Resubmissions

09-05-2023 19:22

230509-x3fn4adg58 10

09-05-2023 19:14

230509-xxsrgaff7x 10

09-05-2023 19:14

230509-xxr5yadg42 7

09-05-2023 19:14

230509-xxrt6sff7w 8

09-05-2023 19:14

230509-xxrjeaff7v 8

09-05-2023 19:14

230509-xxqxwadg39 7

09-05-2023 19:14

230509-xxql4sff7t 10

09-05-2023 19:14

230509-xxqbcadg38 7

09-05-2023 19:10

230509-xvl6xadf64 10

Analysis

  • max time kernel
    149s
  • max time network
    59s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    09-05-2023 19:14

General

  • Target

    trojan-leaks-main/TheEchoOfFear (Special Edition).rar

  • Size

    19.9MB

  • MD5

    05ec3be64cdf7b7dee973bc65fd928e0

  • SHA1

    0625bef37fc4a5e8ac3bd1bd976f49e6a71dfe86

  • SHA256

    84bb8463d236b719e35e41d1d4c0cd5ac953d9ef5e7a4ccd2a06acb56dc49d30

  • SHA512

    66b292668a06e951f558a4bd039a809113c187a022739743b881aef66d9c2e5fa8d2a331dff81c6272e867bd3378085466a5bb5ffcbbf398e933adb700d5cd5c

  • SSDEEP

    393216:Qs0mJzpg1O2xFM5dOnD8Z838kOaMGnHl3M2q4G2oakr8YiOIxjmGR9jrj:+mj2O58D865OBGnFrqB8YjIxS8jrj

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\TheEchoOfFear (Special Edition).rar"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1316
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\TheEchoOfFear (Special Edition).rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1452
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\TheEchoOfFear (Special Edition).rar"
        3⤵
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:1768

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1768-83-0x000000013FA50000-0x000000013FB48000-memory.dmp

