e64bb75516fa8244fc31da6ee100cc10627f316aabc5ec9cfd2d9f5a028a6e4c

Analysis

max time kernel
32s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20-05-2023 21:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ChatGPT-4_Online.rar
Size

2.3MB
MD5

ae9cc5aada7d190699750a0637b91c44
SHA1

3bd4c2389e6db658719bf3a224ae58d72d076538
SHA256

e64bb75516fa8244fc31da6ee100cc10627f316aabc5ec9cfd2d9f5a028a6e4c
SHA512

cb2367a973d4bb389b75e5926a8e7115596c83016fc5fc9c8239ae0c663cedfbe8cb86aabc2fc7282620108efa189fd0c4a4afe0e37d80a33526381e114e3832
SSDEEP

49152:e+1J1nX5LY2DfnuGPq2cFaqZS0ah8BoAcIkvnEUNuC06hWydTbW:dv1JLY2Du2q24aqkZaBoAcIkMyWyw

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

320 vlc.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vlc.exe

pid process

320 vlc.exe
Suspicious use of FindShellTrayWindow 9 IoCs

Processes:

vlc.exe

pid process

320 vlc.exe
320 vlc.exe
320 vlc.exe
320 vlc.exe
320 vlc.exe
320 vlc.exe
320 vlc.exe
320 vlc.exe
320 vlc.exe
Suspicious use of SendNotifyMessage 8 IoCs

Processes:

vlc.exe

pid process

320 vlc.exe
320 vlc.exe
320 vlc.exe
320 vlc.exe
320 vlc.exe
320 vlc.exe
320 vlc.exe
320 vlc.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vlc.exe

pid process

320 vlc.exe

pid	process
320	vlc.exe

pid	process
320	vlc.exe

pid	process
320	vlc.exe
320	vlc.exe
320	vlc.exe
320	vlc.exe
320	vlc.exe
320	vlc.exe
320	vlc.exe
320	vlc.exe
320	vlc.exe

pid	process
320	vlc.exe
320	vlc.exe
320	vlc.exe
320	vlc.exe
320	vlc.exe
320	vlc.exe
320	vlc.exe
320	vlc.exe

pid	process
320	vlc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1764 wrote to memory of 1288	1764	cmd.exe	rundll32.exe
PID 1764 wrote to memory of 1288	1764	cmd.exe	rundll32.exe
PID 1764 wrote to memory of 1288	1764	cmd.exe	rundll32.exe
PID 1288 wrote to memory of 320	1288	rundll32.exe	vlc.exe
PID 1288 wrote to memory of 320	1288	rundll32.exe	vlc.exe
PID 1288 wrote to memory of 320	1288	rundll32.exe	vlc.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ChatGPT-4_Online.rar
1⤵
- Suspicious use of WriteProcessMemory
PID:1764

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ChatGPT-4_Online.rar
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1288

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\ChatGPT-4_Online.rar"
3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:320

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\vlc\vlcrc.320
Filesize
93KB

MD5
478a4a09f4f74e97335cd4d5e9da7ab5

SHA1
3c4f1dc52a293f079095d0b0370428ec8e8f9315

SHA256
884b59950669842f3c45e6da3480cd9a553538b951fb155b435b48ff38683974

SHA512
e96719663cd264132a8e1ea8c3f8a148c778a0c68caa2468ba47629393605b197dd9e00efad91f389de9fcc77b04981a0cf87f785f3c645cdc9e4ebd98060ca1

Download Submit
memory/320-85-0x000000013F5F0000-0x000000013F6E8000-memory.dmp

Filesize
992KB

Download
memory/320-95-0x000000013F5F0000-0x000000013F6E8000-memory.dmp

Filesize
992KB

Download
memory/320-89-0x000007FEFADC0000-0x000007FEFADF4000-memory.dmp

Filesize
208KB

Download
memory/320-96-0x000007FEF63D0000-0x000007FEF6684000-memory.dmp

Filesize
2.7MB

Download
memory/320-101-0x000007FEF5030000-0x000007FEF60DB000-memory.dmp

Filesize
16.7MB

Download
memory/320-112-0x000007FEF3920000-0x000007FEF3A32000-memory.dmp

Filesize
1.1MB

Download