Resubmissions
26-05-2024 23:17
240526-29rr6agf48 1026-05-2024 23:05
240526-23cdwsgc83 1026-05-2024 23:02
240526-21d5psgc24 1026-05-2024 22:53
240526-2t11wsfa9v 1026-05-2024 22:35
240526-2h3qcaee9t 10Analysis
-
max time kernel
143s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 22:53
Behavioral task
behavioral1
Sample
Saveinstance V3.7.rar
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Saveinstance V3.7.rar
Resource
win10v2004-20240426-en
General
-
Target
Saveinstance V3.7.rar
-
Size
20.5MB
-
MD5
b7d3ecbc6c31ad1547f35b0f2b5d52c5
-
SHA1
a282b2e8803013f066335c64dc653285d70531b1
-
SHA256
3662f00b6edd175c2fe058990f46bcea4eb804808d80d1a62acb1ef4f11a9bc6
-
SHA512
e6600cd30416f178cc795a1791584c59653c58b1a17d0f783a584df0f042a8ba0b43bb1d21bf4773693432c4b6f17c0c62b46b70fc28109f160fad42c1b28082
-
SSDEEP
393216:+SYKWuH9ZsA2fL8aZFFG1LCVktMnV0FMgyIDFEhsZsk0GXn:+7CHsAa8aZFFwmeM0Mq6h2s4Xn
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
rundll32.exerundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 2720 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid process 2720 vlc.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
Processes:
vlc.exepid process 2720 vlc.exe 2720 vlc.exe 2720 vlc.exe 2720 vlc.exe 2720 vlc.exe 2720 vlc.exe 2720 vlc.exe 2720 vlc.exe 2720 vlc.exe -
Suspicious use of SendNotifyMessage 8 IoCs
Processes:
vlc.exepid process 2720 vlc.exe 2720 vlc.exe 2720 vlc.exe 2720 vlc.exe 2720 vlc.exe 2720 vlc.exe 2720 vlc.exe 2720 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 2720 vlc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
cmd.exerundll32.exerundll32.exedescription pid process target process PID 1232 wrote to memory of 2648 1232 cmd.exe rundll32.exe PID 1232 wrote to memory of 2648 1232 cmd.exe rundll32.exe PID 1232 wrote to memory of 2648 1232 cmd.exe rundll32.exe PID 2648 wrote to memory of 2516 2648 rundll32.exe rundll32.exe PID 2648 wrote to memory of 2516 2648 rundll32.exe rundll32.exe PID 2648 wrote to memory of 2516 2648 rundll32.exe rundll32.exe PID 2516 wrote to memory of 2720 2516 rundll32.exe vlc.exe PID 2516 wrote to memory of 2720 2516 rundll32.exe vlc.exe PID 2516 wrote to memory of 2720 2516 rundll32.exe vlc.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Saveinstance V3.7.rar"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Saveinstance V3.7.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Saveinstance V3.7.rar3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Saveinstance V3.7.rar"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2720-30-0x000007FEFB1A0000-0x000007FEFB1D4000-memory.dmpFilesize
208KB
-
memory/2720-29-0x000000013FC40000-0x000000013FD38000-memory.dmpFilesize
992KB
-
memory/2720-32-0x000007FEFB180000-0x000007FEFB198000-memory.dmpFilesize
96KB
-
memory/2720-33-0x000007FEFB160000-0x000007FEFB177000-memory.dmpFilesize
92KB
-
memory/2720-34-0x000007FEFB140000-0x000007FEFB151000-memory.dmpFilesize
68KB
-
memory/2720-35-0x000007FEF7D80000-0x000007FEF7D97000-memory.dmpFilesize
92KB
-
memory/2720-36-0x000007FEF7B10000-0x000007FEF7B21000-memory.dmpFilesize
68KB
-
memory/2720-38-0x000007FEF6F70000-0x000007FEF6F81000-memory.dmpFilesize
68KB
-
memory/2720-37-0x000007FEF7AF0000-0x000007FEF7B0D000-memory.dmpFilesize
116KB
-
memory/2720-31-0x000007FEF61C0000-0x000007FEF6476000-memory.dmpFilesize
2.7MB
-
memory/2720-50-0x000007FEF5B60000-0x000007FEF5B90000-memory.dmpFilesize
192KB
-
memory/2720-40-0x000007FEF5C50000-0x000007FEF5E5B000-memory.dmpFilesize
2.0MB
-
memory/2720-41-0x000007FEF6AF0000-0x000007FEF6B31000-memory.dmpFilesize
260KB
-
memory/2720-45-0x000007FEF5C10000-0x000007FEF5C21000-memory.dmpFilesize
68KB
-
memory/2720-48-0x000007FEF5BB0000-0x000007FEF5BC1000-memory.dmpFilesize
68KB
-
memory/2720-47-0x000007FEF5BD0000-0x000007FEF5BEB000-memory.dmpFilesize
108KB
-
memory/2720-49-0x000007FEF5B90000-0x000007FEF5BA8000-memory.dmpFilesize
96KB
-
memory/2720-46-0x000007FEF5BF0000-0x000007FEF5C01000-memory.dmpFilesize
68KB
-
memory/2720-51-0x000007FEF5AF0000-0x000007FEF5B57000-memory.dmpFilesize
412KB
-
memory/2720-55-0x000007FEF59C0000-0x000007FEF59E8000-memory.dmpFilesize
160KB
-
memory/2720-58-0x000007FEF5940000-0x000007FEF5963000-memory.dmpFilesize
140KB
-
memory/2720-57-0x000007FEF5970000-0x000007FEF5988000-memory.dmpFilesize
96KB
-
memory/2720-59-0x000007FEF5920000-0x000007FEF5931000-memory.dmpFilesize
68KB
-
memory/2720-56-0x000007FEF5990000-0x000007FEF59B4000-memory.dmpFilesize
144KB
-
memory/2720-60-0x000007FEF5900000-0x000007FEF5912000-memory.dmpFilesize
72KB
-
memory/2720-61-0x000007FEF19E0000-0x000007FEF19F1000-memory.dmpFilesize
68KB
-
memory/2720-54-0x000007FEF59F0000-0x000007FEF5A47000-memory.dmpFilesize
348KB
-
memory/2720-62-0x000007FEF0070000-0x000007FEF00C7000-memory.dmpFilesize
348KB
-
memory/2720-63-0x000007FEEF1C0000-0x000007FEEF1D2000-memory.dmpFilesize
72KB
-
memory/2720-53-0x000007FEF5A50000-0x000007FEF5A61000-memory.dmpFilesize
68KB
-
memory/2720-64-0x000007FEEF170000-0x000007FEEF1B2000-memory.dmpFilesize
264KB
-
memory/2720-52-0x000007FEF5A70000-0x000007FEF5AEC000-memory.dmpFilesize
496KB
-
memory/2720-44-0x000007FEF5C30000-0x000007FEF5C41000-memory.dmpFilesize
68KB
-
memory/2720-43-0x000007FEF6AD0000-0x000007FEF6AE8000-memory.dmpFilesize
96KB
-
memory/2720-42-0x000007FEF6980000-0x000007FEF69A1000-memory.dmpFilesize
132KB
-
memory/2720-65-0x000007FEEF120000-0x000007FEEF16D000-memory.dmpFilesize
308KB
-
memory/2720-66-0x000007FEEEA50000-0x000007FEEEC91000-memory.dmpFilesize
2.3MB
-
memory/2720-73-0x000007FEEE9E0000-0x000007FEEEA42000-memory.dmpFilesize
392KB
-
memory/2720-74-0x000007FEEE970000-0x000007FEEE9DD000-memory.dmpFilesize
436KB
-
memory/2720-72-0x000007FEEF010000-0x000007FEEF052000-memory.dmpFilesize
264KB
-
memory/2720-71-0x000007FEEF060000-0x000007FEEF076000-memory.dmpFilesize
88KB
-
memory/2720-70-0x000007FEFB110000-0x000007FEFB120000-memory.dmpFilesize
64KB
-
memory/2720-69-0x000007FEEF080000-0x000007FEEF092000-memory.dmpFilesize
72KB
-
memory/2720-68-0x000007FEEF0A0000-0x000007FEEF0B1000-memory.dmpFilesize
68KB
-
memory/2720-67-0x000007FEEF0C0000-0x000007FEEF0D6000-memory.dmpFilesize
88KB
-
memory/2720-39-0x000007FEF4590000-0x000007FEF5640000-memory.dmpFilesize
16.7MB