Overview
overview
6Static
static
3EUIVFix.v3.rar
windows7-x64
3EUIVFix.v3.rar
windows10-2004-x64
3EUIVFix.v3...ix.ini
windows7-x64
1EUIVFix.v3...ix.ini
windows10-2004-x64
1EUIVFix.v3...ix.url
windows7-x64
6EUIVFix.v3...ix.url
windows10-2004-x64
6EUIVFix.v3...64.dll
windows7-x64
1EUIVFix.v3...64.dll
windows10-2004-x64
1EUIVFix.v3...s.json
windows7-x64
3EUIVFix.v3...s.json
windows10-2004-x64
3EUIVFix.v3...64.dll
windows7-x64
1EUIVFix.v3...64.dll
windows10-2004-x64
1EUIVFix.v3...64.dll
windows7-x64
1EUIVFix.v3...64.dll
windows10-2004-x64
1Analysis
-
max time kernel
140s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
26/04/2023, 13:00
Static task
static1
Behavioral task
behavioral1
Sample
EUIVFix.v3.rar
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
EUIVFix.v3.rar
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
EUIVFix.v3/OnlineFix.ini
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
EUIVFix.v3/OnlineFix.ini
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
EUIVFix.v3/OnlineFix.url
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
EUIVFix.v3/OnlineFix.url
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
EUIVFix.v3/OnlineFix64.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
EUIVFix.v3/OnlineFix64.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
EUIVFix.v3/launcher-settings.json
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
EUIVFix.v3/launcher-settings.json
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
EUIVFix.v3/steam_api64.dll
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
EUIVFix.v3/steam_api64.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
EUIVFix.v3/steam_api64.dll
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
EUIVFix.v3/steam_api64.dll
Resource
win10v2004-20230220-en
General
-
Target
EUIVFix.v3.rar
-
Size
4.6MB
-
MD5
501836007b6656c8b69c5b129f329506
-
SHA1
53e069120e59435901fd4bf0b72e4436b39a0053
-
SHA256
e56f771517d4b58c0c4e13b6bb2cd9556844c602052a1c6e051dfc47f5a2c968
-
SHA512
aba2b7a5b081b34a38e793934187f349f4ddcb833cc69a4243e93e1cbee8fa76921c1e6cd95f785a6c75913f30d5f56bb8ac2ef9a949a02707fde154d9608298
-
SSDEEP
98304:1hrpsdXiQWKBr0Fk9FOJmw7W37TAxT6plhmi8P8Tiqe0t:1Rp4iQWKBrf1EgcKhmig8Tiqe+
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 556 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 556 vlc.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 556 vlc.exe 556 vlc.exe 556 vlc.exe 556 vlc.exe 556 vlc.exe 556 vlc.exe 556 vlc.exe 556 vlc.exe 556 vlc.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 556 vlc.exe 556 vlc.exe 556 vlc.exe 556 vlc.exe 556 vlc.exe 556 vlc.exe 556 vlc.exe 556 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 556 vlc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1744 wrote to memory of 320 1744 cmd.exe 29 PID 1744 wrote to memory of 320 1744 cmd.exe 29 PID 1744 wrote to memory of 320 1744 cmd.exe 29 PID 320 wrote to memory of 556 320 rundll32.exe 30 PID 320 wrote to memory of 556 320 rundll32.exe 30 PID 320 wrote to memory of 556 320 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\EUIVFix.v3.rar1⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\EUIVFix.v3.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\EUIVFix.v3.rar"3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:556
-
-