a33443c6603faec9d3bd8d8afd97259308fa4cf7c52332746eca9399c1b97194

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
20/09/2023, 08:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

隔離區文件/RAVCpl64.exe
Size

13.7MB
MD5

f1363f6db44920e4f668be961411a9e4
SHA1

1f4af57cae61b29276f9bef8050d38fda59f81af
SHA256

492e4d4dbc083db1177de5acf82b4542b27fcfb9bac3e79f2097ad98724f6e90
SHA512

9af91c39a03db5c58cf7fba815052120724d9307eaa2454c64ec11c003e6d73290fe910bb2d7ff2c756e042076cb3b6ef98761ea47063b1d56b5d4b162a75b18
SSDEEP

98304:7nsmtk2aBs6qoBMtXwVfbd6vVXEowWaSlVTePFSxch78o79WbjpZ61nMb7xgcsNQ:jLcXqTWeFT3Ymt2yOHTHaxRWcUdax

Score

8^/10

persistence

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\lsass.exe	._cache_RAVCpl64.exe
File created	C:\Windows\SysWOW64\drivers\lsass.exe	lsass.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cmd.pif	lsass.exe

Executes dropped EXE 3 IoCs

pid	Process
2888	._cache_RAVCpl64.exe
2800	lsass.exe
2596	._cache_RAVCpl64.~tmp

Loads dropped DLL 5 IoCs

pid	Process
2256	RAVCpl64.exe
2256	RAVCpl64.exe
2888	._cache_RAVCpl64.exe
2888	._cache_RAVCpl64.exe
2888	._cache_RAVCpl64.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	RAVCpl64.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	lsass.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Control Panel\don't load	._cache_RAVCpl64.~tmp

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2888	._cache_RAVCpl64.exe
2888	._cache_RAVCpl64.exe
2800	lsass.exe
2800	lsass.exe
2596	._cache_RAVCpl64.~tmp
2596	._cache_RAVCpl64.~tmp
2596	._cache_RAVCpl64.~tmp
2596	._cache_RAVCpl64.~tmp
2596	._cache_RAVCpl64.~tmp

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2888	2256	RAVCpl64.exe	28
PID 2256 wrote to memory of 2888	2256	RAVCpl64.exe	28
PID 2256 wrote to memory of 2888	2256	RAVCpl64.exe	28
PID 2256 wrote to memory of 2888	2256	RAVCpl64.exe	28
PID 2888 wrote to memory of 2800	2888	._cache_RAVCpl64.exe	29
PID 2888 wrote to memory of 2800	2888	._cache_RAVCpl64.exe	29
PID 2888 wrote to memory of 2800	2888	._cache_RAVCpl64.exe	29
PID 2888 wrote to memory of 2800	2888	._cache_RAVCpl64.exe	29
PID 2888 wrote to memory of 2596	2888	._cache_RAVCpl64.exe	30
PID 2888 wrote to memory of 2596	2888	._cache_RAVCpl64.exe	30
PID 2888 wrote to memory of 2596	2888	._cache_RAVCpl64.exe	30
PID 2888 wrote to memory of 2596	2888	._cache_RAVCpl64.exe	30

C:\Users\Admin\AppData\Local\Temp\隔離區文件\RAVCpl64.exe
"C:\Users\Admin\AppData\Local\Temp\隔離區文件\RAVCpl64.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\._cache_RAVCpl64.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_RAVCpl64.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\SysWOW64\drivers\lsass.exe
    "C:\Windows\system32\drivers\lsass.exe"
    3⤵
    - Drops file in Drivers directory
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Suspicious use of SetWindowsHookEx
    PID:2800
- - C:\Users\Admin\AppData\Local\Temp\._cache_RAVCpl64.~tmp
    "C:\Users\Admin\AppData\Local\Temp\._cache_RAVCpl64.~tmp"
    3⤵
    - Executes dropped EXE
    - Modifies Control Panel
    - Suspicious use of SetWindowsHookEx
    PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\._cache_RAVCpl64.exe

Filesize
13.0MB

MD5
6c7394ed1351a842391a678afb6292f1

SHA1
a4c6a95bb898f8e7867841b5f469b119e44155bb

SHA256
fc38b09a5a236819d9e0afeadbcea51bc97b4fbede57dcce9de7d19b6fc4f288

SHA512
05b42adefdea0ff063c14ca845ab583249dc741f4c5b1a0dacf4ebe05eca0f846a964e227c1d169b714905e8215ffd754c4a3c39b0944553bd851c2d4c632dc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_RAVCpl64.exe

Filesize
13.0MB

MD5
6c7394ed1351a842391a678afb6292f1

SHA1
a4c6a95bb898f8e7867841b5f469b119e44155bb

SHA256
fc38b09a5a236819d9e0afeadbcea51bc97b4fbede57dcce9de7d19b6fc4f288

SHA512
05b42adefdea0ff063c14ca845ab583249dc741f4c5b1a0dacf4ebe05eca0f846a964e227c1d169b714905e8215ffd754c4a3c39b0944553bd851c2d4c632dc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_RAVCpl64.exe

Filesize
13.0MB

MD5
6c7394ed1351a842391a678afb6292f1

SHA1
a4c6a95bb898f8e7867841b5f469b119e44155bb

SHA256
fc38b09a5a236819d9e0afeadbcea51bc97b4fbede57dcce9de7d19b6fc4f288

SHA512
05b42adefdea0ff063c14ca845ab583249dc741f4c5b1a0dacf4ebe05eca0f846a964e227c1d169b714905e8215ffd754c4a3c39b0944553bd851c2d4c632dc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_RAVCpl64.~tmp

