Resubmissions
26-02-2024 17:10
240226-vpvjzsbh8x 1026-02-2024 17:07
240226-vm4pwabh5v 1019-02-2024 16:49
240219-vbqnwage7y 10Analysis
-
max time kernel
148s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
26-02-2024 17:07
General
-
Target
240219-tf7brafh73_pw_infected.zip
-
Size
3.3MB
-
MD5
a48e102a737c9c3506a98d766e466195
-
SHA1
13ce0d69d73a537e7745e47706aab5508f231dde
-
SHA256
07277482c7598874910acd36595298a91c63ac15986d4caf3b10c85833101336
-
SHA512
05e57c4d94f45c8c99910e5b802bb20758137bfb8a15b9b18a58f173847b90818b919c6c4c5a9ba7cd6a6991773cd2ce01ba454e56b09f19898ab64435bb6066
-
SSDEEP
49152:i+c0LBMP9X1iWaaVKd0jbkQy1uycb+xyIN+2kH+IRHVoAicMRD9zJthV:nBMlg/kKuf4BcbwyMIR1oLhzfhV
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\240219-tf7brafh73_pw_infected.zip1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\ExpandSend.dwg1⤵
- Modifies registry class
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vlc-3.0.20-win64.exe"C:\Users\Admin\AppData\Local\Temp\vlc-3.0.20-win64.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD532c1c9ae03fc910a9a61273942d1036c
SHA1bba7a1134140af918c35b35ca16dcb55b07747fa
SHA25685cd01d2f8051a4277e660a7bfe48f7216f73502bdb9393dda977d3c1db16f8c
SHA5124f38961fe7b15e59e0c833c98f3f445388dc6f3cf9bc9e024abfd4b9cbfbd665c4111809e61467a4ec470887c2510a8e6605596860e7cd220fd0496180665f43
-
Filesize
1.5MB
MD52788e85300d503d0bb10d858047fff49
SHA1131c989cf1a5238a22c3adc81f7cee7960a51094
SHA256fae6af28b15950b78e503c319ec41dc3b0c153d41a034944a78a180765ac3b9a
SHA5128b0680cd8bf6f03e6b96935fa2556ee38616f6bbba3e7d6810b1b1fbd173c84e1be9c1292548db3f43f005bc5db910950edd4352e84bbae3a15c0b92209f734f
-
Filesize
2.7MB
MD554a49fdad4fb2db10399629a98b7c6b2
SHA17ad0f9ccf10b6893aae77454cfaf1c6feaeb7911
SHA256686af675a534681d26ebbddbdd9b095db107ef63c1e30d724c8b0cc68ce2bcfa
SHA512502873c1d11439281999fff0890ce784b785ae9ce0a99ade55462bd97aa20832483e17392710ce72c4551839dafe2c323b9419297891f781cb43195b4f2a7c6a
-
Filesize
7KB
MD520850d4d5416fbfd6a02e8a120f360fc
SHA1ac34f3a34aaa4a21efd6a32bc93102639170e219
SHA256860b409b065b747aab2a9937f02d08b6fd7309993b50d8e4b53983c8c2b56b61
SHA512c8048b9ae0ced72a384c5ab781083a76b96ae08d5c8a5c7797f75a7e54e9cd9192349f185ee88c9cf0514fc8d59e37e01d88b9c8106321c0581659ebe1d1c276
-
Filesize
26KB
MD54f25d99bf1375fe5e61b037b2616695d
SHA1958fad0e54df0736ddab28ff6cb93e6ed580c862
SHA256803931797d95777248dee4f2a563aed51fe931d2dd28faec507c69ed0f26f647
SHA51296a8446f322cd62377a93d2088c0ce06087da27ef95a391e02c505fb4eb1d00419143d67d89494c2ef6f57ae2fd7f049c86e00858d1b193ec6dde4d0fe0e3130
-
Filesize
36KB
-
Filesize
56KB
-
Filesize
516KB
-
Filesize
412KB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
16.7MB
-
Filesize
992KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
108KB
-
Filesize
180KB
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
192KB
-
Filesize
1.7MB
-
Filesize
208KB
-
Filesize
2.7MB
-
Filesize
96KB
-
Filesize
2.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
2.7MB
-
Filesize
208KB
-
Filesize
2.7MB
-
Filesize
16.7MB
-
Filesize
992KB
-
Filesize
116KB
-
Filesize
68KB
-
Filesize
92KB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB