Overview

overview

8

Static

static

3

VencordInstaller.exe

windows10-2004-x64

8

VencordInstaller.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-04-2024 14:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    VencordInstaller.exe

  • Size

    9.9MB

  • MD5

    1b8ee61ddcfd1d425821d76ea54ca829

  • SHA1

    f8daf2bea3d4a6bfc99455d69c3754054de3baa5

  • SHA256

    dc0826657a005009f43bdc3a0933d08352f8b22b2b9b961697a2db6e9913e871

  • SHA512

    75ba16ddc75564e84f5d248326908065942ad50631ec30d7952069caee15b8c5411a8802d25d38e9d80e042f1dde97a0326f4ab4f1c90f8e4b81396ca69c229a

  • SSDEEP

    98304:jmPUf5A91QP5oToUsbeRwcyHekFeSpc12EKw+KVktWHBLmpTN5huJd3kMerGpNTt:SqqQP5oKswpLi3gOW

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 5 IoCs
    persistence
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 11 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VencordInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\VencordInstaller.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4748
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4828
    • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
      "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:5088
      • C:\Program Files (x86)\Windows Media Player\setup_wm.exe
        "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:368
        • C:\Windows\SysWOW64\unregmp2.exe
          C:\Windows\system32\unregmp2.exe /ShowWMP /SetShowState /CreateMediaLibrary
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4180
          • C:\Windows\system32\unregmp2.exe
            "C:\Windows\SysNative\unregmp2.exe" /ShowWMP /SetShowState /CreateMediaLibrary /REENTRANT
            4⤵
            • Modifies Installed Components in the registry
            • Drops desktop.ini file(s)
            • Drops file in Program Files directory
            • Modifies registry class
            PID:3780
        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Relaunch /Play C:\Users\Admin\Desktop\GroupCheckpoint.wmx
          3⤵
          • Enumerates connected drives
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:980
      • C:\Windows\SysWOW64\unregmp2.exe
        "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4748
        • C:\Windows\system32\unregmp2.exe
          "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
          3⤵
          • Enumerates connected drives
          • Suspicious use of AdjustPrivilegeToken
          PID:2980
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
      1⤵
      • Drops file in Windows directory
      PID:4012
    • C:\Windows\system32\mspaint.exe
      "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\OptimizeCopy.png" /ForceBootstrapPaint3D
      1⤵
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2312
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
      1⤵
      • Drops file in System32 directory
      PID:4244
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4404

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
      Filesize

      256KB

      MD5

      adbd8353954edbe5e0620c5bdcad4363

      SHA1

      aeb5c03e8c1b8bc5d55683ea113e6ce1be7ac6e6

      SHA256

      64eff10c4e866930d32d4d82cc88ec0e6f851ac49164122cae1b27eb3c9d9d55

      SHA512

      87bf4a2dc4dd5c833d96f3f5cb0b607796414ffee36d5c167a75644bcbb02ab5159aa4aa093ed43abe290481abc01944885c68b1755d9b2c4c583fcccd041fd2

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
      Filesize

      1024KB

      MD5

      774aeb9b401b325586ce49c5c6816ad6

      SHA1

      311c3ec364f78dc4a99fb79d02397df913e62b19

      SHA256

      546cb845bf9adfab4a7660dbbdfbd488bb930197afff46afc2a35debc0424c41

      SHA512

      b1bdf76dc33fdabef01c7b13880cfd271c6126ceaa5d64b2f7b5899a660f41f51c82f0002781a5b019d7bd23efd4433b2d5942e4bd9e0125b540f7bbd3361a38

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
      Filesize

      9KB

      MD5

      7050d5ae8acfbe560fa11073fef8185d

      SHA1

      5bc38e77ff06785fe0aec5a345c4ccd15752560e

      SHA256

      cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

      SHA512

      a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\wmsetup.log
      Filesize

      1KB

      MD5

      3722050dff90f833a5fc3cd60844e49a

      SHA1

      e2ad81aa62466284d46ae7aaae301bf2e01b9f8c

      SHA256

      f03e9927dbb0fbcab755b6e05893d707aacb99139ba866ff40ff8221a4cc4f0d

      SHA512

      6fb7cc4d28a28cd1559e7f4ba25ba22c9f4ef0f90852df34753e6ae5c3a14f5b25ecdd165afe7541cf5274f3c278de1deb55582994659527775e6a0540ad5eb8

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\wmsetup.log
      Filesize

      2KB

      MD5

      6e3daafd69889a579743e9e99c491995

      SHA1

      e4b662727553913acb58b10eaa9ae8433b145b49

      SHA256

      5eb03b61e443d6cf24097185f7b784068225d051edb4349c45c9e66db8f9ac5e

      SHA512

      568a0018433ce659612e107c9726cdebfd39a16d22dba2d4a193e60579d636fd1717a5c8f45bacec4330d3355875f065fc987b44c097e5c147dbe2b8a9f2842e

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
      Filesize

      3KB

      MD5

      16c3f343e6f9131ecd128a2c33fb8589

      SHA1

      c7a28b18ace8f9f551db4626b82ecce9f584ed4b

      SHA256

      1b9d0a02cee4302f28eb022a0f3dd45d6ab4c90ef87d380a040f8d290c20235e

      SHA512

      df3f8963d6022d016aef19ad1dc1bf8524e7f9e084811c5e7cea5f725024b28ffadc4af724197cbdbd9df975a48ec29ed24342fd35a2eec5d6820340089a0abb

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
      Filesize

      1KB

      MD5

      8cf77365a7bc18909d808625eaeaab90

      SHA1

      81138a53d349ff3c6684de21b164b67460f1d875

      SHA256

      79e9acaafe81e6980b9c7f434ca3e79f7a956b11c56092e16e07df52e1a31a0b

      SHA512

      d424bad43ef2926995a84e15e7482bbed83c69332b219afa149bfeebc74d87fbc8f4fcce98097f98a61e288b2976a2f36a762b097effaf31277129fd83b7cc8e

      Download Submit

    • memory/4244-59-0x00000146E8F30000-0x00000146E8F40000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4244-63-0x00000146E8F70000-0x00000146E8F80000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4244-70-0x00000146F1BC0000-0x00000146F1BC1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4244-72-0x00000146F1C40000-0x00000146F1C41000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4244-74-0x00000146F1C40000-0x00000146F1C41000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4244-75-0x00000146F1CD0000-0x00000146F1CD1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4244-76-0x00000146F1CD0000-0x00000146F1CD1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4244-77-0x00000146F1CE0000-0x00000146F1CE1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4244-78-0x00000146F1CE0000-0x00000146F1CE1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4748-0-0x00007FF691D50000-0x00007FF692FC9000-memory.dmp

      Filesize

      18.5MB

      Download