Overview
overview
7Static
static
3LUXONIX Pu....4.exe
windows7-x64
7LUXONIX Pu....4.exe
windows10-2004-x64
7$PLUGINSDI...al.ini
windows7-x64
1$PLUGINSDI...al.ini
windows10-2004-x64
1$PLUGINSDI...er.bmp
windows7-x64
3$PLUGINSDI...er.bmp
windows10-2004-x64
7$PLUGINSDI...rd.bmp
windows7-x64
3$PLUGINSDI...rd.bmp
windows10-2004-x64
7000 GM Normal.pth
windows7-x64
3000 GM Normal.pth
windows10-2004-x64
3000 GM Normal.smp
windows7-x64
3000 GM Normal.smp
windows10-2004-x64
3000 GM Normal.wvt
windows7-x64
3000 GM Normal.wvt
windows10-2004-x64
3001 GM Rhythm.pth
windows7-x64
3001 GM Rhythm.pth
windows10-2004-x64
3001 GM Rhythm.smp
windows7-x64
3001 GM Rhythm.smp
windows10-2004-x64
3001 GM Rhythm.wvt
windows7-x64
3001 GM Rhythm.wvt
windows10-2004-x64
3010 Factor...dy.smp
windows7-x64
3010 Factor...dy.smp
windows10-2004-x64
3010 Motive.pth
windows7-x64
3010 Motive.pth
windows10-2004-x64
3010 Piano.wvt
windows7-x64
3010 Piano.wvt
windows10-2004-x64
3011 Factory Drum.smp
windows7-x64
3011 Factory Drum.smp
windows10-2004-x64
3011 Organ.wvt
windows7-x64
3011 Organ.wvt
windows10-2004-x64
3012 Percussive.wvt
windows7-x64
3012 Percussive.wvt
windows10-2004-x64
3Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-04-2024 21:03
Behavioral task
behavioral1
Sample
LUXONIX Purity VSTi.v1.2.4.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
LUXONIX Purity VSTi.v1.2.4.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ioSpecial.ini
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ioSpecial.ini
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
000 GM Normal.pth
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
000 GM Normal.pth
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
000 GM Normal.smp
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
000 GM Normal.smp
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
000 GM Normal.wvt
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
000 GM Normal.wvt
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
001 GM Rhythm.pth
Resource
win7-20240215-en
Behavioral task
behavioral16
Sample
001 GM Rhythm.pth
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
001 GM Rhythm.smp
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
001 GM Rhythm.smp
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
001 GM Rhythm.wvt
Resource
win7-20240220-en
Behavioral task
behavioral20
Sample
001 GM Rhythm.wvt
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
010 Factory Melody.smp
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
010 Factory Melody.smp
Resource
win10v2004-20240412-en
Behavioral task
behavioral23
Sample
010 Motive.pth
Resource
win7-20240215-en
Behavioral task
behavioral24
Sample
010 Motive.pth
Resource
win10v2004-20240412-en
Behavioral task
behavioral25
Sample
010 Piano.wvt
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
010 Piano.wvt
Resource
win10v2004-20240412-en
Behavioral task
behavioral27
Sample
011 Factory Drum.smp
Resource
win7-20240220-en
Behavioral task
behavioral28
Sample
011 Factory Drum.smp
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
011 Organ.wvt
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
011 Organ.wvt
Resource
win10v2004-20240412-en
Behavioral task
behavioral31
Sample
012 Percussive.wvt
Resource
win7-20231129-en
Behavioral task
behavioral32
Sample
012 Percussive.wvt
Resource
win10v2004-20240412-en
General
-
Target
011 Organ.wvt
-
Size
493B
-
MD5
307e6edd33179398df8bca17635bf6d4
-
SHA1
33ae5937094bbb0d9226c17b589ca28ff6519d38
-
SHA256
3938f45badd1d19ff00d8b281eceb0e51bf455c90ca7194326d80d76afaefb75
-
SHA512
5b0bfc83282b9706d6cff91e64d012e980c0dee18b2deba3c7d37efb1491597a99a14264ead1b8d539e2275060ecbcb5eac03e7c39e2cd13e75518c304212f4f
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\wvt_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\wvt_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.wvt rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\wvt_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\wvt_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\wvt_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\wvt_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.wvt\ = "wvt_auto_file" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2532 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2532 AcroRd32.exe 2532 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 2776 wrote to memory of 2536 2776 cmd.exe rundll32.exe PID 2776 wrote to memory of 2536 2776 cmd.exe rundll32.exe PID 2776 wrote to memory of 2536 2776 cmd.exe rundll32.exe PID 2536 wrote to memory of 2532 2536 rundll32.exe AcroRd32.exe PID 2536 wrote to memory of 2532 2536 rundll32.exe AcroRd32.exe PID 2536 wrote to memory of 2532 2536 rundll32.exe AcroRd32.exe PID 2536 wrote to memory of 2532 2536 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\011 Organ.wvt"1⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\011 Organ.wvt2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\011 Organ.wvt"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2532
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD5878ecc2f08f66cfd2068eff59c539018
SHA1092e49232b53743b0dc1e7f6238be685c66fdce4
SHA256b7a6ea18f27c44a48dddb69b72560391543a738fa0c11e3842397b7db569a4f4
SHA5128a43a9eea9cdba47ea66a232e2b1105aa14610c92988d07f46d0f2a45ae938373d24bfbb7b1b69ce981a660ea0eb43ab5c607148ae21fba80bd2dca5bdf480df