Analysis
-
max time kernel
138s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
25-07-2023 17:27
Static task
static1
Behavioral task
behavioral1
Sample
Launcher.rar
Resource
win7-20230712-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Launcher.rar
Resource
win10v2004-20230703-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
Launcher.rar
-
Size
2.1MB
-
MD5
e85d40ffaba3c7f06e61f2e7f9282292
-
SHA1
db0ced8c05e6fcac55ab4fe31752c1d469d8ec35
-
SHA256
965d9591ae9f1c6996f4212ff3685df4ef497fca20e118c4b58cca43cf35d34c
-
SHA512
33ea12dc8dba6eaa5018a613cd547f505b8d1b1cb0f1643e71f7d3399e08a0fcbe42df31893233b0fdf7b968eb75a085644726c106c7663549bf9f0fc02138b4
-
SSDEEP
49152:8zR19XcCCouSWphsoyE0kbgmH7aPsUCKVZQks1tKskkPM:sYvouJ8oF7gmH7aP9rVgKfsM
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2948 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2948 vlc.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 2948 vlc.exe 2948 vlc.exe 2948 vlc.exe 2948 vlc.exe 2948 vlc.exe 2948 vlc.exe 2948 vlc.exe 2948 vlc.exe 2948 vlc.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 2948 vlc.exe 2948 vlc.exe 2948 vlc.exe 2948 vlc.exe 2948 vlc.exe 2948 vlc.exe 2948 vlc.exe 2948 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2948 vlc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2428 wrote to memory of 2920 2428 cmd.exe 29 PID 2428 wrote to memory of 2920 2428 cmd.exe 29 PID 2428 wrote to memory of 2920 2428 cmd.exe 29 PID 2920 wrote to memory of 2948 2920 rundll32.exe 30 PID 2920 wrote to memory of 2948 2920 rundll32.exe 30 PID 2920 wrote to memory of 2948 2920 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Launcher.rar1⤵
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Launcher.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Launcher.rar"3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2948
-
-