Overview
overview
9Static
static
7a/A.class
windows10-1703-x64
3a/B.class
windows10-1703-x64
3a/C.class
windows10-1703-x64
3a/D.class
windows10-1703-x64
3a/E.class
windows10-1703-x64
3a/F.class
windows10-1703-x64
3a/G.class
windows10-1703-x64
3a/H.class
windows10-1703-x64
3a/I.class
windows10-1703-x64
3a/J.class
windows10-1703-x64
3a/K.class
windows10-1703-x64
3a/L.class
windows10-1703-x64
3a/M.class
windows10-1703-x64
3a/N.class
windows10-1703-x64
3a/O.class
windows10-1703-x64
3a/P.class
windows10-1703-x64
3a/Q.class
windows10-1703-x64
3a/R.class
windows10-1703-x64
3a/S.class
windows10-1703-x64
3a/T.class
windows10-1703-x64
3a/U.class
windows10-1703-x64
3a/V.class
windows10-1703-x64
3a/W.class
windows10-1703-x64
3a/X.class
windows10-1703-x64
3a/Y.class
windows10-1703-x64
3vape lite/...er.exe
windows10-1703-x64
1vape lite/...oo.dll
windows10-1703-x64
1vape lite/...te.exe
windows10-1703-x64
9vape lite/...ver.py
windows10-1703-x64
3vape lite/...ll.bat
windows10-1703-x64
1vape lite/...un.bat
windows10-1703-x64
1vape lite/server.py
windows10-1703-x64
3Analysis
-
max time kernel
97s -
max time network
68s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
31-03-2023 16:07
Behavioral task
behavioral1
Sample
a/A.class
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
a/B.class
Resource
win10-20230220-en
Behavioral task
behavioral3
Sample
a/C.class
Resource
win10-20230220-en
Behavioral task
behavioral4
Sample
a/D.class
Resource
win10-20230220-en
Behavioral task
behavioral5
Sample
a/E.class
Resource
win10-20230220-en
Behavioral task
behavioral6
Sample
a/F.class
Resource
win10-20230220-en
Behavioral task
behavioral7
Sample
a/G.class
Resource
win10-20230220-en
Behavioral task
behavioral8
Sample
a/H.class
Resource
win10-20230220-en
Behavioral task
behavioral9
Sample
a/I.class
Resource
win10-20230220-en
Behavioral task
behavioral10
Sample
a/J.class
Resource
win10-20230220-en
Behavioral task
behavioral11
Sample
a/K.class
Resource
win10-20230220-en
Behavioral task
behavioral12
Sample
a/L.class
Resource
win10-20230220-en
Behavioral task
behavioral13
Sample
a/M.class
Resource
win10-20230220-en
Behavioral task
behavioral14
Sample
a/N.class
Resource
win10-20230220-en
Behavioral task
behavioral15
Sample
a/O.class
Resource
win10-20230220-en
Behavioral task
behavioral16
Sample
a/P.class
Resource
win10-20230220-en
Behavioral task
behavioral17
Sample
a/Q.class
Resource
win10-20230220-en
Behavioral task
behavioral18
Sample
a/R.class
Resource
win10-20230220-en
Behavioral task
behavioral19
Sample
a/S.class
Resource
win10-20230220-en
Behavioral task
behavioral20
Sample
a/T.class
Resource
win10-20230220-en
Behavioral task
behavioral21
Sample
a/U.class
Resource
win10-20230220-en
Behavioral task
behavioral22
Sample
a/V.class
Resource
win10-20230220-en
Behavioral task
behavioral23
Sample
a/W.class
Resource
win10-20230220-en
Behavioral task
behavioral24
Sample
a/X.class
Resource
win10-20230220-en
Behavioral task
behavioral25
Sample
a/Y.class
Resource
win10-20230220-en
Behavioral task
behavioral26
Sample
vape lite/Vape Lite/Kangaroo Patcher.exe
Resource
win10-20230220-en
Behavioral task
behavioral27
Sample
vape lite/Vape Lite/Kangaroo.dll
Resource
win10-20230220-en
Behavioral task
behavioral28
Sample
vape lite/Vape Lite/Vape_Lite.exe
Resource
win10-20230220-en
Behavioral task
behavioral29
Sample
vape lite/dumper/mitm_server.py
Resource
win10-20230220-en
Behavioral task
behavioral30
Sample
vape lite/requirements install.bat
Resource
win10-20230220-en
Behavioral task
behavioral31
Sample
vape lite/server run.bat
Resource
win10-20230220-en
Behavioral task
behavioral32
Sample
vape lite/server.py
Resource
win10-20230220-en
General
-
Target
vape lite/dumper/mitm_server.py
-
Size
4KB
-
MD5
fb2ea3294517bab463df4273e7c6bcd6
-
SHA1
1a5eb75bff26c1d8a8cfefa57a8ea7fe366b7546
-
SHA256
bc130c050da31bc55f7d6aa1c7a7e0817f289fa0eaf72ffa253cbaa10c45aff7
-
SHA512
ef56b9000dca93f34a5badb94299f27cd0cca267decf9c99b60dfe7b60d5df748900da7a422882a80f0a26a552bcb0588298096aa56d80c2026e190da862dfa7
-
SSDEEP
96:I5kbEiPPT7JDOKVyqOeyJCA1B5FE9pWbWCGkBRP4:I5niPPT7JDP+eyJt1XFErWs84
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
OpenWith.exepid process 4988 OpenWith.exe -
Suspicious use of SetWindowsHookEx 55 IoCs
Processes:
OpenWith.exepid process 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe 4988 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\vape lite\dumper\mitm_server.py"1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx