Overview

overview

7

Static

static

3

FNOP_VR.zip

windows10-2004-x64

7

Resubmissions

02/03/2024, 17:35

240302-v54slafe5x7

02/03/2024, 17:29

240302-v2md5sfh743

02/03/2024, 17:23

240302-vx752sfh283

Analysis

  • max time kernel
    106s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/03/2024, 17:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    FNOP_VR.zip
  • Size 482.7MB
  • Sample240302-v54slafe5x
  • SHA256 05dedd94258a447272ca293db5a78cebfc9560abd02d8415833ad1a400d529a6
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Modifies system executable filetype association 2 TTPs 2 IoCs
    persistence
  • Registers COM server for autorun 1 TTPs 64 IoCs
    persistence
  • Checks system information in the registry 2 TTPs 4 IoCs

    System information is often read in order to detect sandboxing environments.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 49 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\FNOP_VR.zip
    1⤵
      PID:4356
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3880 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:1992
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:2152
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
          1⤵
            PID:2432
          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
            "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
            1⤵
            • Modifies system executable filetype association
            • Registers COM server for autorun
            • Checks processor information in registry
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4524
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
              "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart
              2⤵
              • Executes dropped EXE
              • Checks system information in the registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2592
              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode
                3⤵
                • Executes dropped EXE
                • Checks system information in the registry
                • Suspicious behavior: EnumeratesProcesses
                PID:4280
          • C:\Windows\system32\taskmgr.exe
            "C:\Windows\system32\taskmgr.exe" /4
            1⤵
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:2196

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                OneDriveSetup.exe
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                • Size 12.6MB
                • SHA256 ad5c31c156d8f22797e06996c94f27e3235b25bb736cd94166395d1b92a59a0c
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                OneDriveSetup.exe
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                • Size 2.2MB
                • SHA256 f094e7e4080a6ad1d533cd45807cc2ff574e5b2cb4477dcec97f04132dc10fe0
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                OneDriveSetup.exe
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                • Size 540KB
                • SHA256 4c33d3c8af9dff48d6b542b76ea1dc9f17fea755002f708874c4711a034e79c3
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                logUploaderSettings_temp.ini
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\Personal\logUploaderSettings_temp.ini
                • Size 38B
                • SHA256 884d272d16605590e511ae50c88842a8ce203a864f56061a3c554f8f8265866e
                • MD5 SHA1 SHA512
                Submit Download

                PreSignInSettingsConfig.json
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\PreSignInSettingsConfig.json
                • Size 63KB
                • SHA256 543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                DeviceHealthSummaryConfiguration.ini
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\DeviceHealthSummaryConfiguration.ini
                • Size 77B
                • SHA256 8bad8cab000633e385962750af567010235c8dcfcc9b205d2086adcb436b3eab
                • MD5 SHA1 SHA512
                Submit Download

                update100[1].xml
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\update100[1].xml
                • Size 726B
                • SHA256 36a6bd38a8a6f5a75b73caffae5ae66dfabcaefd83da65b493fa881ea8a64e7d
                • MD5 SHA1 SHA512
                Submit Download

                tmpEF19.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\tmpEF19.tmp
                • Size 5.5MB
                • SHA256 d3047d7b076f6f2e0f9dbacd043064c0ecfc29f0cc54624d9fcffa0e44e152ee
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                AddDisable.asf
                • Path C:\Users\Admin\Desktop\AddDisable.asf
                • Size 284KB
                • SHA256 83a0c2f4e9a06b19521e47dfc2a59e42215eff8bc83422b48f99bfb3adae8a9a
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                BackupUnregister.mpv2
                • Path C:\Users\Admin\Desktop\BackupUnregister.mpv2
                • Size 192KB
                • SHA256 4e9e53023b463940674b66142930f3f113c2df8cceb654db14f00e6c4e652a77
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                CompressResize.WTV
                • Path C:\Users\Admin\Desktop\CompressResize.WTV
                • Size 203KB
                • SHA256 6b3da2dda76b4dd3c9c4ba9b1c6147c66c3c90c7149fce3cfcb2a844eaaa4a2d
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                ConvertFromFind.php
                • Path C:\Users\Admin\Desktop\ConvertFromFind.php
                • Size 121KB
                • SHA256 42baa825d6dca63b69d526a2d73f969f051fdce7427a43c317b54e0e8f09e5a2
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                DenyUndo.odt
                • Path C:\Users\Admin\Desktop\DenyUndo.odt
                • Size 168KB
                • SHA256 d3065597a6fd477f57a0081b0ea4de81064c484c8b46fe8a19c715f7bc07b112
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                DisconnectBlock.mpeg
                • Path C:\Users\Admin\Desktop\DisconnectBlock.mpeg
                • Size 342KB
                • SHA256 5586c4b94f70064327818bc3f42a19f4a24abbf959d93cdcf73c6a37d217e28d
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                EnterLock.xps
                • Path C:\Users\Admin\Desktop\EnterLock.xps
                • Size 179KB
                • SHA256 80f0a1d5f1a3437d5c7be9fef34aba5060f815e9e8369ab3812e169c51cfacda
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                ExitComplete.shtml
                • Path C:\Users\Admin\Desktop\ExitComplete.shtml
                • Size 238KB
                • SHA256 cfb6152da7562d7007564ab4690ccc92e85a9dbec036923fbfa1ab08b1357fbb
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                GroupOpen.ttc
                • Path C:\Users\Admin\Desktop\GroupOpen.ttc
                • Size 191KB
                • SHA256 43be8b7621749ab381c8e28ff30ffccd0c7fbd98bcc8cb261677b9e03dbc7b20
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                LockInitialize.vsdx
                • Path C:\Users\Admin\Desktop\LockInitialize.vsdx
                • Size 330KB
                • SHA256 e426eac7b5fc086c975fd444b5674720e3fa0236ca234a480d142b76c0cd1c6e
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                Microsoft Edge.lnk
                • Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
                • Size 2KB
                • SHA256 2b3175413780647a047891c8ea1b75db755770db55e46c2f82567d5918f25c6a
                • MD5 SHA1 SHA512
                Submit Download