Filesize
12.9MB

MD5
fb8008f6a25ef6df72057b9bd642f3b9

SHA1
42e3e4068f1fe3a58532927b55023745129a6cc5

SHA256
89de6c2e05bb8e2e151076d4f192b30268aaa3f61247ebf1b24cc6d8aee8386c

SHA512
268bd474094aff2bf65c35cddd959d821dfe18026a826dbfebe98b54d7048eb3bb3ff2daacbe920ed67e1ae53ed6e8ffbbac09c94dee278d45da19aa791c8bdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_RAVCpl64.~tmp

Filesize
12.9MB

MD5
fb8008f6a25ef6df72057b9bd642f3b9

SHA1
42e3e4068f1fe3a58532927b55023745129a6cc5

SHA256
89de6c2e05bb8e2e151076d4f192b30268aaa3f61247ebf1b24cc6d8aee8386c

SHA512
268bd474094aff2bf65c35cddd959d821dfe18026a826dbfebe98b54d7048eb3bb3ff2daacbe920ed67e1ae53ed6e8ffbbac09c94dee278d45da19aa791c8bdd

Download Submit
C:\Windows\SysWOW64\drivers\lsass.exe

Filesize
32KB

MD5
007b4d557984229bdc98e9f3a6fcae05

SHA1
d7bdbb4f3ba427d1362429645efd242e2a7e1448

SHA256
9c503850af6ce9e4598007e1581694f389e9ad1b4fb78ca1b96170555dafb532

SHA512
18b3ab76d5e421fbcaf12dfbc74ad717823ca57adfc663e615a3862d05e276177683e89916003cca849666f1cb84869a7773ebf775abb969d26776997114dd88

Download Submit
C:\Windows\SysWOW64\drivers\lsass.exe

Filesize
32KB

MD5
007b4d557984229bdc98e9f3a6fcae05

SHA1
d7bdbb4f3ba427d1362429645efd242e2a7e1448

SHA256
9c503850af6ce9e4598007e1581694f389e9ad1b4fb78ca1b96170555dafb532

SHA512
18b3ab76d5e421fbcaf12dfbc74ad717823ca57adfc663e615a3862d05e276177683e89916003cca849666f1cb84869a7773ebf775abb969d26776997114dd88

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_RAVCpl64.exe

Filesize
13.0MB

MD5
6c7394ed1351a842391a678afb6292f1

SHA1
a4c6a95bb898f8e7867841b5f469b119e44155bb

SHA256
fc38b09a5a236819d9e0afeadbcea51bc97b4fbede57dcce9de7d19b6fc4f288

SHA512
05b42adefdea0ff063c14ca845ab583249dc741f4c5b1a0dacf4ebe05eca0f846a964e227c1d169b714905e8215ffd754c4a3c39b0944553bd851c2d4c632dc3

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_RAVCpl64.exe

Filesize
13.0MB

MD5
6c7394ed1351a842391a678afb6292f1

SHA1
a4c6a95bb898f8e7867841b5f469b119e44155bb

SHA256
fc38b09a5a236819d9e0afeadbcea51bc97b4fbede57dcce9de7d19b6fc4f288

SHA512
05b42adefdea0ff063c14ca845ab583249dc741f4c5b1a0dacf4ebe05eca0f846a964e227c1d169b714905e8215ffd754c4a3c39b0944553bd851c2d4c632dc3

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_RAVCpl64.~tmp

Filesize
12.9MB

MD5
fb8008f6a25ef6df72057b9bd642f3b9

SHA1
42e3e4068f1fe3a58532927b55023745129a6cc5

SHA256
89de6c2e05bb8e2e151076d4f192b30268aaa3f61247ebf1b24cc6d8aee8386c

SHA512
268bd474094aff2bf65c35cddd959d821dfe18026a826dbfebe98b54d7048eb3bb3ff2daacbe920ed67e1ae53ed6e8ffbbac09c94dee278d45da19aa791c8bdd

Download Submit
\Windows\SysWOW64\drivers\lsass.exe

Filesize
32KB

MD5
007b4d557984229bdc98e9f3a6fcae05

SHA1
d7bdbb4f3ba427d1362429645efd242e2a7e1448

SHA256
9c503850af6ce9e4598007e1581694f389e9ad1b4fb78ca1b96170555dafb532

SHA512
18b3ab76d5e421fbcaf12dfbc74ad717823ca57adfc663e615a3862d05e276177683e89916003cca849666f1cb84869a7773ebf775abb969d26776997114dd88

Download Submit
\Windows\SysWOW64\drivers\lsass.exe

Filesize
32KB

MD5
007b4d557984229bdc98e9f3a6fcae05

SHA1
d7bdbb4f3ba427d1362429645efd242e2a7e1448

SHA256
9c503850af6ce9e4598007e1581694f389e9ad1b4fb78ca1b96170555dafb532

SHA512
18b3ab76d5e421fbcaf12dfbc74ad717823ca57adfc663e615a3862d05e276177683e89916003cca849666f1cb84869a7773ebf775abb969d26776997114dd88

Download Submit
memory/2256-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2256-28-0x0000000000400000-0x00000000011B7000-memory.dmp

Filesize
13.7MB

Download
memory/2256-29-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads