Analysis

  • max time kernel
    1770s
  • max time network
    1652s
  • platform
    windows7_x64
  • resource
    win7-20230703-en
  • resource tags

    arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
  • submitted
    12-07-2023 01:13

General

  • Target

    MC LAUNCHER.rar

  • Size

    254KB

  • MD5

    fe0b0249d2ae44e9ed458b2e267b81aa

  • SHA1

    8bf9d8d73adb078513e38058d6db96ed9ac4f8fb

  • SHA256

    b2ed92361b143b7e8d3a78c20ac9b3a11a03c3cee9af9fdf75a4dc57d4b68e74

  • SHA512

    29e4982206f96808526bf1a49a413589b88e9e1f676f749c98eb4be128f502478fdd493e0e72d2ec57e4f1b255b83d73f97ad60646eda6f161591e9a639e305b

  • SSDEEP

    6144:NLdA/4zWv196TU0BwZb016Zub/JWABzMMA+qr:NLwiWvVFKQaBWAdMP

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\MC LAUNCHER.rar"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2408
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MC LAUNCHER.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1060
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\MC LAUNCHER.rar"
        3⤵
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2036

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2036-78-0x000000013F4B0000-0x000000013F5A8000-memory.dmp

    Filesize

    992KB

  • memory/2036-79-0x000007FEF6BC0000-0x000007FEF6BF4000-memory.dmp

    Filesize

    208KB

  • memory/2036-80-0x000007FEF61A0000-0x000007FEF6454000-memory.dmp

    Filesize

    2.7MB

  • memory/2036-81-0x000007FEF6BA0000-0x000007FEF6BB8000-memory.dmp

    Filesize

    96KB

  • memory/2036-82-0x000007FEF65F0000-0x000007FEF6607000-memory.dmp

    Filesize

    92KB

  • memory/2036-83-0x000007FEF65D0000-0x000007FEF65E1000-memory.dmp

    Filesize

    68KB

  • memory/2036-84-0x000007FEF65B0000-0x000007FEF65C7000-memory.dmp

    Filesize

    92KB

  • memory/2036-85-0x000007FEF6180000-0x000007FEF6191000-memory.dmp

    Filesize

    68KB

  • memory/2036-86-0x000007FEF6160000-0x000007FEF617D000-memory.dmp

    Filesize

    116KB

  • memory/2036-87-0x000007FEF6100000-0x000007FEF6111000-memory.dmp

    Filesize

    68KB

  • memory/2036-88-0x000007FEF5F00000-0x000007FEF6100000-memory.dmp

    Filesize

    2.0MB

  • memory/2036-89-0x000007FEF4E50000-0x000007FEF5EFB000-memory.dmp

    Filesize

    16.7MB

  • memory/2036-90-0x000007FEF4E10000-0x000007FEF4E4F000-memory.dmp

    Filesize

    252KB

  • memory/2036-91-0x000007FEF4DE0000-0x000007FEF4E01000-memory.dmp

    Filesize

    132KB

  • memory/2036-92-0x000007FEF4DC0000-0x000007FEF4DD8000-memory.dmp

    Filesize

    96KB

  • memory/2036-94-0x000007FEF4D80000-0x000007FEF4D91000-memory.dmp

    Filesize

    68KB

  • memory/2036-95-0x000007FEF4D60000-0x000007FEF4D71000-memory.dmp

    Filesize

    68KB

  • memory/2036-96-0x000007FEF4D40000-0x000007FEF4D5B000-memory.dmp

    Filesize

    108KB

  • memory/2036-97-0x000007FEF4D20000-0x000007FEF4D31000-memory.dmp

    Filesize

    68KB

  • memory/2036-93-0x000007FEF4DA0000-0x000007FEF4DB1000-memory.dmp

    Filesize

    68KB

  • memory/2036-98-0x000007FEF4D00000-0x000007FEF4D18000-memory.dmp

    Filesize

    96KB

  • memory/2036-99-0x000007FEF4CD0000-0x000007FEF4D00000-memory.dmp

    Filesize

    192KB

  • memory/2036-100-0x000007FEF4C60000-0x000007FEF4CC7000-memory.dmp

    Filesize

    412KB

  • memory/2036-101-0x000007FEF4BF0000-0x000007FEF4C5F000-memory.dmp

    Filesize

    444KB

  • memory/2036-102-0x000007FEF4BD0000-0x000007FEF4BE1000-memory.dmp

    Filesize

    68KB

  • memory/2036-103-0x000007FEF4B70000-0x000007FEF4BC6000-memory.dmp

    Filesize

    344KB

  • memory/2036-104-0x000007FEF4B40000-0x000007FEF4B68000-memory.dmp

    Filesize

    160KB

  • memory/2036-105-0x000007FEF4B10000-0x000007FEF4B34000-memory.dmp

    Filesize

    144KB

  • memory/2036-106-0x000007FEF4AF0000-0x000007FEF4B07000-memory.dmp

    Filesize

    92KB

  • memory/2036-107-0x000007FEF4AC0000-0x000007FEF4AE3000-memory.dmp

    Filesize

    140KB

  • memory/2036-108-0x000007FEF4AA0000-0x000007FEF4AB1000-memory.dmp

    Filesize

    68KB

  • memory/2036-109-0x000007FEF4A80000-0x000007FEF4A92000-memory.dmp

    Filesize

    72KB

  • memory/2036-110-0x000007FEF4A50000-0x000007FEF4A71000-memory.dmp

    Filesize

    132KB

  • memory/2036-111-0x000007FEF4A30000-0x000007FEF4A43000-memory.dmp

    Filesize

    76KB

  • memory/2036-112-0x000007FEF4A10000-0x000007FEF4A22000-memory.dmp

    Filesize

    72KB

  • memory/2036-113-0x000007FEF48D0000-0x000007FEF4A0B000-memory.dmp

    Filesize

    1.2MB

  • memory/2036-114-0x000007FEF48A0000-0x000007FEF48CC000-memory.dmp

    Filesize

    176KB

  • memory/2036-115-0x000007FEF46E0000-0x000007FEF4892000-memory.dmp

    Filesize

    1.7MB

  • memory/2036-116-0x000007FEF4510000-0x000007FEF456C000-memory.dmp

    Filesize

    368KB

  • memory/2036-117-0x000007FEF44F0000-0x000007FEF4501000-memory.dmp

    Filesize

    68KB

  • memory/2036-118-0x000007FEF4450000-0x000007FEF44E7000-memory.dmp

    Filesize

    604KB

  • memory/2036-119-0x000007FEF4210000-0x000007FEF4222000-memory.dmp

    Filesize

    72KB

  • memory/2036-120-0x000007FEF3F60000-0x000007FEF4191000-memory.dmp

    Filesize

    2.2MB

  • memory/2036-121-0x000007FEF3BF0000-0x000007FEF3D02000-memory.dmp

    Filesize

    1.1MB

  • memory/2036-122-0x000007FEF3BB0000-0x000007FEF3BE5000-memory.dmp

    Filesize

    212KB

  • memory/2036-123-0x000007FEF3B80000-0x000007FEF3BA5000-memory.dmp

    Filesize

    148KB

  • memory/2036-124-0x000007FEF3B60000-0x000007FEF3B71000-memory.dmp

    Filesize

    68KB

  • memory/2036-125-0x000007FEF3AF0000-0x000007FEF3B51000-memory.dmp

    Filesize

    388KB

  • memory/2036-126-0x000007FEF3AD0000-0x000007FEF3AE1000-memory.dmp

    Filesize

    68KB

  • memory/2036-127-0x000007FEF3640000-0x000007FEF3652000-memory.dmp

    Filesize

    72KB

  • memory/2036-128-0x000007FEF35B0000-0x000007FEF35C3000-memory.dmp

    Filesize

    76KB

  • memory/2036-129-0x000007FEF3350000-0x000007FEF33EF000-memory.dmp

    Filesize

    636KB

  • memory/2036-130-0x000007FEF3330000-0x000007FEF3341000-memory.dmp

    Filesize

    68KB

  • memory/2036-131-0x000007FEF3220000-0x000007FEF3322000-memory.dmp

    Filesize

    1.0MB

  • memory/2036-132-0x000007FEF2CD0000-0x000007FEF2CE1000-memory.dmp

    Filesize

    68KB

  • memory/2036-133-0x000007FEF2C90000-0x000007FEF2CA1000-memory.dmp

    Filesize

    68KB

  • memory/2036-134-0x000007FEF2C70000-0x000007FEF2C81000-memory.dmp

    Filesize

    68KB

  • memory/2036-135-0x000007FEF2C50000-0x000007FEF2C62000-memory.dmp

    Filesize

    72KB

  • memory/2036-136-0x000007FEF2C30000-0x000007FEF2C48000-memory.dmp

    Filesize

    96KB

  • memory/2036-137-0x000007FEF2C10000-0x000007FEF2C26000-memory.dmp

    Filesize

    88KB

  • memory/2036-138-0x000007FEF2BE0000-0x000007FEF2C09000-memory.dmp

    Filesize

    164KB

  • memory/2036-139-0x000007FEF2BC0000-0x000007FEF2BD2000-memory.dmp

    Filesize

    72KB

  • memory/2036-140-0x000007FEF2BA0000-0x000007FEF2BB1000-memory.dmp

    Filesize

    68KB

  • memory/2036-141-0x000007FEF2B80000-0x000007FEF2B91000-memory.dmp

    Filesize

    68KB