Overview
overview
9Static
static
7a/A.class
windows10-1703-x64
3a/B.class
windows10-1703-x64
3a/C.class
windows10-1703-x64
3a/D.class
windows10-1703-x64
3a/E.class
windows10-1703-x64
3a/F.class
windows10-1703-x64
3a/G.class
windows10-1703-x64
3a/H.class
windows10-1703-x64
3a/I.class
windows10-1703-x64
3a/J.class
windows10-1703-x64
3a/K.class
windows10-1703-x64
3a/L.class
windows10-1703-x64
3a/M.class
windows10-1703-x64
3a/N.class
windows10-1703-x64
3a/O.class
windows10-1703-x64
3a/P.class
windows10-1703-x64
3a/Q.class
windows10-1703-x64
3a/R.class
windows10-1703-x64
3a/S.class
windows10-1703-x64
3a/T.class
windows10-1703-x64
3a/U.class
windows10-1703-x64
3a/V.class
windows10-1703-x64
3a/W.class
windows10-1703-x64
3a/X.class
windows10-1703-x64
3a/Y.class
windows10-1703-x64
3vape lite/...er.exe
windows10-1703-x64
1vape lite/...oo.dll
windows10-1703-x64
1vape lite/...te.exe
windows10-1703-x64
9vape lite/...ver.py
windows10-1703-x64
3vape lite/...ll.bat
windows10-1703-x64
1vape lite/...un.bat
windows10-1703-x64
1vape lite/server.py
windows10-1703-x64
3Analysis
-
max time kernel
70s -
max time network
77s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
31-03-2023 16:07
Behavioral task
behavioral1
Sample
a/A.class
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
a/B.class
Resource
win10-20230220-en
Behavioral task
behavioral3
Sample
a/C.class
Resource
win10-20230220-en
Behavioral task
behavioral4
Sample
a/D.class
Resource
win10-20230220-en
Behavioral task
behavioral5
Sample
a/E.class
Resource
win10-20230220-en
Behavioral task
behavioral6
Sample
a/F.class
Resource
win10-20230220-en
Behavioral task
behavioral7
Sample
a/G.class
Resource
win10-20230220-en
Behavioral task
behavioral8
Sample
a/H.class
Resource
win10-20230220-en
Behavioral task
behavioral9
Sample
a/I.class
Resource
win10-20230220-en
Behavioral task
behavioral10
Sample
a/J.class
Resource
win10-20230220-en
Behavioral task
behavioral11
Sample
a/K.class
Resource
win10-20230220-en
Behavioral task
behavioral12
Sample
a/L.class
Resource
win10-20230220-en
Behavioral task
behavioral13
Sample
a/M.class
Resource
win10-20230220-en
Behavioral task
behavioral14
Sample
a/N.class
Resource
win10-20230220-en
Behavioral task
behavioral15
Sample
a/O.class
Resource
win10-20230220-en
Behavioral task
behavioral16
Sample
a/P.class
Resource
win10-20230220-en
Behavioral task
behavioral17
Sample
a/Q.class
Resource
win10-20230220-en
Behavioral task
behavioral18
Sample
a/R.class
Resource
win10-20230220-en
Behavioral task
behavioral19
Sample
a/S.class
Resource
win10-20230220-en
Behavioral task
behavioral20
Sample
a/T.class
Resource
win10-20230220-en
Behavioral task
behavioral21
Sample
a/U.class
Resource
win10-20230220-en
Behavioral task
behavioral22
Sample
a/V.class
Resource
win10-20230220-en
Behavioral task
behavioral23
Sample
a/W.class
Resource
win10-20230220-en
Behavioral task
behavioral24
Sample
a/X.class
Resource
win10-20230220-en
Behavioral task
behavioral25
Sample
a/Y.class
Resource
win10-20230220-en
Behavioral task
behavioral26
Sample
vape lite/Vape Lite/Kangaroo Patcher.exe
Resource
win10-20230220-en
Behavioral task
behavioral27
Sample
vape lite/Vape Lite/Kangaroo.dll
Resource
win10-20230220-en
Behavioral task
behavioral28
Sample
vape lite/Vape Lite/Vape_Lite.exe
Resource
win10-20230220-en
Behavioral task
behavioral29
Sample
vape lite/dumper/mitm_server.py
Resource
win10-20230220-en
Behavioral task
behavioral30
Sample
vape lite/requirements install.bat
Resource
win10-20230220-en
Behavioral task
behavioral31
Sample
vape lite/server run.bat
Resource
win10-20230220-en
Behavioral task
behavioral32
Sample
vape lite/server.py
Resource
win10-20230220-en
General
-
Target
a/Y.class
-
Size
8KB
-
MD5
720cf2a979954ef614b0c502927f15a8
-
SHA1
6eb3753905da4f67e1bb3e1325bb8e9aa834bf91
-
SHA256
c901708a380547e16260a21361d8174ba7934565e2a19f5a2bce2bc8bda9f61c
-
SHA512
d5dd872774942aadf030abbad9713bcd001cd5812af44f6a06e117fb6be9e833dd20f8d829f613370abaf1527dc1a7dcf8f4ad0a25450af3301a56736d5fd620
-
SSDEEP
192:ydYYeblP1antvUDzlg+UwAcMMzmP1DOsSTYBx2wiB:ydjWt1antvUDzO+sMmP1DOsUYBxYB
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 4348 OpenWith.exe