d97404002e0dc33afd30404a4462706b9892d82161c47d5b6ac57b4f0c397526

Analysis

max time kernel
95s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22-04-2024 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Vape v4.10.rar
Size

17.5MB
MD5

94225360f6c43806154028b59d6fcd7e
SHA1

c833f9e216bb703ab8db48492420d4119485fac1
SHA256

d97404002e0dc33afd30404a4462706b9892d82161c47d5b6ac57b4f0c397526
SHA512

b0ea74d4cd45ff35303751df937ea2fc0209d317bb9e0813cf26db7ecd4ea8d8cea13e428b18859bf5495108f3de6f1eb9529e4eadc71814c4de29c58b47fe67
SSDEEP

393216:sSWGYXyOJzz617iGtDmm67eSspjsP7yKbaPajSFxY:hWGhOpWdp67l9baijay

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings	OpenWith.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2348	PING.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	4476	7zG.exe
Token: 35	4476	7zG.exe
Token: SeSecurityPrivilege	4476	7zG.exe
Token: SeSecurityPrivilege	4476	7zG.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4476	7zG.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2316	OpenWith.exe
2316	OpenWith.exe
2316	OpenWith.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 4368	5092	cmd.exe	128
PID 5092 wrote to memory of 4368	5092	cmd.exe	128
PID 5092 wrote to memory of 2348	5092	cmd.exe	129
PID 5092 wrote to memory of 2348	5092	cmd.exe	129
PID 5092 wrote to memory of 1248	5092	cmd.exe	130
PID 5092 wrote to memory of 1248	5092	cmd.exe	130

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Vape v4.10.rar"
1⤵
- Modifies registry class
PID:2856

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2316

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1728

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Vape v4.10\" -ad -an -ai#7zMap31838:78:7zEvent11259
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4476

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Vape v4.10\WARNING (READ ME).txt
1⤵
PID:2840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Vape v4.10\vape v4.10\bapeclient.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\system32\mode.com
  mode 55, 9
  2⤵
  PID:4368
- C:\Windows\system32\PING.EXE
  ping localhost -n 5.5
  2⤵
  - Runs ping.exe
  PID:2348
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  java --add-opens java.base/java.lang=ALL-UNNAMED -jar vape-loader.jar
  2⤵
  PID:1248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\Vape v4.10\WARNING (READ ME).txt

Filesize
409B

MD5
8df67363511e87829f63be7189338adb

SHA1
3081a4a4d141098cbd32ddf631949ed745d67b66

SHA256
2b1ae5f68ddb5acaee0f148d6e15459213179f6c1c6a3c4bdc20788a459a82f0

SHA512
dd6eb0e37d31ca00e3822fe3d4b1ffaeccd7faa5b071b9a4b969253a005b4293f6ac2a9e57a5e72b901a2e2936f9aeaceb3dbcf80a4a2ce918f05ffbc92ed910

Download Submit
C:\Users\Admin\Desktop\Vape v4.10\vape v4.10\bapeclient.bat

Filesize
212B

MD5
45e402e32c7fabf579c3a048396ca270

SHA1
18950dc60c913a0a7b098cbd55d2bf3087d2447a

SHA256
9d87e71946d492dc878fdda9ce8693b820dcab116d52b60e429eff37c1b8b707

SHA512
b286685f1efd07ade19876c522dd01d47ce9ef6b49da920f96163687e6728cf82f3d21d358029f3f1fe738a524711b6caf71a2ff789c52ef44b28104ed09f916

Download Submit