                OutGrant.dll
                • Path C:\Users\Admin\Desktop\OutGrant.dll
                • Size 214KB
                • SHA256 0969aa98fed0982c3e105e4a6885b9a2fae07f9f3ca4f1b931d36f327ef6ada9
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                PopStep.mht
                • Path C:\Users\Admin\Desktop\PopStep.mht
                • Size 249KB
                • SHA256 7c027e7b968b33a519d6388ad4b79511db57d58175a38be1cc87d37595e38676
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                PopWait.vstx
                • Path C:\Users\Admin\Desktop\PopWait.vstx
                • Size 192KB
                • SHA256 64e9143a4d86e18e75762107d4ef8ae5c02588b0b94438b674715aa3bcd640c1
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                ProtectRevoke.WTV
                • Path C:\Users\Admin\Desktop\ProtectRevoke.WTV
                • Size 145KB
                • SHA256 73908147c333eef80e3acf7ff0f21a8a1849f8cc55bd5860bf8e24a2f93224d2
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                PushLimit.lock
                • Path C:\Users\Admin\Desktop\PushLimit.lock
                • Size 261KB
                • SHA256 d54627f86c8e8d2743ea7d580b8fd01150e056a61cdab17718d8851ef57cb358
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                RemoveInitialize.fon
                • Path C:\Users\Admin\Desktop\RemoveInitialize.fon
                • Size 296KB
                • SHA256 7721eca057f558d81fdcbc5a041ef3604e130b8fb74efdf0c6904c57400deccb
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                RepairCompare.tiff
                • Path C:\Users\Admin\Desktop\RepairCompare.tiff
                • Size 156KB
                • SHA256 177bd1327034ea779b45bd36eb35f40e0cdabe5b5cba00b77db45e7399cb4b77
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                RevokeImport.wdp
                • Path C:\Users\Admin\Desktop\RevokeImport.wdp
                • Size 226KB
                • SHA256 4c87e05ce18564e71d2424aa3ef40a98c17ec613ec01601152e5b61da2a6e741
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                SubmitTrace.ADTS
                • Path C:\Users\Admin\Desktop\SubmitTrace.ADTS
                • Size 133KB
                • SHA256 acf8cb97dee280ab4e54db7594838e9d590553e3128c2ce331c10c5f0ad9f51b
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                TestResume.xlsb
                • Path C:\Users\Admin\Desktop\TestResume.xlsb
                • Size 319KB
                • SHA256 84cbfdbf02a789381cd72c583e2f6b024c55816b14d1cec4a8b45e5c8a0d345b
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                WriteWatch.png
                • Path C:\Users\Admin\Desktop\WriteWatch.png
                • Size 307KB
                • SHA256 e001520638d6783829062b3b5c1f289f3cd417bfef30cb7f98dddcfb41c42341
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                Acrobat Reader DC.lnk
                • Path C:\Users\Public\Desktop\Acrobat Reader DC.lnk
                • Size 2KB
                • SHA256 76f4182ffc414282185da0c3d8f56f28279be677575939bf3f0b13fc8cedc3bd
                • MD5 SHA1 SHA512
                Submit Download

                Firefox.lnk
                • Path C:\Users\Public\Desktop\Firefox.lnk
                • Size 1000B
                • SHA256 ce7afd9e16b2d8bdc7c8abc7b9de91518e6958fddfabeec0ba7401db4097bd55
                • MD5 SHA1 SHA512
                Submit Download

                Google Chrome.lnk
                • Path C:\Users\Public\Desktop\Google Chrome.lnk
                • Size 2KB
                • SHA256 b74be6199aaff0f8e146d2837fd499675e37832c5837eec094a4a6a826c9c02b
                • MD5 SHA1 SHA512
                Submit Download

                VLC media player.lnk
                • Path C:\Users\Public\Desktop\VLC media player.lnk
                • Size 923B
                • SHA256 061c3e9e9132b7cf86a245154104e5f817304719cb54ee32e98c4b0edd0f44c5
                • MD5 SHA1 SHA512
                Submit Download

                onedrivesetup.exe
                • Path \??\c:\users\admin\appdata\local\microsoft\onedrive\update\onedrivesetup.exe
                • Size 2.5MB
                • SHA256 13c3ccdcc6f0a10f4f515ca8aaabd50715762c43f1f8ceeac0129be657d211a8
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                memory/2196-71-0x0000015240E90000-0x0000015240E91000-memory.dmp
                Download

                memory/2196-70-0x0000015240E90000-0x0000015240E91000-memory.dmp
                Download

                memory/2196-65-0x0000015240E90000-0x0000015240E91000-memory.dmp
                Download

                memory/2196-60-0x0000015240E90000-0x0000015240E91000-memory.dmp
                Download

                memory/2196-69-0x0000015240E90000-0x0000015240E91000-memory.dmp
                Download

                memory/2196-61-0x0000015240E90000-0x0000015240E91000-memory.dmp
                Download

                memory/2196-59-0x0000015240E90000-0x0000015240E91000-memory.dmp
                Download

                memory/2196-68-0x0000015240E90000-0x0000015240E91000-memory.dmp
                Download

                memory/2196-66-0x0000015240E90000-0x0000015240E91000-memory.dmp
                Download

                memory/2196-67-0x0000015240E90000-0x0000015240E91000-memory.dmp
                Download