quasar | 458c83f0bc425cb9fecfe4b60bd5e2df08fadffea5598422ff0561dee46b6e9a

Resubmissions

23-04-2023 09:56

230423-lycwvscf66 10

23-04-2023 09:54

230423-lxf7wsec61 10

Analysis

max time kernel
120s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
23-04-2023 09:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Venom HVNC 5.4.0 crack.rar
Size

14.5MB
MD5

3276eefc2547702c8a7fbc6db1275c36
SHA1

6c7ae5b03b8da23e5335da100675fc3ea824bbe4
SHA256

458c83f0bc425cb9fecfe4b60bd5e2df08fadffea5598422ff0561dee46b6e9a
SHA512

15a04bbf3990e78344ae7d657f1a35e90fbe856011aeee696dd4c206c551a834c5493c864f274525b4ac65ee383f3a0887cb4d3583962d9c2e1a51706b30771f
SSDEEP

393216:aLWJa3c4xuHK2CbbjlACVnyGinovZept7T4:Nc3oK2ebOynyG5vwr4

Score

10^/10

quasar xworm persistence rat spyware trojan

Malware Config

Extracted

Family

xworm

behind-him.at.ply.gg:27180

Attributes

install_file
USB.exe

Extracted

Family

quasar

Attributes

reconnect_delay
5000

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4600-518-0x0000000000B30000-0x000000000156A000-memory.dmp	family_quasar
behavioral1/memory/4600-519-0x0000000000B30000-0x000000000156A000-memory.dmp	family_quasar
behavioral1/memory/4600-524-0x0000000000B30000-0x000000000156A000-memory.dmp	family_quasar

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

VenomHVNC.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	VenomHVNC.exe

Drops startup file 2 IoCs

Processes:

VenomHVNC.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VenomHVNC.lnk	VenomHVNC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VenomHVNC.lnk	VenomHVNC.exe

Executes dropped EXE 3 IoCs

Processes:

VenomHVNC.exeVenombin.exeVenomHVNC.exe

pid process

2764 VenomHVNC.exe
4600 Venombin.exe
2748 VenomHVNC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

VenomHVNC.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VenomHVNC = "C:\\Users\\Admin\\AppData\\Roaming\\VenomHVNC.exe"	VenomHVNC.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

39 ip-api.com

flow	ioc
39	ip-api.com

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

7zFM.exe

description	ioc	process
File created	C:\Users\Admin\desktop\Venom HVNC 5.4.0 crack\autorun.inf	7zFM.exe
File opened for modification	C:\Users\Admin\desktop\Venom HVNC 5.4.0 crack\autorun.inf	7zFM.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

Venombin.exe

pid process

4600 Venombin.exe
4600 Venombin.exe
4600 Venombin.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

432 4600 WerFault.exe Venombin.exe

pid	process
4600	Venombin.exe
4600	Venombin.exe
4600	Venombin.exe

pid	pid_target	process	target process
432	4600	WerFault.exe	Venombin.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

228 schtasks.exe

pid	process
228	schtasks.exe

Modifies registry class 64 IoCs

Processes:

OpenWith.exeVenombin.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\印趻翹	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\ms-settings\shell\open	Venombin.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\rar_auto_file\shell\open\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\ms-settings\shell\open\command\	Venombin.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\rar_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\鉀킞䜀老厈趻翹	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\鉂킐䠀蠁\ = "rar_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\rar_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Applications\7zFM.exe\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\ms-settings	Venombin.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 5000310000000000555602191000372d5a6970003c0009000400efbe55560219555602192e000000d7e7010000000d000000000000000000000000000000db36fb0037002d005a0069007000000014000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\ms-settings\shell\open\command	Venombin.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\鉀킞䜀老厈趻翹\ = "rar_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\鉂킐䠀蠁	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 8c003100000000005556fb1b110050524f4752417e310000740009000400efbe874fdb495556fb1b2e0000003f0000000000010000000000000000004a000000000012f0d200500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\㒐濜ʝ	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Applications	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Applications\7zFM.exe\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zFM.exe\" \"%1\""	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\㒐濜ʝ\ = "rar_auto_file"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\rar_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\ms-settings\shell	Venombin.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Applications\7zFM.exe\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\.rar	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

VenomHVNC.exetaskmgr.exe

pid	process
2764	VenomHVNC.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

OpenWith.exe7zFM.exe

pid process

4072 OpenWith.exe
4088 7zFM.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

7zFM.exeVenomHVNC.exeVenombin.exeVenomHVNC.exetaskmgr.exe

description	pid	process
Token: SeRestorePrivilege	4088	7zFM.exe
Token: 35	4088	7zFM.exe
Token: SeSecurityPrivilege	4088	7zFM.exe
Token: SeDebugPrivilege	2764	VenomHVNC.exe
Token: SeDebugPrivilege	2764	VenomHVNC.exe
Token: SeDebugPrivilege	4600	Venombin.exe
Token: SeDebugPrivilege	2748	VenomHVNC.exe
Token: SeDebugPrivilege	1736	taskmgr.exe
Token: SeSystemProfilePrivilege	1736	taskmgr.exe
Token: SeCreateGlobalPrivilege	1736	taskmgr.exe
Token: 33	1736	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1736	taskmgr.exe

Suspicious use of FindShellTrayWindow 45 IoCs

Processes:

7zFM.exetaskmgr.exe

pid	process
4088	7zFM.exe
4088	7zFM.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe

Suspicious use of SendNotifyMessage 43 IoCs

Processes:

taskmgr.exe

pid	process
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe

Suspicious use of SetWindowsHookEx 36 IoCs

Processes:

OpenWith.exeVenomHVNC.exeVenombin.exe

pid	process
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
4072	OpenWith.exe
2764	VenomHVNC.exe
4600	Venombin.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

OpenWith.exeVenomHVNC.exe

description	pid	process	target process
PID 4072 wrote to memory of 4088	4072	OpenWith.exe	7zFM.exe
PID 4072 wrote to memory of 4088	4072	OpenWith.exe	7zFM.exe
PID 2764 wrote to memory of 228	2764	VenomHVNC.exe	schtasks.exe
PID 2764 wrote to memory of 228	2764	VenomHVNC.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Venom HVNC 5.4.0 crack.rar"
1⤵
PID:5056

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4072

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Venom HVNC 5.4.0 crack.rar"
2⤵
- Drops autorun.inf file
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4088

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3156

C:\Users\Admin\Desktop\Venom HVNC 5.4.0 crack\VenomHVNC.exe
"C:\Users\Admin\Desktop\Venom HVNC 5.4.0 crack\VenomHVNC.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "VenomHVNC" /tr "C:\Users\Admin\AppData\Roaming\VenomHVNC.exe"
2⤵
- Creates scheduled task(s)
PID:228

C:\Users\Admin\Desktop\Venom HVNC 5.4.0 crack\Venombin.exe
"C:\Users\Admin\Desktop\Venom HVNC 5.4.0 crack\Venombin.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 1720
2⤵
- Program crash
PID:432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4600 -ip 4600
1⤵
PID:3360

C:\Users\Admin\AppData\Roaming\VenomHVNC.exe
C:\Users\Admin\AppData\Roaming\VenomHVNC.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2748

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1736

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

T1091

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Replication Through Removable Media

T1091

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Filesize
28KB

MD5
275ae366e4ecf3d88e56863ce8f712fa

SHA1
e95c248a4379ebd5ccbdeddc196be0e852b16ccc

SHA256
73948663c05951a55c1a92bd8cd3eed4e8f2c942faac8b749100f5457ffce2fc

SHA512
8adea257aa3237dd4ad88e69e6b67f1d59ef6a7066622686d2e2637eb16a5d732e8e30d0c0e2c08bef6cd3071683e5104e6c1ee5ef954c2fa4b72b09c40e44e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Filesize
28KB

MD5
b907e049d9cb2a54e93318f768e57cb9

SHA1
f2c69309b9796700d75b0fe42ba7a1beba7b0066

SHA256
1ec69d645caa3a599abf62237ddde770d37350242f30668dfe78d91357311386

SHA512
8470e8556e3fd8f7324cdd918bd613924e450ac2a4d03d091d432f9bfeaf8c1584a513fecc63f532d0e1b6cbf0f88c1b09dd21bdb3b942be87bef7fc91426b37

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VenomHVNC.lnk
Filesize
783B

MD5
5fdd66a036014b9da503346ff49c7397

SHA1
8d60b78ec830ccdb20cf2b1aabd1116b85d41963

SHA256
0b503e048cadbbfac5787e40aa4dce6fbbc956b498374c82b2f396db7947bd71

SHA512
038bb86a0432e1b4effe4bf3b00a4e209d7ad543cbfa13401950d0ee30ffdc93bf2a4facab4d7440e219d50f39440c24422647b48b011cfe5f3443a265b0769b

Download Submit
C:\Users\Admin\AppData\Roaming\VenomHVNC.exe
Filesize
188KB

MD5
099aff06a5aba484c958501f1b037996

SHA1
c418b0b0cb3f7cf97f31e619f9ef7075d7f7a50f

SHA256
9e8390c4f8ca29205810d4947309bfc4ee7d92d697df720c75a151ddf6abdc0c

SHA512
7f61f9e92d838f5bbf8b4a052d45298025ade393de7cdaaff48dfc2ec9902724518b60858ac15ef8fb372f077c4349201a43d459880b9e2e16f909bb198c49e3

Download Submit
C:\Users\Admin\AppData\Roaming\VenomHVNC.exe
Filesize
188KB

MD5
099aff06a5aba484c958501f1b037996

SHA1
c418b0b0cb3f7cf97f31e619f9ef7075d7f7a50f

SHA256
9e8390c4f8ca29205810d4947309bfc4ee7d92d697df720c75a151ddf6abdc0c

SHA512
7f61f9e92d838f5bbf8b4a052d45298025ade393de7cdaaff48dfc2ec9902724518b60858ac15ef8fb372f077c4349201a43d459880b9e2e16f909bb198c49e3

Download Submit
C:\Users\Admin\AppData\Roaming\VenomHVNC.exe
Filesize
188KB

MD5
099aff06a5aba484c958501f1b037996

SHA1
c418b0b0cb3f7cf97f31e619f9ef7075d7f7a50f

SHA256
9e8390c4f8ca29205810d4947309bfc4ee7d92d697df720c75a151ddf6abdc0c

SHA512
7f61f9e92d838f5bbf8b4a052d45298025ade393de7cdaaff48dfc2ec9902724518b60858ac15ef8fb372f077c4349201a43d459880b9e2e16f909bb198c49e3

Download Submit
C:\Users\Admin\Desktop\Venom HVNC 5.4.0 crack\VenomHVNC.exe
Filesize
188KB

MD5
099aff06a5aba484c958501f1b037996

SHA1
c418b0b0cb3f7cf97f31e619f9ef7075d7f7a50f

SHA256
9e8390c4f8ca29205810d4947309bfc4ee7d92d697df720c75a151ddf6abdc0c

SHA512
7f61f9e92d838f5bbf8b4a052d45298025ade393de7cdaaff48dfc2ec9902724518b60858ac15ef8fb372f077c4349201a43d459880b9e2e16f909bb198c49e3

Download Submit
C:\Users\Admin\Desktop\Venom HVNC 5.4.0 crack\VenomHVNC.exe
Filesize
188KB

MD5
099aff06a5aba484c958501f1b037996

SHA1
c418b0b0cb3f7cf97f31e619f9ef7075d7f7a50f

SHA256
9e8390c4f8ca29205810d4947309bfc4ee7d92d697df720c75a151ddf6abdc0c

SHA512
7f61f9e92d838f5bbf8b4a052d45298025ade393de7cdaaff48dfc2ec9902724518b60858ac15ef8fb372f077c4349201a43d459880b9e2e16f909bb198c49e3

Download Submit
C:\Users\Admin\Desktop\Venom HVNC 5.4.0 crack\Venombin.exe
Filesize
2.6MB

MD5
28ab86b3dcd21945ecf0d61cff33f0af

SHA1
5117b7fea972011d5d8744632d5052d92d93bc64

SHA256
a9da04a7a49309e177655fb41589cac45813b8a98e469225f58ed137a6fe3078

SHA512
2c7370fe9fa0b0ca15bbb29c7b9b102978555aab02f6ced0a59773146f0f72e6b2d6994a3f99851bd4bd63a4e07a88751090aece1ce34ed1c97f97ead0fbe6f8

Download Submit
\??\c:\users\admin\desktop\venom hvnc 5.4.0 crack\venombin.exe
Filesize
2.6MB

MD5
28ab86b3dcd21945ecf0d61cff33f0af

SHA1
5117b7fea972011d5d8744632d5052d92d93bc64

SHA256
a9da04a7a49309e177655fb41589cac45813b8a98e469225f58ed137a6fe3078

SHA512
2c7370fe9fa0b0ca15bbb29c7b9b102978555aab02f6ced0a59773146f0f72e6b2d6994a3f99851bd4bd63a4e07a88751090aece1ce34ed1c97f97ead0fbe6f8

Download Submit
memory/1736-535-0x000001FE190A0000-0x000001FE190A1000-memory.dmp

Filesize
4KB

Download
memory/1736-537-0x000001FE190A0000-0x000001FE190A1000-memory.dmp

Filesize
4KB

Download
memory/1736-541-0x000001FE190A0000-0x000001FE190A1000-memory.dmp

Filesize
4KB

Download
memory/1736-540-0x000001FE190A0000-0x000001FE190A1000-memory.dmp

Filesize
4KB

Download
memory/1736-539-0x000001FE190A0000-0x000001FE190A1000-memory.dmp

Filesize
4KB

Download
memory/1736-538-0x000001FE190A0000-0x000001FE190A1000-memory.dmp

Filesize
4KB

Download
memory/1736-536-0x000001FE190A0000-0x000001FE190A1000-memory.dmp

Filesize
4KB

Download
memory/1736-531-0x000001FE190A0000-0x000001FE190A1000-memory.dmp

Filesize
4KB

Download
memory/1736-529-0x000001FE190A0000-0x000001FE190A1000-memory.dmp

Filesize
4KB

Download
memory/1736-530-0x000001FE190A0000-0x000001FE190A1000-memory.dmp

Filesize
4KB

Download
memory/2764-505-0x0000000000BD0000-0x0000000000BE0000-memory.dmp

Filesize
64KB

Download
memory/2764-523-0x0000000000BD0000-0x0000000000BE0000-memory.dmp

Filesize
64KB

Download
memory/2764-504-0x0000000000320000-0x0000000000356000-memory.dmp

Filesize
216KB

Download
memory/4600-516-0x0000000000B30000-0x000000000156A000-memory.dmp

Filesize
10.2MB

Download
memory/4600-517-0x000000007EDD0000-0x000000007F1A1000-memory.dmp

Filesize
3.8MB

Download
memory/4600-525-0x000000007EDD0000-0x000000007F1A1000-memory.dmp

Filesize
3.8MB

Download
memory/4600-524-0x0000000000B30000-0x000000000156A000-memory.dmp

Filesize
10.2MB

Download
memory/4600-518-0x0000000000B30000-0x000000000156A000-memory.dmp

Filesize
10.2MB

Download
memory/4600-522-0x00000000078B0000-0x00000000078C0000-memory.dmp

Filesize
64KB

Download
memory/4600-521-0x0000000007960000-0x00000000079F2000-memory.dmp

Filesize
584KB

Download
memory/4600-520-0x0000000007D50000-0x00000000082F4000-memory.dmp

Filesize
5.6MB

Download
memory/4600-519-0x0000000000B30000-0x000000000156A000-memory.dmp

Filesize
10.2MB

Download