Analysis

  • max time kernel
    140s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    26/04/2023, 13:00

General

  • Target

    EUIVFix.v3.rar

  • Size

    4.6MB

  • MD5

    501836007b6656c8b69c5b129f329506

  • SHA1

    53e069120e59435901fd4bf0b72e4436b39a0053

  • SHA256

    e56f771517d4b58c0c4e13b6bb2cd9556844c602052a1c6e051dfc47f5a2c968

  • SHA512

    aba2b7a5b081b34a38e793934187f349f4ddcb833cc69a4243e93e1cbee8fa76921c1e6cd95f785a6c75913f30d5f56bb8ac2ef9a949a02707fde154d9608298

  • SSDEEP

    98304:1hrpsdXiQWKBr0Fk9FOJmw7W37TAxT6plhmi8P8Tiqe0t:1Rp4iQWKBrf1EgcKhmig8Tiqe+

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\EUIVFix.v3.rar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1744
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\EUIVFix.v3.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:320
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\EUIVFix.v3.rar"
        3⤵
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:556

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/556-83-0x000000013FE10000-0x000000013FF08000-memory.dmp

    Filesize

    992KB

  • memory/556-84-0x000007FEFADE0000-0x000007FEFAE14000-memory.dmp

    Filesize

    208KB

  • memory/556-85-0x000007FEF6410000-0x000007FEF66C4000-memory.dmp

    Filesize

    2.7MB

  • memory/556-86-0x000007FEFB660000-0x000007FEFB678000-memory.dmp

    Filesize

    96KB

  • memory/556-87-0x000007FEFAD90000-0x000007FEFADA7000-memory.dmp

    Filesize

    92KB

  • memory/556-88-0x000007FEFAD70000-0x000007FEFAD81000-memory.dmp

    Filesize

    68KB

  • memory/556-89-0x000007FEFAAC0000-0x000007FEFAAD7000-memory.dmp

    Filesize

    92KB

  • memory/556-90-0x000007FEFAAA0000-0x000007FEFAAB1000-memory.dmp

    Filesize

    68KB

  • memory/556-91-0x000007FEFAA80000-0x000007FEFAA9D000-memory.dmp

    Filesize

    116KB

  • memory/556-92-0x000007FEF6190000-0x000007FEF6390000-memory.dmp

    Filesize

    2.0MB

  • memory/556-93-0x000007FEFAA60000-0x000007FEFAA71000-memory.dmp

    Filesize

    68KB

  • memory/556-94-0x000007FEFA7A0000-0x000007FEFA7DF000-memory.dmp

    Filesize

    252KB

  • memory/556-95-0x000007FEFA770000-0x000007FEFA791000-memory.dmp

    Filesize

    132KB

  • memory/556-96-0x000007FEFA750000-0x000007FEFA768000-memory.dmp

    Filesize

    96KB

  • memory/556-97-0x000007FEF50E0000-0x000007FEF618B000-memory.dmp

    Filesize

    16.7MB

  • memory/556-98-0x000007FEF6840000-0x000007FEF6851000-memory.dmp

    Filesize

    68KB

  • memory/556-99-0x000007FEF6820000-0x000007FEF6831000-memory.dmp

    Filesize

    68KB

  • memory/556-100-0x000007FEF6800000-0x000007FEF6811000-memory.dmp

    Filesize

    68KB

  • memory/556-101-0x000007FEF63F0000-0x000007FEF640B000-memory.dmp

    Filesize

    108KB

  • memory/556-102-0x000007FEF63D0000-0x000007FEF63E1000-memory.dmp

    Filesize

    68KB

  • memory/556-103-0x000007FEF4EE0000-0x000007FEF4EF8000-memory.dmp

    Filesize

    96KB

  • memory/556-104-0x000007FEF4EB0000-0x000007FEF4EE0000-memory.dmp

    Filesize

    192KB

  • memory/556-105-0x000007FEF4E40000-0x000007FEF4EA7000-memory.dmp

    Filesize

    412KB

  • memory/556-106-0x000007FEF4240000-0x000007FEF42AF000-memory.dmp

    Filesize

    444KB

  • memory/556-107-0x000007FEF41E0000-0x000007FEF41F1000-memory.dmp

    Filesize

    68KB

  • memory/556-108-0x000007FEF4160000-0x000007FEF41B6000-memory.dmp

    Filesize

    344KB

  • memory/556-109-0x000007FEF4130000-0x000007FEF4158000-memory.dmp

    Filesize

    160KB

  • memory/556-110-0x000007FEF4100000-0x000007FEF4124000-memory.dmp

    Filesize

    144KB

  • memory/556-111-0x000007FEF40E0000-0x000007FEF40F7000-memory.dmp

    Filesize

    92KB

  • memory/556-112-0x000007FEF40B0000-0x000007FEF40D3000-memory.dmp

    Filesize

    140KB

  • memory/556-113-0x000007FEF4090000-0x000007FEF40A1000-memory.dmp

    Filesize

    68KB

  • memory/556-114-0x000007FEF4070000-0x000007FEF4082000-memory.dmp

    Filesize

    72KB

  • memory/556-116-0x000007FEF4020000-0x000007FEF4033000-memory.dmp

    Filesize

    76KB

  • memory/556-115-0x000007FEF4040000-0x000007FEF4061000-memory.dmp

    Filesize

    132KB

  • memory/556-117-0x000007FEF4000000-0x000007FEF4012000-memory.dmp

    Filesize

    72KB

  • memory/556-118-0x000007FEF3EC0000-0x000007FEF3FFB000-memory.dmp

    Filesize

    1.2MB

  • memory/556-119-0x000007FEF3D90000-0x000007FEF3DBC000-memory.dmp

    Filesize

    176KB

  • memory/556-120-0x000007FEF3BD0000-0x000007FEF3D82000-memory.dmp

    Filesize

    1.7MB

  • memory/556-121-0x000007FEF3B70000-0x000007FEF3BCC000-memory.dmp

    Filesize

    368KB

  • memory/556-122-0x000007FEF3B50000-0x000007FEF3B61000-memory.dmp

    Filesize

    68KB

  • memory/556-123-0x000007FEF3990000-0x000007FEF3A27000-memory.dmp

    Filesize

    604KB

  • memory/556-124-0x000007FEF3970000-0x000007FEF3982000-memory.dmp

    Filesize

    72KB

  • memory/556-125-0x000007FEF3730000-0x000007FEF3961000-memory.dmp

    Filesize

    2.2MB

  • memory/556-126-0x000007FEF3610000-0x000007FEF3722000-memory.dmp

    Filesize

    1.1MB

  • memory/556-127-0x000007FEF35D0000-0x000007FEF3605000-memory.dmp

    Filesize

    212KB

  • memory/556-128-0x000007FEF35A0000-0x000007FEF35C5000-memory.dmp

    Filesize

    148KB

  • memory/556-129-0x000007FEF3580000-0x000007FEF3591000-memory.dmp

    Filesize

    68KB

  • memory/556-130-0x000007FEF3510000-0x000007FEF3571000-memory.dmp

    Filesize

    388KB

  • memory/556-131-0x000007FEF34F0000-0x000007FEF3501000-memory.dmp

    Filesize

    68KB

  • memory/556-132-0x000007FEF34D0000-0x000007FEF34E2000-memory.dmp

    Filesize

    72KB

  • memory/556-133-0x000007FEF34B0000-0x000007FEF34C3000-memory.dmp

    Filesize

    76KB

  • memory/556-134-0x000007FEF32F0000-0x000007FEF338F000-memory.dmp

    Filesize

    636KB

  • memory/556-135-0x000007FEF3490000-0x000007FEF34A1000-memory.dmp

    Filesize

    68KB

  • memory/556-136-0x000007FEF31E0000-0x000007FEF32E2000-memory.dmp

    Filesize

    1.0MB

  • memory/556-137-0x000007FEF3470000-0x000007FEF3481000-memory.dmp

    Filesize

    68KB

  • memory/556-138-0x000007FEF3450000-0x000007FEF3461000-memory.dmp

    Filesize

    68KB

  • memory/556-139-0x000007FEF33B0000-0x000007FEF33C1000-memory.dmp

    Filesize

    68KB

  • memory/556-140-0x000007FEF31C0000-0x000007FEF31D2000-memory.dmp

    Filesize

    72KB

  • memory/556-141-0x000007FEF31A0000-0x000007FEF31B8000-memory.dmp

    Filesize

    96KB

  • memory/556-142-0x000007FEF3180000-0x000007FEF3196000-memory.dmp

    Filesize

    88KB

  • memory/556-143-0x000007FEF3150000-0x000007FEF3179000-memory.dmp

    Filesize

    164KB

  • memory/556-144-0x000007FEF3130000-0x000007FEF3142000-memory.dmp

    Filesize

    72KB

  • memory/556-145-0x000007FEF3110000-0x000007FEF3121000-memory.dmp

    Filesize

    68KB

  • memory/556-146-0x000007FEF30F0000-0x000007FEF3101000-memory.dmp

    Filesize

    68KB