Overview
overview
9Static
static
7a/A.class
windows10-1703-x64
3a/B.class
windows10-1703-x64
3a/C.class
windows10-1703-x64
3a/D.class
windows10-1703-x64
3a/E.class
windows10-1703-x64
3a/F.class
windows10-1703-x64
3a/G.class
windows10-1703-x64
3a/H.class
windows10-1703-x64
3a/I.class
windows10-1703-x64
3a/J.class
windows10-1703-x64
3a/K.class
windows10-1703-x64
3a/L.class
windows10-1703-x64
3a/M.class
windows10-1703-x64
3a/N.class
windows10-1703-x64
3a/O.class
windows10-1703-x64
3a/P.class
windows10-1703-x64
3a/Q.class
windows10-1703-x64
3a/R.class
windows10-1703-x64
3a/S.class
windows10-1703-x64
3a/T.class
windows10-1703-x64
3a/U.class
windows10-1703-x64
3a/V.class
windows10-1703-x64
3a/W.class
windows10-1703-x64
3a/X.class
windows10-1703-x64
3a/Y.class
windows10-1703-x64
3vape lite/...er.exe
windows10-1703-x64
1vape lite/...oo.dll
windows10-1703-x64
1vape lite/...te.exe
windows10-1703-x64
9vape lite/...ver.py
windows10-1703-x64
3vape lite/...ll.bat
windows10-1703-x64
1vape lite/...un.bat
windows10-1703-x64
1vape lite/server.py
windows10-1703-x64
3Analysis
-
max time kernel
140s -
max time network
176s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
31-03-2023 16:07
Behavioral task
behavioral1
Sample
a/A.class
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
a/B.class
Resource
win10-20230220-en
Behavioral task
behavioral3
Sample
a/C.class
Resource
win10-20230220-en
Behavioral task
behavioral4
Sample
a/D.class
Resource
win10-20230220-en
Behavioral task
behavioral5
Sample
a/E.class
Resource
win10-20230220-en
Behavioral task
behavioral6
Sample
a/F.class
Resource
win10-20230220-en
Behavioral task
behavioral7
Sample
a/G.class
Resource
win10-20230220-en
Behavioral task
behavioral8
Sample
a/H.class
Resource
win10-20230220-en
Behavioral task
behavioral9
Sample
a/I.class
Resource
win10-20230220-en
Behavioral task
behavioral10
Sample
a/J.class
Resource
win10-20230220-en
Behavioral task
behavioral11
Sample
a/K.class
Resource
win10-20230220-en
Behavioral task
behavioral12
Sample
a/L.class
Resource
win10-20230220-en
Behavioral task
behavioral13
Sample
a/M.class
Resource
win10-20230220-en
Behavioral task
behavioral14
Sample
a/N.class
Resource
win10-20230220-en
Behavioral task
behavioral15
Sample
a/O.class
Resource
win10-20230220-en
Behavioral task
behavioral16
Sample
a/P.class
Resource
win10-20230220-en
Behavioral task
behavioral17
Sample
a/Q.class
Resource
win10-20230220-en
Behavioral task
behavioral18
Sample
a/R.class
Resource
win10-20230220-en
Behavioral task
behavioral19
Sample
a/S.class
Resource
win10-20230220-en
Behavioral task
behavioral20
Sample
a/T.class
Resource
win10-20230220-en
Behavioral task
behavioral21
Sample
a/U.class
Resource
win10-20230220-en
Behavioral task
behavioral22
Sample
a/V.class
Resource
win10-20230220-en
Behavioral task
behavioral23
Sample
a/W.class
Resource
win10-20230220-en
Behavioral task
behavioral24
Sample
a/X.class
Resource
win10-20230220-en
Behavioral task
behavioral25
Sample
a/Y.class
Resource
win10-20230220-en
Behavioral task
behavioral26
Sample
vape lite/Vape Lite/Kangaroo Patcher.exe
Resource
win10-20230220-en
Behavioral task
behavioral27
Sample
vape lite/Vape Lite/Kangaroo.dll
Resource
win10-20230220-en
Behavioral task
behavioral28
Sample
vape lite/Vape Lite/Vape_Lite.exe
Resource
win10-20230220-en
Behavioral task
behavioral29
Sample
vape lite/dumper/mitm_server.py
Resource
win10-20230220-en
Behavioral task
behavioral30
Sample
vape lite/requirements install.bat
Resource
win10-20230220-en
Behavioral task
behavioral31
Sample
vape lite/server run.bat
Resource
win10-20230220-en
Behavioral task
behavioral32
Sample
vape lite/server.py
Resource
win10-20230220-en
General
-
Target
a/T.class
-
Size
13KB
-
MD5
ee2936c22fcf4d2d6c79f72f9fbad776
-
SHA1
0d9b27caf08e1959a71088b2064e64fce11615b1
-
SHA256
96e3dc3c8c6a52d0fd134fbadb9eaa28b128a0d391778e38ee5be8dec4306082
-
SHA512
86d6a1c9f6aa3df9448240ce10209f30af15e890758f1fc5c0615227691ff67488cbacf0ac6a6bab40bdc627959230c5bcbe46f9fccdbdc5ae34ed6105664ef1
-
SSDEEP
192:ReyKPmxzPN4PK3/FgQN0uJylCkx2S8FSTLm7v2SiEZ2ztXGnvnHE2CXXdjui:RjzPNAKeQN0uEwFSXmhG2nvnHQXX8i
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 4548 OpenWith.exe