Overview
overview
10Static
static
1Victoria537.zip
windows7-x64
Victoria537.zip
windows10-2004-x64
1Victoria53...mo.rtf
windows7-x64
4Victoria53...mo.rtf
windows10-2004-x64
1Victoria53...lp.rtf
windows7-x64
4Victoria53...lp.rtf
windows10-2004-x64
1Victoria53...ew.rtf
windows7-x64
4Victoria53...ew.rtf
windows10-2004-x64
1Victoria53...mo.rtf
windows7-x64
4Victoria53...mo.rtf
windows10-2004-x64
1Victoria53...lp.rtf
windows7-x64
4Victoria53...lp.rtf
windows10-2004-x64
1Victoria53...ew.rtf
windows7-x64
4Victoria53...ew.rtf
windows10-2004-x64
10Victoria53...mo.rtf
windows7-x64
4Victoria53...mo.rtf
windows10-2004-x64
1Victoria53...lp.rtf
windows7-x64
4Victoria53...lp.rtf
windows10-2004-x64
1Victoria53...ew.rtf
windows7-x64
4Victoria53...ew.rtf
windows10-2004-x64
1Victoria53...sh.lng
windows7-x64
3Victoria53...sh.lng
windows10-2004-x64
3Victoria53...ol.lng
windows7-x64
3Victoria53...ol.lng
windows10-2004-x64
3Victoria53...ne.lng
windows7-x64
3Victoria53...ne.lng
windows10-2004-x64
3Victoria53...й.lng
windows7-x64
3Victoria53...й.lng
windows10-2004-x64
3Victoria53...st.rtf
windows7-x64
4Victoria53...st.rtf
windows10-2004-x64
1Victoria53...ia.exe
windows7-x64
6Victoria53...ia.exe
windows10-2004-x64
6Analysis
-
max time kernel
301s -
max time network
266s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-es -
resource tags
arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
27-03-2023 16:15
Static task
static1
Behavioral task
behavioral1
Sample
Victoria537.zip
Resource
win7-20230220-es
Behavioral task
behavioral2
Sample
Victoria537.zip
Resource
win10v2004-20230220-es
Behavioral task
behavioral3
Sample
Victoria537/Help/English/dcomemo.rtf
Resource
win7-20230220-es
Behavioral task
behavioral4
Sample
Victoria537/Help/English/dcomemo.rtf
Resource
win10v2004-20230221-es
Behavioral task
behavioral5
Sample
Victoria537/Help/English/vichlp.rtf
Resource
win7-20230220-es
Behavioral task
behavioral6
Sample
Victoria537/Help/English/vichlp.rtf
Resource
win10v2004-20230220-es
Behavioral task
behavioral7
Sample
Victoria537/Help/English/whatsnew.rtf
Resource
win7-20230220-es
Behavioral task
behavioral8
Sample
Victoria537/Help/English/whatsnew.rtf
Resource
win10v2004-20230221-es
Behavioral task
behavioral9
Sample
Victoria537/Help/Ukraine/dcomemo.rtf
Resource
win7-20230220-es
Behavioral task
behavioral10
Sample
Victoria537/Help/Ukraine/dcomemo.rtf
Resource
win10v2004-20230220-es
Behavioral task
behavioral11
Sample
Victoria537/Help/Ukraine/vichlp.rtf
Resource
win7-20230220-es
Behavioral task
behavioral12
Sample
Victoria537/Help/Ukraine/vichlp.rtf
Resource
win10v2004-20230220-es
Behavioral task
behavioral13
Sample
Victoria537/Help/Ukraine/whatsnew.rtf
Resource
win7-20230220-es
Behavioral task
behavioral14
Sample
Victoria537/Help/Ukraine/whatsnew.rtf
Resource
win10v2004-20230220-es
Behavioral task
behavioral15
Sample
Victoria537/Help/Русский/dcomemo.rtf
Resource
win7-20230220-es
Behavioral task
behavioral16
Sample
Victoria537/Help/Русский/dcomemo.rtf
Resource
win10v2004-20230221-es
Behavioral task
behavioral17
Sample
Victoria537/Help/Русский/vichlp.rtf
Resource
win7-20230220-es
Behavioral task
behavioral18
Sample
Victoria537/Help/Русский/vichlp.rtf
Resource
win10v2004-20230220-es
Behavioral task
behavioral19
Sample
Victoria537/Help/Русский/whatsnew.rtf
Resource
win7-20230220-es
Behavioral task
behavioral20
Sample
Victoria537/Help/Русский/whatsnew.rtf
Resource
win10v2004-20230220-es
Behavioral task
behavioral21
Sample
Victoria537/LNG/English.lng
Resource
win7-20230220-es
Behavioral task
behavioral22
Sample
Victoria537/LNG/English.lng
Resource
win10v2004-20230220-es
Behavioral task
behavioral23
Sample
Victoria537/LNG/Español.lng
Resource
win7-20230220-es
Behavioral task
behavioral24
Sample
Victoria537/LNG/Español.lng
Resource
win10v2004-20230220-es
Behavioral task
behavioral25
Sample
Victoria537/LNG/Ukraine.lng
Resource
win7-20230220-es
Behavioral task
behavioral26
Sample
Victoria537/LNG/Ukraine.lng
Resource
win10v2004-20230220-es
Behavioral task
behavioral27
Sample
Victoria537/LNG/Русский.lng
Resource
win7-20230220-es
Behavioral task
behavioral28
Sample
Victoria537/LNG/Русский.lng
Resource
win10v2004-20230221-es
Behavioral task
behavioral29
Sample
Victoria537/USB_SupportList.rtf
Resource
win7-20230220-es
Behavioral task
behavioral30
Sample
Victoria537/USB_SupportList.rtf
Resource
win10v2004-20230220-es
Behavioral task
behavioral31
Sample
Victoria537/Victoria.exe
Resource
win7-20230220-es
Behavioral task
behavioral32
Sample
Victoria537/Victoria.exe
Resource
win10v2004-20230220-es
General
-
Target
Victoria537/Victoria.exe
-
Size
3.1MB
-
MD5
613a1546bc8f67a554d2ae2b3a0873a6
-
SHA1
acd2f871df9048e40032a6b082b5545537c313d9
-
SHA256
fba0b7d5c042f0a13fd5b875f6f13989038ca188d6de6f505ed52bc85ac0de48
-
SHA512
802855c9ca71b6502cf7529136e3bf67f3829e1283b67ca36e4f7e863e55c499ef8379384b13053399ab162ae7a601a906503db7a5b3bd09860d1213915dca31
-
SSDEEP
49152:SxKLuTiHzQ6oSipy03foa6TvNn4WhFbUToml/2QWP1e3n2wkJOs5Kg5GTV8MWGo:SxK6THDS+WhSH4vP5g8MWG
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Victoria.exedescription ioc process File opened (read-only) \??\D: Victoria.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
Victoria.exedescription ioc process File opened for modification \??\PhysicalDrive0 Victoria.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Victoria.exepid process 4288 Victoria.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Victoria.exedescription pid process Token: SeIncBasePriorityPrivilege 4288 Victoria.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Victoria.exepid process 4288 Victoria.exe 4288 Victoria.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Victoria.exepid process 4288 Victoria.exe 4288 Victoria.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Victoria537\Victoria.exe"C:\Users\Admin\AppData\Local\Temp\Victoria537\Victoria.exe"1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4288-133-0x00000000147A0000-0x00000000147A1000-memory.dmpFilesize
4KB
-
memory/4288-134-0x0000000016180000-0x0000000016181000-memory.dmpFilesize
4KB
-
memory/4288-143-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/4288-144-0x00000000147A0000-0x00000000147A1000-memory.dmpFilesize
4KB
-
memory/4288-145-0x0000000016180000-0x0000000016181000-memory.dmpFilesize
4KB
-
memory/4288-147-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB