Analysis

  • max time kernel
    1774s
  • max time network
    1588s
  • platform
    windows7_x64
  • resource
    win7-20231025-en
  • resource tags

    arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
  • submitted
    27-11-2023 01:28

General

  • Target

    Desktop - Copy (15).rar

  • Size

    32KB

  • MD5

    fcb7c9384859a7e7737a0b3e8b323135

  • SHA1

    3c79508ff1736f3792fce459818ca0fdac6e3deb

  • SHA256

    2f88a8062606f74795d5ec0a5f465066304635d6af0eafd7db79207e09203352

  • SHA512

    9a4eeb5f8347000d90e26c4f87495f6c419ddbd6b9eaf5a763c4366533cbd741e59a0236c7ad97dd65babdf7e64b6ddec89c9ceddb23943987ab4b4c44bbb6a0

  • SSDEEP

    768:P07PVreHgzrPODgE6nwdCexOLLjp1IE6g1IE6u1IE6b1IE6k1IE6k1IE6NY1IE6X:P07PVreGPODg1wdCexOLLjvIOIMIRIKO

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Desktop - Copy (15).rar"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Desktop - Copy (15).rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2692
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Desktop - Copy (15).rar"
        3⤵
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2736

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2736-24-0x000000013F130000-0x000000013F228000-memory.dmp

    Filesize

    992KB

  • memory/2736-25-0x000007FEF74D0000-0x000007FEF7504000-memory.dmp

    Filesize

    208KB

  • memory/2736-26-0x000007FEF5B30000-0x000007FEF5DE4000-memory.dmp

    Filesize

    2.7MB

  • memory/2736-27-0x000007FEFB5E0000-0x000007FEFB5F8000-memory.dmp

    Filesize

    96KB

  • memory/2736-28-0x000007FEF75B0000-0x000007FEF75C7000-memory.dmp

    Filesize

    92KB

  • memory/2736-29-0x000007FEF72F0000-0x000007FEF7301000-memory.dmp

    Filesize

    68KB

  • memory/2736-30-0x000007FEF72D0000-0x000007FEF72E7000-memory.dmp

    Filesize

    92KB

  • memory/2736-31-0x000007FEF67B0000-0x000007FEF67C1000-memory.dmp

    Filesize

    68KB

  • memory/2736-32-0x000007FEF6790000-0x000007FEF67AD000-memory.dmp

    Filesize

    116KB

  • memory/2736-33-0x000007FEF6770000-0x000007FEF6781000-memory.dmp

    Filesize

    68KB

  • memory/2736-34-0x000007FEF4A80000-0x000007FEF5B2B000-memory.dmp

    Filesize

    16.7MB

  • memory/2736-35-0x000007FEF4880000-0x000007FEF4A80000-memory.dmp

    Filesize

    2.0MB

  • memory/2736-36-0x000007FEF6230000-0x000007FEF626F000-memory.dmp

    Filesize

    252KB

  • memory/2736-37-0x000007FEF6740000-0x000007FEF6761000-memory.dmp

    Filesize

    132KB

  • memory/2736-38-0x000007FEF6210000-0x000007FEF6228000-memory.dmp

    Filesize

    96KB

  • memory/2736-39-0x000007FEF61F0000-0x000007FEF6201000-memory.dmp

    Filesize

    68KB

  • memory/2736-41-0x000007FEF61B0000-0x000007FEF61C1000-memory.dmp

    Filesize

    68KB

  • memory/2736-43-0x000007FEF6170000-0x000007FEF6181000-memory.dmp

    Filesize

    68KB

  • memory/2736-42-0x000007FEF6190000-0x000007FEF61AB000-memory.dmp

    Filesize

    108KB

  • memory/2736-44-0x000007FEF4860000-0x000007FEF4878000-memory.dmp

    Filesize

    96KB

  • memory/2736-45-0x000007FEF4830000-0x000007FEF4860000-memory.dmp

    Filesize

    192KB

  • memory/2736-40-0x000007FEF61D0000-0x000007FEF61E1000-memory.dmp

    Filesize

    68KB

  • memory/2736-46-0x000007FEF47C0000-0x000007FEF4827000-memory.dmp

    Filesize

    412KB

  • memory/2736-47-0x000007FEF4750000-0x000007FEF47BF000-memory.dmp

    Filesize

    444KB

  • memory/2736-48-0x000007FEF4730000-0x000007FEF4741000-memory.dmp

    Filesize

    68KB

  • memory/2736-49-0x000007FEF46D0000-0x000007FEF4726000-memory.dmp

    Filesize

    344KB

  • memory/2736-50-0x000007FEF46A0000-0x000007FEF46C8000-memory.dmp

    Filesize

    160KB

  • memory/2736-51-0x000007FEF4670000-0x000007FEF4694000-memory.dmp

    Filesize

    144KB

  • memory/2736-53-0x000007FEF4620000-0x000007FEF4643000-memory.dmp

    Filesize

    140KB

  • memory/2736-55-0x000007FEFA710000-0x000007FEFA722000-memory.dmp

    Filesize

    72KB

  • memory/2736-56-0x000007FEFA6C0000-0x000007FEFA6E1000-memory.dmp

    Filesize

    132KB

  • memory/2736-54-0x000007FEFA730000-0x000007FEFA741000-memory.dmp

    Filesize

    68KB

  • memory/2736-57-0x000007FEFA6A0000-0x000007FEFA6B3000-memory.dmp

    Filesize

    76KB

  • memory/2736-58-0x000007FEFA680000-0x000007FEFA692000-memory.dmp

    Filesize

    72KB

  • memory/2736-52-0x000007FEF4650000-0x000007FEF4667000-memory.dmp

    Filesize

    92KB

  • memory/2736-59-0x000007FEF44E0000-0x000007FEF461B000-memory.dmp

    Filesize

    1.2MB

  • memory/2736-60-0x000007FEF4490000-0x000007FEF44BC000-memory.dmp

    Filesize

    176KB

  • memory/2736-61-0x000007FEF42D0000-0x000007FEF4482000-memory.dmp

    Filesize

    1.7MB

  • memory/2736-62-0x000007FEF4270000-0x000007FEF42CC000-memory.dmp

    Filesize

    368KB

  • memory/2736-63-0x000007FEF4250000-0x000007FEF4261000-memory.dmp

    Filesize

    68KB

  • memory/2736-64-0x000007FEF40E0000-0x000007FEF4177000-memory.dmp

    Filesize

    604KB

  • memory/2736-65-0x000007FEF40C0000-0x000007FEF40D2000-memory.dmp

    Filesize

    72KB

  • memory/2736-66-0x000007FEF3E80000-0x000007FEF40B1000-memory.dmp

    Filesize

    2.2MB

  • memory/2736-67-0x000007FEF3D60000-0x000007FEF3E72000-memory.dmp

    Filesize

    1.1MB

  • memory/2736-68-0x000007FEF3C80000-0x000007FEF3CB5000-memory.dmp

    Filesize

    212KB

  • memory/2736-69-0x000007FEF3C50000-0x000007FEF3C75000-memory.dmp

    Filesize

    148KB

  • memory/2736-70-0x000007FEF3C30000-0x000007FEF3C41000-memory.dmp

    Filesize

    68KB

  • memory/2736-71-0x000007FEF3BC0000-0x000007FEF3C21000-memory.dmp

    Filesize

    388KB

  • memory/2736-72-0x000007FEF3BA0000-0x000007FEF3BB1000-memory.dmp

    Filesize

    68KB

  • memory/2736-73-0x000007FEF3B80000-0x000007FEF3B92000-memory.dmp

    Filesize

    72KB

  • memory/2736-74-0x000007FEF3B60000-0x000007FEF3B73000-memory.dmp

    Filesize

    76KB

  • memory/2736-75-0x000007FEF3870000-0x000007FEF390F000-memory.dmp

    Filesize

    636KB

  • memory/2736-76-0x000007FEF3850000-0x000007FEF3861000-memory.dmp

    Filesize

    68KB

  • memory/2736-77-0x000007FEF3740000-0x000007FEF3842000-memory.dmp

    Filesize

    1.0MB

  • memory/2736-78-0x000007FEF3320000-0x000007FEF3331000-memory.dmp

    Filesize

    68KB

  • memory/2736-79-0x000007FEF3300000-0x000007FEF3311000-memory.dmp

    Filesize

    68KB

  • memory/2736-80-0x000007FEF32E0000-0x000007FEF32F1000-memory.dmp

    Filesize

    68KB

  • memory/2736-81-0x000007FEF32C0000-0x000007FEF32D2000-memory.dmp

    Filesize

    72KB

  • memory/2736-82-0x000007FEF32A0000-0x000007FEF32B8000-memory.dmp

    Filesize

    96KB

  • memory/2736-83-0x000007FEF3160000-0x000007FEF3176000-memory.dmp

    Filesize

    88KB

  • memory/2736-84-0x000007FEF30F0000-0x000007FEF3119000-memory.dmp

    Filesize

    164KB

  • memory/2736-85-0x000007FEF30D0000-0x000007FEF30E2000-memory.dmp

    Filesize

    72KB

  • memory/2736-86-0x000007FEF3040000-0x000007FEF3051000-memory.dmp

    Filesize

    68KB

  • memory/2736-87-0x000007FEF3020000-0x000007FEF3031000-memory.dmp

    Filesize

    68KB