Overview
overview
10Static
static
9by Ryosx [...s].zip
windows7-x64
1by Ryosx [...s].zip
windows10-2004-x64
1AUR0RA V3.rar
windows7-x64
3AUR0RA V3.rar
windows10-2004-x64
7AUR0RA V3/...V3.exe
windows7-x64
10AUR0RA V3/...V3.exe
windows10-2004-x64
10$INTERNET_CACHE/Alot
windows7-x64
1$INTERNET_CACHE/Alot
windows10-2004-x64
1$INTERNET_...earing
windows7-x64
1$INTERNET_...earing
windows10-2004-x64
1$INTERNET_...otions
windows7-x64
1$INTERNET_...otions
windows10-2004-x64
$INTERNET_...rotica
windows7-x64
1$INTERNET_...rotica
windows10-2004-x64
1$INTERNET_CACHE/Fcc
windows7-x64
1$INTERNET_CACHE/Fcc
windows10-2004-x64
1$INTERNET_...ighter
windows7-x64
1$INTERNET_...ighter
windows10-2004-x64
1$INTERNET_...er.ps1
windows7-x64
1$INTERNET_...er.ps1
windows10-2004-x64
1$INTERNET_CACHE/Genre
windows7-x64
1$INTERNET_CACHE/Genre
windows10-2004-x64
1$INTERNET_...rrison
windows7-x64
1$INTERNET_...rrison
windows10-2004-x64
1$INTERNET_CACHE/Idea
windows7-x64
1$INTERNET_CACHE/Idea
windows10-2004-x64
1$INTERNET_...roduce
windows7-x64
1$INTERNET_...roduce
windows10-2004-x64
1$INTERNET_CACHE/Ld
windows7-x64
1$INTERNET_CACHE/Ld
windows10-2004-x64
1$INTERNET_...ipants
windows7-x64
1$INTERNET_...ipants
windows10-2004-x64
1Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-04-2024 22:32
Behavioral task
behavioral1
Sample
by Ryosx [GoddyXSpl0its].zip
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
by Ryosx [GoddyXSpl0its].zip
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
AUR0RA V3.rar
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
AUR0RA V3.rar
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
AUR0RA V3/AURORAV3.exe
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
AUR0RA V3/AURORAV3.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$INTERNET_CACHE/Alot
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$INTERNET_CACHE/Alot
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
$INTERNET_CACHE/Clearing
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$INTERNET_CACHE/Clearing
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
$INTERNET_CACHE/Emotions
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$INTERNET_CACHE/Emotions
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
$INTERNET_CACHE/Erotica
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$INTERNET_CACHE/Erotica
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
$INTERNET_CACHE/Fcc
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
$INTERNET_CACHE/Fcc
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
$INTERNET_CACHE/Fighter
Resource
win7-20240319-en
Behavioral task
behavioral18
Sample
$INTERNET_CACHE/Fighter
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
$INTERNET_CACHE/Forever.ps1
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
$INTERNET_CACHE/Forever.ps1
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
$INTERNET_CACHE/Genre
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
$INTERNET_CACHE/Genre
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
$INTERNET_CACHE/Harrison
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
$INTERNET_CACHE/Harrison
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
$INTERNET_CACHE/Idea
Resource
win7-20240215-en
Behavioral task
behavioral26
Sample
$INTERNET_CACHE/Idea
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
$INTERNET_CACHE/Introduce
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
$INTERNET_CACHE/Introduce
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
$INTERNET_CACHE/Ld
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
$INTERNET_CACHE/Ld
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
$INTERNET_CACHE/Participants
Resource
win7-20240319-en
Behavioral task
behavioral32
Sample
$INTERNET_CACHE/Participants
Resource
win10v2004-20240226-en
General
-
Target
AUR0RA V3.rar
-
Size
9.0MB
-
MD5
0df42dd74a3e614a12173fd71aaf98fe
-
SHA1
52e949b521a2ff7671b663ec5b8ab197e5dd7ffd
-
SHA256
656eb84822afbd053bf199f8362fd15b7fef64f18c83ff74f6fb547dbc6ad813
-
SHA512
3347ef6ec4389671d8c3929e9ec9d730c5941528866e8e6011927d2ef288be179f320f7d61c8f8fa68f6888c385bfac72b850d7c0819bdaee8d744d901a5839b
-
SSDEEP
196608:ZqqB7bIs+K5/wcoKsZpyCa4sbJNtoKpwI0qWgQUoobIxYovpHa:ZqC+KChLyp4uNmRI0qkwtmHa
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
7zFM.exedescription pid process Token: SeRestorePrivilege 2184 7zFM.exe Token: 35 2184 7zFM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
7zFM.exepid process 2184 7zFM.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 2256 wrote to memory of 2184 2256 cmd.exe 7zFM.exe PID 2256 wrote to memory of 2184 2256 cmd.exe 7zFM.exe PID 2256 wrote to memory of 2184 2256 cmd.exe 7zFM.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\AUR0RA V3.rar"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\AUR0RA V3.rar"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow