cf4ace71e2fb09825dca8f3a1e0180708cd62050561d733027cc1d6b46d184a4 | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07-03-2024 18:25

Sharing

Report Analysis Logs

General

Target

vbug-master.zip
Size

7.0MB
MD5

d52796122c1bb06a92d36e3fd18ea9ad
SHA1

c49f161e6cdc601119c550c037384f0d02b8d3b5
SHA256

cf4ace71e2fb09825dca8f3a1e0180708cd62050561d733027cc1d6b46d184a4
SHA512

4b37348d7acd1f2c29298b791c7aff3d680774376c9cffa1bd5630d8dae0aa7d82270669def0d1a366fb9433d8cf75ed704d2de9e9ccff3b0e7a4b1a1c780c3a
SSDEEP

196608:CnxsdQzjS0NHbwDezbdTyFpprAQQsmqqD2:CnxQ0jScHbwyzxTyFpprA7smjD2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

rundll32.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings rundll32.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\vbug-master.zip
1⤵
PID:1660

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2516

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Temp1_vbug-master.zip\vbug-master\vbug-AIDE.apk
1⤵
- Modifies registry class
PID:1632

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...