Analysis
-
max time kernel
98s -
max time network
95s -
platform
windows10-1703_x64 -
resource
win10-20230220-it -
resource tags
-
submitted
01-04-2023 07:48
General
-
Target
Full-Best_version.zip
-
Size
5.9MB
-
MD5
ca4d02a99b0ecf2343f0f4b3248f26e7
-
SHA1
419a4e894b0db65980ed6fe2b5f766eb4a0a5bb3
-
SHA256
671cc9e1189a0b67fb5ec59c8538865b91038021eac747e4d3db0ed13790549c
-
SHA512
fcc3683b740039aecba0802641c7adc5d8ab8960a24b0758353834db53452c1311dd2d45ee87d121ac483a244cec182b4ef76ea89ad7bf2239694258ace92391
-
SSDEEP
98304:duhx+eGVwmJxn1iBB8mkgbdn96+SFCGOX+EMg9YpJNoz7WFHWQZRKEiR+n:dMsdVJ/kgqZMuXMg9AJuzfQZUJq
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 2 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: LoadsDriver 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 18 IoCs
-
Suspicious use of FindShellTrayWindow 16 IoCs
-
Suspicious use of SendNotifyMessage 15 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Full-Best_version.zip1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\SystemSettingsBroker.exeC:\Windows\System32\SystemSettingsBroker.exe -Embedding1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s RmSvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s SstpSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s RasMan1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnpublishInvoke.TS"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\xpsrchvw.exe"C:\Windows\System32\xpsrchvw.exe" "C:\Users\Admin\Desktop\SwitchClose.edrwx"1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.iniFilesize
80B
MD584d859fbb9242f1b17119dbcd42f3bb4
SHA11579f423c99ba53e090f492cd38bedb10fc2a620
SHA25603da01ec745770dc287a7cce8723c7aceb477dc21272899bbe5f67b9cc93f26c
SHA512c92bd65b32c3d1a3af9727ea74990c69e5880c30b03b655a371bbbd42bd6d5c360491eb8342a0a66f87033beed5672c2643253e143d0e4a7959b3ddeb394c341
-
C:\Users\Admin\AppData\Roaming\vlc\vlcrc.4188Filesize
94KB
MD5fb5b0a519da21f54a7ccb4864e713f4f
SHA1329165e2f3cc17fe085f9675c4f9a280471be6b2
SHA2566d61d2876b70a2c118d35b37be64613366dc65a53c34f919de6975ce0e2135f8
SHA51274d421535870e1ccb39ccf26e1cac9b84c876cb65d89f3f63938326be1594b3c9781f69f8aca21f200232d3844334f7fc239bb982e4ce19230ccf3a7782c188d
-
C:\Windows\INF\netrasa.PNFFilesize
22KB
MD580648b43d233468718d717d10187b68d
SHA1a1736e8f0e408ce705722ce097d1adb24ebffc45
SHA2568ab9a39457507e405ade5ef9d723e0f89bc46d8d8b33d354b00d95847f098380
SHA512eec0ac7e7abcf87b3f0f4522b0dd95c658327afb866ceecff3c9ff0812a521201d729dd71d43f3ac46536f8435d4a49ac157b6282077c7c1940a6668f3b3aea9
-
C:\Windows\INF\netsstpa.PNFFilesize
6KB
MD501e21456e8000bab92907eec3b3aeea9
SHA139b34fe438352f7b095e24c89968fca48b8ce11c
SHA25635ad0403fdef3fce3ef5cd311c72fef2a95a317297a53c02735cda4bd6e0c74f
SHA5129d5153450e8fe3f51f20472bae4a2ab2fed43fad61a89b04a70325559f6ffed935dd72212671cc6cfc0288458d359bc71567f0d9af8e5770d696adc5bdadd7ec
-
memory/4188-135-0x00007FF9CFC90000-0x00007FF9CFF44000-memory.dmpFilesize
2.7MB
-
memory/4188-145-0x00007FF9CFA40000-0x00007FF9CFA5D000-memory.dmpFilesize
116KB
-
memory/4188-134-0x00007FF9D1D90000-0x00007FF9D1DC4000-memory.dmpFilesize
208KB
-
memory/4188-137-0x00007FF9CFAC0000-0x00007FF9CFAD7000-memory.dmpFilesize
92KB
-
memory/4188-139-0x00007FF9CFAA0000-0x00007FF9CFAB1000-memory.dmpFilesize
68KB
-
memory/4188-140-0x00007FF9CFA80000-0x00007FF9CFA97000-memory.dmpFilesize
92KB
-
memory/4188-144-0x00007FF9CFA60000-0x00007FF9CFA71000-memory.dmpFilesize
68KB
-
memory/4188-136-0x00007FF9E0210000-0x00007FF9E0228000-memory.dmpFilesize
96KB
-
memory/4188-133-0x00007FF7F9B10000-0x00007FF7F9C08000-memory.dmpFilesize
992KB
-
memory/4188-151-0x00007FF9CFA20000-0x00007FF9CFA31000-memory.dmpFilesize
68KB
-
memory/4188-154-0x00007FF7F9B10000-0x00007FF7F9C08000-memory.dmpFilesize
992KB
-
memory/4188-155-0x00007FF9D1D90000-0x00007FF9D1DC4000-memory.dmpFilesize
208KB
-
memory/4188-156-0x00007FF9CFC90000-0x00007FF9CFF44000-memory.dmpFilesize
2.7MB
-
memory/4188-153-0x00007FF9CDED0000-0x00007FF9CEF7B000-memory.dmpFilesize
16.7MB
-
memory/4188-161-0x00007FF9CDA70000-0x00007FF9CDB82000-memory.dmpFilesize
1.1MB