Analysis

  • max time kernel
    138s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231025-en
  • resource tags

    arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
  • submitted
    26-11-2023 01:23

General

  • Target

    x360ce.rar

  • Size

    2.1MB

  • MD5

    7f2fc7ca453e2cc711b59ce3a9a516be

  • SHA1

    088396d627cbfed7914261076b9c9bb587aa5dcc

  • SHA256

    c3def36b65e2a13f5675b68c5a60842935240580c71ba559a3cd1efc6843f676

  • SHA512

    637652878485d245aee43ddafe430a5015878eaa3998345ea00fa291e3ce55a161a578ba1edb9990e9038d95ce312dc5af48bc5ea39ea90b57bef071e56bdbe6

  • SSDEEP

    49152:YhQ+I8PIvjR/fRpz4gGkp1wxYj2Yk1OsiPV:YhQ+zkJfRpz4goxYjHV

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\x360ce.rar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:856
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\x360ce.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2760
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\x360ce.rar"
        3⤵
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2756

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2756-29-0x000000013FAD0000-0x000000013FBC8000-memory.dmp

    Filesize

    992KB

  • memory/2756-30-0x000007FEF7A80000-0x000007FEF7AB4000-memory.dmp

    Filesize

    208KB

  • memory/2756-31-0x000007FEF6150000-0x000007FEF6404000-memory.dmp

    Filesize

    2.7MB

  • memory/2756-32-0x000007FEFB800000-0x000007FEFB818000-memory.dmp

    Filesize

    96KB

  • memory/2756-33-0x000007FEF7BD0000-0x000007FEF7BE7000-memory.dmp

    Filesize

    92KB

  • memory/2756-34-0x000007FEF7360000-0x000007FEF7371000-memory.dmp

    Filesize

    68KB

  • memory/2756-35-0x000007FEF6D40000-0x000007FEF6D57000-memory.dmp

    Filesize

    92KB

  • memory/2756-36-0x000007FEF6D20000-0x000007FEF6D31000-memory.dmp

    Filesize

    68KB

  • memory/2756-37-0x000007FEF6D00000-0x000007FEF6D1D000-memory.dmp

    Filesize

    116KB

  • memory/2756-38-0x000007FEF6CE0000-0x000007FEF6CF1000-memory.dmp

    Filesize

    68KB

  • memory/2756-39-0x000007FEF50A0000-0x000007FEF614B000-memory.dmp

    Filesize

    16.7MB

  • memory/2756-40-0x000007FEF4EA0000-0x000007FEF50A0000-memory.dmp

    Filesize

    2.0MB

  • memory/2756-41-0x000007FEF6850000-0x000007FEF688F000-memory.dmp

    Filesize

    252KB

  • memory/2756-42-0x000007FEF6820000-0x000007FEF6841000-memory.dmp

    Filesize

    132KB

  • memory/2756-43-0x000007FEF6800000-0x000007FEF6818000-memory.dmp

    Filesize

    96KB

  • memory/2756-44-0x000007FEF67E0000-0x000007FEF67F1000-memory.dmp

    Filesize

    68KB

  • memory/2756-45-0x000007FEF67A0000-0x000007FEF67B1000-memory.dmp

    Filesize

    68KB

  • memory/2756-46-0x000007FEF6780000-0x000007FEF6791000-memory.dmp

    Filesize

    68KB

  • memory/2756-47-0x000007FEF4E20000-0x000007FEF4E3B000-memory.dmp

    Filesize

    108KB

  • memory/2756-49-0x000007FEF4E60000-0x000007FEF4E78000-memory.dmp

    Filesize

    96KB

  • memory/2756-48-0x000007FEF4E80000-0x000007FEF4E91000-memory.dmp

    Filesize

    68KB

  • memory/2756-50-0x000007FEF4DF0000-0x000007FEF4E20000-memory.dmp

    Filesize

    192KB

  • memory/2756-51-0x000007FEF4D80000-0x000007FEF4DE7000-memory.dmp

    Filesize

    412KB

  • memory/2756-52-0x000007FEF4BA0000-0x000007FEF4C0F000-memory.dmp

    Filesize

    444KB

  • memory/2756-53-0x000007FEF4E40000-0x000007FEF4E51000-memory.dmp

    Filesize

    68KB

  • memory/2756-54-0x000007FEF4B40000-0x000007FEF4B96000-memory.dmp

    Filesize

    344KB

  • memory/2756-55-0x000007FEF4B10000-0x000007FEF4B38000-memory.dmp

    Filesize

    160KB

  • memory/2756-56-0x000007FEF4AE0000-0x000007FEF4B04000-memory.dmp

    Filesize

    144KB

  • memory/2756-57-0x000007FEF4AC0000-0x000007FEF4AD7000-memory.dmp

    Filesize

    92KB

  • memory/2756-58-0x000007FEF4A00000-0x000007FEF4A23000-memory.dmp

    Filesize

    140KB

  • memory/2756-59-0x000007FEF4AA0000-0x000007FEF4AB1000-memory.dmp

    Filesize

    68KB

  • memory/2756-60-0x000007FEF4A80000-0x000007FEF4A92000-memory.dmp

    Filesize

    72KB

  • memory/2756-61-0x000007FEF4A50000-0x000007FEF4A71000-memory.dmp

    Filesize

    132KB

  • memory/2756-62-0x000007FEF4A30000-0x000007FEF4A43000-memory.dmp

    Filesize

    76KB

  • memory/2756-63-0x000007FEF49E0000-0x000007FEF49F2000-memory.dmp

    Filesize

    72KB

  • memory/2756-64-0x000007FEF4270000-0x000007FEF43AB000-memory.dmp

    Filesize

    1.2MB

  • memory/2756-65-0x000007FEF3CF0000-0x000007FEF3D1C000-memory.dmp

    Filesize

    176KB

  • memory/2756-66-0x000007FEF3B30000-0x000007FEF3CE2000-memory.dmp

    Filesize

    1.7MB

  • memory/2756-67-0x000007FEF3740000-0x000007FEF379C000-memory.dmp

    Filesize

    368KB

  • memory/2756-68-0x000007FEF3720000-0x000007FEF3731000-memory.dmp

    Filesize

    68KB

  • memory/2756-69-0x000007FEF3610000-0x000007FEF36A7000-memory.dmp

    Filesize

    604KB

  • memory/2756-70-0x000007FEF35F0000-0x000007FEF3602000-memory.dmp

    Filesize

    72KB

  • memory/2756-71-0x000007FEF33B0000-0x000007FEF35E1000-memory.dmp

    Filesize

    2.2MB

  • memory/2756-72-0x000007FEF3190000-0x000007FEF32A2000-memory.dmp

    Filesize

    1.1MB

  • memory/2756-75-0x000007FEF3100000-0x000007FEF3111000-memory.dmp

    Filesize

    68KB

  • memory/2756-78-0x000007FEF3050000-0x000007FEF3062000-memory.dmp

    Filesize

    72KB

  • memory/2756-79-0x000007FEF3030000-0x000007FEF3043000-memory.dmp

    Filesize

    76KB

  • memory/2756-77-0x000007FEF3070000-0x000007FEF3081000-memory.dmp

    Filesize

    68KB

  • memory/2756-76-0x000007FEF3090000-0x000007FEF30F1000-memory.dmp

    Filesize

    388KB

  • memory/2756-74-0x000007FEF3120000-0x000007FEF3145000-memory.dmp

    Filesize

    148KB

  • memory/2756-73-0x000007FEF3150000-0x000007FEF3185000-memory.dmp

    Filesize

    212KB

  • memory/2756-80-0x000007FEF2F90000-0x000007FEF302F000-memory.dmp

    Filesize

    636KB

  • memory/2756-81-0x000007FEF2F70000-0x000007FEF2F81000-memory.dmp

    Filesize

    68KB

  • memory/2756-82-0x000007FEF2E60000-0x000007FEF2F62000-memory.dmp

    Filesize

    1.0MB

  • memory/2756-83-0x000007FEF2E40000-0x000007FEF2E51000-memory.dmp

    Filesize

    68KB

  • memory/2756-84-0x000007FEF2E20000-0x000007FEF2E31000-memory.dmp

    Filesize

    68KB

  • memory/2756-85-0x000007FEF2E00000-0x000007FEF2E11000-memory.dmp

    Filesize

    68KB

  • memory/2756-87-0x000007FEF2DC0000-0x000007FEF2DD8000-memory.dmp

    Filesize

    96KB

  • memory/2756-86-0x000007FEF2DE0000-0x000007FEF2DF2000-memory.dmp

    Filesize

    72KB

  • memory/2756-88-0x000007FEF2DA0000-0x000007FEF2DB6000-memory.dmp

    Filesize

    88KB

  • memory/2756-89-0x000007FEF2D70000-0x000007FEF2D99000-memory.dmp

    Filesize

    164KB

  • memory/2756-90-0x000007FEF2D50000-0x000007FEF2D62000-memory.dmp

    Filesize

    72KB

  • memory/2756-91-0x000007FEF2D30000-0x000007FEF2D41000-memory.dmp

    Filesize

    68KB

  • memory/2756-92-0x000007FEF2D10000-0x000007FEF2D21000-memory.dmp

    Filesize

    68KB