    Filesize

    992KB

  • memory/1768-84-0x000007FEFADC0000-0x000007FEFADF4000-memory.dmp

    Filesize

    208KB

  • memory/1768-85-0x000007FEF65E0000-0x000007FEF6894000-memory.dmp

    Filesize

    2.7MB

  • memory/1768-86-0x000007FEFBAA0000-0x000007FEFBAB8000-memory.dmp

    Filesize

    96KB

  • memory/1768-87-0x000007FEFADA0000-0x000007FEFADB7000-memory.dmp

    Filesize

    92KB

  • memory/1768-88-0x000007FEFAD80000-0x000007FEFAD91000-memory.dmp

    Filesize

    68KB

  • memory/1768-89-0x000007FEFAD60000-0x000007FEFAD77000-memory.dmp

    Filesize

    92KB

  • memory/1768-90-0x000007FEFA8A0000-0x000007FEFA8B1000-memory.dmp

    Filesize

    68KB

  • memory/1768-91-0x000007FEFA880000-0x000007FEFA89D000-memory.dmp

    Filesize

    116KB

  • memory/1768-92-0x000007FEFA860000-0x000007FEFA871000-memory.dmp

    Filesize

    68KB

  • memory/1768-93-0x000007FEF63E0000-0x000007FEF65E0000-memory.dmp

    Filesize

    2.0MB

  • memory/1768-94-0x000007FEF4B50000-0x000007FEF5BFB000-memory.dmp

    Filesize

    16.7MB

  • memory/1768-95-0x000007FEFA820000-0x000007FEFA85F000-memory.dmp

    Filesize

    252KB

  • memory/1768-96-0x000007FEF6B50000-0x000007FEF6B71000-memory.dmp

    Filesize

    132KB

  • memory/1768-100-0x000007FEF6AD0000-0x000007FEF6AE1000-memory.dmp

    Filesize

    68KB

  • memory/1768-99-0x000007FEF6AF0000-0x000007FEF6B01000-memory.dmp

    Filesize

    68KB

  • memory/1768-102-0x000007FEF6A90000-0x000007FEF6AA1000-memory.dmp

    Filesize

    68KB

  • memory/1768-106-0x000007FEF6FC0000-0x000007FEF702F000-memory.dmp

    Filesize

    444KB

  • memory/1768-107-0x000007FEF6FA0000-0x000007FEF6FB1000-memory.dmp

    Filesize

    68KB

  • memory/1768-105-0x000007FEF69D0000-0x000007FEF6A37000-memory.dmp

    Filesize

    412KB

  • memory/1768-108-0x000007FEF6380000-0x000007FEF63D6000-memory.dmp

    Filesize

    344KB

  • memory/1768-104-0x000007FEF6A40000-0x000007FEF6A70000-memory.dmp

    Filesize

    192KB

  • memory/1768-109-0x000007FEF6350000-0x000007FEF6378000-memory.dmp

    Filesize

    160KB

  • memory/1768-111-0x000007FEF6F80000-0x000007FEF6F97000-memory.dmp

    Filesize

    92KB

  • memory/1768-110-0x000007FEF6320000-0x000007FEF6344000-memory.dmp

    Filesize

    144KB

  • memory/1768-114-0x000007FEF62B0000-0x000007FEF62C2000-memory.dmp

    Filesize

    72KB

  • memory/1768-115-0x000007FEF61B0000-0x000007FEF61D1000-memory.dmp

    Filesize

    132KB

  • memory/1768-113-0x000007FEF62D0000-0x000007FEF62E1000-memory.dmp

    Filesize

    68KB

  • memory/1768-117-0x000007FEF60D0000-0x000007FEF60E2000-memory.dmp

    Filesize

    72KB

  • memory/1768-116-0x000007FEF6190000-0x000007FEF61A3000-memory.dmp

    Filesize

    76KB

  • memory/1768-118-0x000007FEF5F90000-0x000007FEF60CB000-memory.dmp

    Filesize

    1.2MB

  • memory/1768-112-0x000007FEF62F0000-0x000007FEF6313000-memory.dmp

    Filesize

    140KB

  • memory/1768-103-0x000007FEF6A70000-0x000007FEF6A88000-memory.dmp

    Filesize

    96KB

  • memory/1768-120-0x000007FEF5DA0000-0x000007FEF5F52000-memory.dmp

    Filesize

    1.7MB

  • memory/1768-119-0x000007FEF5F60000-0x000007FEF5F8C000-memory.dmp

    Filesize

    176KB

  • memory/1768-121-0x000007FEF3F50000-0x000007FEF3FAC000-memory.dmp

    Filesize

    368KB

  • memory/1768-123-0x000007FEF3E90000-0x000007FEF3F27000-memory.dmp

    Filesize

    604KB

  • memory/1768-122-0x000007FEF3F30000-0x000007FEF3F41000-memory.dmp

    Filesize

    68KB

  • memory/1768-101-0x000007FEF6AB0000-0x000007FEF6ACB000-memory.dmp

    Filesize

    108KB

  • memory/1768-124-0x000007FEF3E00000-0x000007FEF3E12000-memory.dmp

    Filesize

    72KB

  • memory/1768-98-0x000007FEF6B10000-0x000007FEF6B21000-memory.dmp

    Filesize

    68KB

  • memory/1768-97-0x000007FEF6B30000-0x000007FEF6B48000-memory.dmp

    Filesize

    96KB

  • memory/1768-125-0x000007FEF39C0000-0x000007FEF3BF1000-memory.dmp

    Filesize

    2.2MB

  • memory/1768-126-0x000007FEF3CE0000-0x000007FEF3DF2000-memory.dmp

    Filesize

    1.1MB

  • memory/1768-133-0x000007FEF3930000-0x000007FEF3943000-memory.dmp

    Filesize

    76KB

  • memory/1768-134-0x000007FEF3640000-0x000007FEF36DF000-memory.dmp

    Filesize

    636KB

  • memory/1768-132-0x000007FEF3C10000-0x000007FEF3C22000-memory.dmp

    Filesize

    72KB

  • memory/1768-135-0x000007FEF3620000-0x000007FEF3631000-memory.dmp

    Filesize

    68KB

  • memory/1768-131-0x000007FEF3C30000-0x000007FEF3C41000-memory.dmp

    Filesize

    68KB

  • memory/1768-130-0x000007FEF3950000-0x000007FEF39B1000-memory.dmp

    Filesize

    388KB

  • memory/1768-129-0x000007FEF3C50000-0x000007FEF3C61000-memory.dmp

    Filesize

    68KB

  • memory/1768-128-0x000007FEF3C70000-0x000007FEF3C95000-memory.dmp

    Filesize

    148KB

  • memory/1768-136-0x000007FEF3410000-0x000007FEF3512000-memory.dmp

    Filesize

    1.0MB

  • memory/1768-140-0x000007FEF3250000-0x000007FEF3262000-memory.dmp

    Filesize

    72KB

  • memory/1768-141-0x000007FEF3230000-0x000007FEF3248000-memory.dmp

    Filesize

    96KB

  • memory/1768-139-0x000007FEF3270000-0x000007FEF3281000-memory.dmp

    Filesize

    68KB

  • memory/1768-144-0x000007FEF31C0000-0x000007FEF31D2000-memory.dmp

    Filesize

    72KB

  • memory/1768-146-0x000007FEF3180000-0x000007FEF3191000-memory.dmp

    Filesize

    68KB

  • memory/1768-145-0x000007FEF31A0000-0x000007FEF31B1000-memory.dmp

    Filesize

    68KB

  • memory/1768-143-0x000007FEF31E0000-0x000007FEF3209000-memory.dmp

    Filesize

    164KB

  • memory/1768-142-0x000007FEF3210000-0x000007FEF3226000-memory.dmp

    Filesize

    88KB

  • memory/1768-138-0x000007FEF3290000-0x000007FEF32A1000-memory.dmp

    Filesize

    68KB

  • memory/1768-137-0x000007FEF32B0000-0x000007FEF32C1000-memory.dmp

    Filesize

    68KB

  • memory/1768-127-0x000007FEF3CA0000-0x000007FEF3CD5000-memory.dmp

    Filesize

    212KB