral19
Sample
Victoria537/Help/Русский/whatsnew.rtf
Resource
win7-20230220-es
Behavioral task
behavioral20
Sample
Victoria537/Help/Русский/whatsnew.rtf
Resource
win10v2004-20230220-es
Behavioral task
behavioral21
Sample
Victoria537/LNG/English.lng
Resource
win7-20230220-es
Behavioral task
behavioral22
Sample
Victoria537/LNG/English.lng
Resource
win10v2004-20230220-es
Behavioral task
behavioral23
Sample
Victoria537/LNG/Español.lng
Resource
win7-20230220-es
Behavioral task
behavioral24
Sample
Victoria537/LNG/Español.lng
Resource
win10v2004-20230220-es
Behavioral task
behavioral25
Sample
Victoria537/LNG/Ukraine.lng
Resource
win7-20230220-es
Behavioral task
behavioral26
Sample
Victoria537/LNG/Ukraine.lng
Resource
win10v2004-20230220-es
Behavioral task
behavioral27
Sample
Victoria537/LNG/Русский.lng
Resource
win7-20230220-es
Behavioral task
behavioral28
Sample
Victoria537/LNG/Русский.lng
Resource
win10v2004-20230221-es
Behavioral task
behavioral29
Sample
Victoria537/USB_SupportList.rtf
Resource
win7-20230220-es
Behavioral task
behavioral30
Sample
Victoria537/USB_SupportList.rtf
Resource
win10v2004-20230220-es
Behavioral task
behavioral31
Sample
Victoria537/Victoria.exe
Resource
win7-20230220-es
Behavioral task
behavioral32
Sample
Victoria537/Victoria.exe
Resource
win10v2004-20230220-es
General
-
Target
Victoria537/LNG/English.lng
-
Size
37KB
-
MD5
1fc68fd20e3e589d8f9deb05279620b7
-
SHA1
9cf0a22e1921ee54b2492ebb56ee184817517c23
-
SHA256
0969ada3e06388b76778cf92287bd3f4fea90455c99c95682a33e96411ac9abc
-
SHA512
ab9d320b0ca83f98525a104ef476c14600b4ca8f95c147f4524eae70e39a3df4f4cf83ee2e228040727fa0e7d644340da830fc7cf68573ac24a6706c9d1980e5
-
SSDEEP
768:xhJi3x89Dbnk6/bplfotTIOj8fi/ympY89qxUGibL/RQ5QQmzCLTgrA4yyO2oVch:xhEh89DplUjBz/GSzq8bPOpVhMlKvY
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
rundll32.exepid process 1716 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 1604 wrote to memory of 1716 1604 cmd.exe rundll32.exe PID 1604 wrote to memory of 1716 1604 cmd.exe rundll32.exe PID 1604 wrote to memory of 1716 1604 cmd.exe rundll32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Victoria537\LNG\English.lng1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Victoria537\LNG\English.lng2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam