Resubmissions
22/05/2024, 14:33
240522-rw846see6s22/05/2024, 14:32
240522-rv83saee4s1022/05/2024, 14:30
240522-rvkp7aed6310Analysis
- max time kernel
148s - max time network
120s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
- submitted
22/05/2024, 14:32
General
- Target !!@New_Setup_Pa$sWr0d__2244.rar
- Size 5.9MB
- Sample240522-rv83saee4s
- SHA256 96a17214b6a014acc12245edd7b83ea669ae0b857d04018a3201a6724e0dacfd
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\!!@New_Setup_Pa$sWr0d__2244.rar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\!!@New_Setup_Pa$sWr0d__2244.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\!!@New_Setup_Pa$sWr0d__2244.rar"3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2740-30-0x000007FEF7160000-0x000007FEF7194000-memory.dmp
memory/2740-29-0x000000013F160000-0x000000013F258000-memory.dmp
memory/2740-32-0x000007FEFAFB0000-0x000007FEFAFC8000-memory.dmp
memory/2740-33-0x000007FEFADC0000-0x000007FEFADD7000-memory.dmp
memory/2740-34-0x000007FEF7120000-0x000007FEF7131000-memory.dmp
memory/2740-35-0x000007FEF6C00000-0x000007FEF6C17000-memory.dmp
memory/2740-37-0x000007FEF6BC0000-0x000007FEF6BDD000-memory.dmp
memory/2740-36-0x000007FEF6BE0000-0x000007FEF6BF1000-memory.dmp
memory/2740-38-0x000007FEF6BA0000-0x000007FEF6BB1000-memory.dmp
memory/2740-31-0x000007FEF5980000-0x000007FEF5C34000-memory.dmp
memory/2740-39-0x000007FEF5780000-0x000007FEF5980000-memory.dmp
memory/2740-41-0x000007FEF6B60000-0x000007FEF6B9F000-memory.dmp
memory/2740-43-0x000007FEF65D0000-0x000007FEF65E8000-memory.dmp
memory/2740-42-0x000007FEF65F0000-0x000007FEF6611000-memory.dmp
memory/2740-44-0x000007FEF65B0000-0x000007FEF65C1000-memory.dmp
memory/2740-45-0x000007FEF6590000-0x000007FEF65A1000-memory.dmp
memory/2740-46-0x000007FEF60A0000-0x000007FEF60B1000-memory.dmp
memory/2740-48-0x000007FEF6060000-0x000007FEF6071000-memory.dmp
memory/2740-47-0x000007FEF6080000-0x000007FEF609B000-memory.dmp
memory/2740-49-0x000007FEF6040000-0x000007FEF6058000-memory.dmp
memory/2740-50-0x000007FEF6010000-0x000007FEF6040000-memory.dmp
memory/2740-51-0x000007FEF4660000-0x000007FEF46C7000-memory.dmp
memory/2740-52-0x000007FEF45F0000-0x000007FEF465F000-memory.dmp
memory/2740-54-0x000007FEF4590000-0x000007FEF45E6000-memory.dmp
memory/2740-53-0x000007FEF5FF0000-0x000007FEF6001000-memory.dmp
memory/2740-58-0x000007FEF4510000-0x000007FEF4533000-memory.dmp
memory/2740-62-0x000007FEF38E0000-0x000007FEF38F2000-memory.dmp
memory/2740-61-0x000007FEF3940000-0x000007FEF3951000-memory.dmp
memory/2740-60-0x000007FEF44D0000-0x000007FEF44E2000-memory.dmp
memory/2740-59-0x000007FEF44F0000-0x000007FEF4501000-memory.dmp
memory/2740-57-0x000007FEF4540000-0x000007FEF4557000-memory.dmp
memory/2740-56-0x000007FEF4560000-0x000007FEF4584000-memory.dmp
memory/2740-55-0x000007FEF5FC0000-0x000007FEF5FE8000-memory.dmp
memory/2740-40-0x000007FEF46D0000-0x000007FEF577B000-memory.dmp