Overview
overview
9Static
static
7a/A.class
windows10-1703-x64
3a/B.class
windows10-1703-x64
3a/C.class
windows10-1703-x64
3a/D.class
windows10-1703-x64
3a/E.class
windows10-1703-x64
3a/F.class
windows10-1703-x64
3a/G.class
windows10-1703-x64
3a/H.class
windows10-1703-x64
3a/I.class
windows10-1703-x64
3a/J.class
windows10-1703-x64
3a/K.class
windows10-1703-x64
3a/L.class
windows10-1703-x64
3a/M.class
windows10-1703-x64
3a/N.class
windows10-1703-x64
3a/O.class
windows10-1703-x64
3a/P.class
windows10-1703-x64
3a/Q.class
windows10-1703-x64
3a/R.class
windows10-1703-x64
3a/S.class
windows10-1703-x64
3a/T.class
windows10-1703-x64
3a/U.class
windows10-1703-x64
3a/V.class
windows10-1703-x64
3a/W.class
windows10-1703-x64
3a/X.class
windows10-1703-x64
3a/Y.class
windows10-1703-x64
3vape lite/...er.exe
windows10-1703-x64
1vape lite/...oo.dll
windows10-1703-x64
1vape lite/...te.exe
windows10-1703-x64
9vape lite/...ver.py
windows10-1703-x64
3vape lite/...ll.bat
windows10-1703-x64
1vape lite/...un.bat
windows10-1703-x64
1vape lite/server.py
windows10-1703-x64
3Analysis
-
max time kernel
50s -
max time network
59s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
31-03-2023 16:07
Behavioral task
behavioral1
Sample
a/A.class
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
a/B.class
Resource
win10-20230220-en
Behavioral task
behavioral3
Sample
a/C.class
Resource
win10-20230220-en
Behavioral task
behavioral4
Sample
a/D.class
Resource
win10-20230220-en
Behavioral task
behavioral5
Sample
a/E.class
Resource
win10-20230220-en
Behavioral task
behavioral6
Sample
a/F.class
Resource
win10-20230220-en
Behavioral task
behavioral7
Sample
a/G.class
Resource
win10-20230220-en
Behavioral task
behavioral8
Sample
a/H.class
Resource
win10-20230220-en
Behavioral task
behavioral9
Sample
a/I.class
Resource
win10-20230220-en
Behavioral task
behavioral10
Sample
a/J.class
Resource
win10-20230220-en
Behavioral task
behavioral11
Sample
a/K.class
Resource
win10-20230220-en
Behavioral task
behavioral12
Sample
a/L.class
Resource
win10-20230220-en
Behavioral task
behavioral13
Sample
a/M.class
Resource
win10-20230220-en
Behavioral task
behavioral14
Sample
a/N.class
Resource
win10-20230220-en
Behavioral task
behavioral15
Sample
a/O.class
Resource
win10-20230220-en
Behavioral task
behavioral16
Sample
a/P.class
Resource
win10-20230220-en
Behavioral task
behavioral17
Sample
a/Q.class
Resource
win10-20230220-en
Behavioral task
behavioral18
Sample
a/R.class
Resource
win10-20230220-en
Behavioral task
behavioral19
Sample
a/S.class
Resource
win10-20230220-en
Behavioral task
behavioral20
Sample
a/T.class
Resource
win10-20230220-en
Behavioral task
behavioral21
Sample
a/U.class
Resource
win10-20230220-en
Behavioral task
behavioral22
Sample
a/V.class
Resource
win10-20230220-en
Behavioral task
behavioral23
Sample
a/W.class
Resource
win10-20230220-en
Behavioral task
behavioral24
Sample
a/X.class
Resource
win10-20230220-en
Behavioral task
behavioral25
Sample
a/Y.class
Resource
win10-20230220-en
Behavioral task
behavioral26
Sample
vape lite/Vape Lite/Kangaroo Patcher.exe
Resource
win10-20230220-en
Behavioral task
behavioral27
Sample
vape lite/Vape Lite/Kangaroo.dll
Resource
win10-20230220-en
Behavioral task
behavioral28
Sample
vape lite/Vape Lite/Vape_Lite.exe
Resource
win10-20230220-en
Behavioral task
behavioral29
Sample
vape lite/dumper/mitm_server.py
Resource
win10-20230220-en
Behavioral task
behavioral30
Sample
vape lite/requirements install.bat
Resource
win10-20230220-en
Behavioral task
behavioral31
Sample
vape lite/server run.bat
Resource
win10-20230220-en
Behavioral task
behavioral32
Sample
vape lite/server.py
Resource
win10-20230220-en
General
-
Target
a/W.class
-
Size
1KB
-
MD5
b598fb613cdf0302e0a14b8818fa8547
-
SHA1
229b28f3422463bc71d8580764ac1de3375888e5
-
SHA256
89cb3e7830dc8ef34dc3848f89e7450d9635656a62f4a8c004ede1db15ff526d
-
SHA512
aa220fd6c01383e3e524e824e33c0d14261dbcf122037b7cea0fda006bde2834b195bba3d0012c274b628c3d6130283034ab5cefcaef8a1ef4b3fdf359580444
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 1004 OpenWith.exe