Analysis

  • max time kernel
    145s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    24-09-2023 00:47

General

  • Target

    Sp3dyClient.rar

  • Size

    42KB

  • MD5

    a4ceef30ebf1e679728d2c72fb1265e0

  • SHA1

    5425bfe0d8725e3399d90798b466d963daeca20b

  • SHA256

    ecdc73cb673db78176483ae4e650790ddefbdc25de41e458ff1d68f456c6feb4

  • SHA512

    1b0e520e5dcd78740ad490510ec68e8f95ccaf3a16acf92ecb3ce6b2feeec352e9295de47033fccbe6c9b2aa12d0489d39800a795af49f1c6c8c145ced82c0a1

  • SSDEEP

    768:jN9C1mNJnB0el3/iOKfOeGU+6mFAPLHDDB8THzNM/VeKpnrqEERsI3wI:jN9OmXn1FidfOEmFirDNuCeKpnrMLAI

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Sp3dyClient.rar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1916
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Sp3dyClient.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2688
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Sp3dyClient.rar"
        3⤵
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2400

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2400-29-0x000000013F540000-0x000000013F638000-memory.dmp

    Filesize

    992KB

  • memory/2400-30-0x000007FEF7A20000-0x000007FEF7A54000-memory.dmp

    Filesize

    208KB

  • memory/2400-31-0x000007FEF6240000-0x000007FEF64F4000-memory.dmp

    Filesize

    2.7MB

  • memory/2400-32-0x000007FEFBFA0000-0x000007FEFBFB8000-memory.dmp

    Filesize

    96KB

  • memory/2400-33-0x000007FEF79E0000-0x000007FEF79F7000-memory.dmp

    Filesize

    92KB

  • memory/2400-34-0x000007FEF74C0000-0x000007FEF74D1000-memory.dmp

    Filesize

    68KB

  • memory/2400-35-0x000007FEF74A0000-0x000007FEF74B7000-memory.dmp

    Filesize

    92KB

  • memory/2400-36-0x000007FEF7480000-0x000007FEF7491000-memory.dmp

    Filesize

    68KB

  • memory/2400-37-0x000007FEF6EC0000-0x000007FEF6EDD000-memory.dmp

    Filesize

    116KB

  • memory/2400-38-0x000007FEF6EA0000-0x000007FEF6EB1000-memory.dmp

    Filesize

    68KB

  • memory/2400-39-0x000007FEF5190000-0x000007FEF623B000-memory.dmp

    Filesize

    16.7MB

  • memory/2400-40-0x000007FEF4D40000-0x000007FEF4F40000-memory.dmp

    Filesize

    2.0MB

  • memory/2400-41-0x000007FEF6E60000-0x000007FEF6E9F000-memory.dmp

    Filesize

    252KB

  • memory/2400-42-0x000007FEF6880000-0x000007FEF68A1000-memory.dmp

    Filesize

    132KB

  • memory/2400-43-0x000007FEF4920000-0x000007FEF4938000-memory.dmp

    Filesize

    96KB

  • memory/2400-45-0x000007FEF48E0000-0x000007FEF48F1000-memory.dmp

    Filesize

    68KB

  • memory/2400-46-0x000007FEF48C0000-0x000007FEF48D1000-memory.dmp

    Filesize

    68KB

  • memory/2400-48-0x000007FEF4630000-0x000007FEF4641000-memory.dmp

    Filesize

    68KB

  • memory/2400-49-0x000007FEF4610000-0x000007FEF4628000-memory.dmp

    Filesize

    96KB

  • memory/2400-50-0x000007FEF44E0000-0x000007FEF4510000-memory.dmp

    Filesize

    192KB

  • memory/2400-51-0x000007FEF4470000-0x000007FEF44D7000-memory.dmp

    Filesize

    412KB

  • memory/2400-47-0x000007FEF4650000-0x000007FEF466B000-memory.dmp

    Filesize

    108KB

  • memory/2400-44-0x000007FEF4900000-0x000007FEF4911000-memory.dmp

    Filesize

    68KB

  • memory/2400-52-0x000007FEF43C0000-0x000007FEF442F000-memory.dmp

    Filesize

    444KB

  • memory/2400-53-0x000007FEF43A0000-0x000007FEF43B1000-memory.dmp

    Filesize

    68KB

  • memory/2400-54-0x000007FEF4340000-0x000007FEF4396000-memory.dmp

    Filesize

    344KB

  • memory/2400-55-0x000007FEF4310000-0x000007FEF4338000-memory.dmp

    Filesize

    160KB

  • memory/2400-57-0x000007FEF42C0000-0x000007FEF42D7000-memory.dmp

    Filesize

    92KB

  • memory/2400-58-0x000007FEF4290000-0x000007FEF42B3000-memory.dmp

    Filesize

    140KB

  • memory/2400-60-0x000007FEF4250000-0x000007FEF4262000-memory.dmp

    Filesize

    72KB

  • memory/2400-59-0x000007FEF4270000-0x000007FEF4281000-memory.dmp

    Filesize

    68KB

  • memory/2400-63-0x000007FEF41E0000-0x000007FEF41F2000-memory.dmp

    Filesize

    72KB

  • memory/2400-62-0x000007FEF4200000-0x000007FEF4213000-memory.dmp

    Filesize

    76KB

  • memory/2400-61-0x000007FEF4220000-0x000007FEF4241000-memory.dmp

    Filesize

    132KB

  • memory/2400-56-0x000007FEF42E0000-0x000007FEF4304000-memory.dmp

    Filesize

    144KB

  • memory/2400-64-0x000007FEF40A0000-0x000007FEF41DB000-memory.dmp

    Filesize

    1.2MB

  • memory/2400-65-0x000007FEF4070000-0x000007FEF409C000-memory.dmp

    Filesize

    176KB

  • memory/2400-66-0x000007FEF3EB0000-0x000007FEF4062000-memory.dmp

    Filesize

    1.7MB

  • memory/2400-67-0x000007FEF3E50000-0x000007FEF3EAC000-memory.dmp

    Filesize

    368KB

  • memory/2400-68-0x000007FEF3E30000-0x000007FEF3E41000-memory.dmp

    Filesize

    68KB

  • memory/2400-69-0x000007FEF3D90000-0x000007FEF3E27000-memory.dmp

    Filesize

    604KB

  • memory/2400-70-0x000007FEF3D70000-0x000007FEF3D82000-memory.dmp

    Filesize

    72KB

  • memory/2400-71-0x000007FEF3B30000-0x000007FEF3D61000-memory.dmp

    Filesize

    2.2MB

  • memory/2400-72-0x000007FEF3A10000-0x000007FEF3B22000-memory.dmp

    Filesize

    1.1MB

  • memory/2400-73-0x000007FEF39D0000-0x000007FEF3A05000-memory.dmp

    Filesize

    212KB

  • memory/2400-74-0x000007FEF39A0000-0x000007FEF39C5000-memory.dmp

    Filesize

    148KB

  • memory/2400-75-0x000007FEF3980000-0x000007FEF3991000-memory.dmp

    Filesize

    68KB

  • memory/2400-76-0x000007FEF3910000-0x000007FEF3971000-memory.dmp

    Filesize

    388KB

  • memory/2400-77-0x000007FEF38F0000-0x000007FEF3901000-memory.dmp

    Filesize

    68KB

  • memory/2400-78-0x000007FEF38D0000-0x000007FEF38E2000-memory.dmp

    Filesize

    72KB

  • memory/2400-79-0x000007FEF38B0000-0x000007FEF38C3000-memory.dmp

    Filesize

    76KB

  • memory/2400-80-0x000007FEF3810000-0x000007FEF38AF000-memory.dmp

    Filesize

    636KB

  • memory/2400-81-0x000007FEF37F0000-0x000007FEF3801000-memory.dmp

    Filesize

    68KB

  • memory/2400-82-0x000007FEF36E0000-0x000007FEF37E2000-memory.dmp

    Filesize

    1.0MB

  • memory/2400-83-0x000007FEF36C0000-0x000007FEF36D1000-memory.dmp

    Filesize

    68KB

  • memory/2400-84-0x000007FEF36A0000-0x000007FEF36B1000-memory.dmp

    Filesize

    68KB

  • memory/2400-85-0x000007FEF3680000-0x000007FEF3691000-memory.dmp

    Filesize

    68KB

  • memory/2400-86-0x000007FEF3660000-0x000007FEF3672000-memory.dmp

    Filesize

    72KB

  • memory/2400-87-0x000007FEF3640000-0x000007FEF3658000-memory.dmp

    Filesize

    96KB

  • memory/2400-88-0x000007FEF3620000-0x000007FEF3636000-memory.dmp

    Filesize

    88KB

  • memory/2400-89-0x000007FEF35F0000-0x000007FEF3619000-memory.dmp

    Filesize

    164KB

  • memory/2400-90-0x000007FEF35D0000-0x000007FEF35E2000-memory.dmp

    Filesize

    72KB

  • memory/2400-91-0x000007FEF35B0000-0x000007FEF35C1000-memory.dmp

    Filesize

    68KB

  • memory/2400-92-0x000007FEF3590000-0x000007FEF35A1000-memory.dmp

    Filesize

    68KB