Overview

overview

6

Static

static

1

Firework Stars.png

windows10-2004-x64

6

Analysis

  • max time kernel
    597s
  • max time network
    574s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-05-2024 06:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Firework Stars.png

  • Size

    39KB

  • MD5

    474e7fac5724eb07163aefc19e1f1f79

  • SHA1

    775c689df447faeba0d2293ce892c995465f8a02

  • SHA256

    9bb9b429599af896e15e17f93bd828d8917cffaff40b6107b47dfb6972b59145

  • SHA512

    a0ab811f0ab42ea50c13f0215b0d48704609383c0a3afc13a5590ef2e1997e6e529ddf8302062f3244a1b19b4105ed5820ce6fb229b2ade8a26e219fcbc255bd

  • SSDEEP

    768:gLQAgCRfQIfvUoDNLhhPS5pNyxOHngjN8o1GYoQ9sLKUjgIcEb36IuXdxHOeVlJ:3AlfQIXbDNVhqAx8ngjN8EvrUjbwjf9

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 40 IoCs
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 20 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Firework Stars.png"
    1⤵
      PID:1876
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
      1⤵
        PID:3352
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
        1⤵
        • Checks processor information in registry
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:408
      • C:\Windows\system32\mstsc.exe
        "C:\Windows\system32\mstsc.exe"
        1⤵
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        PID:4132
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x3c0 0x324
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4988
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:636
        • C:\Windows\system32\dashost.exe
          dashost.exe {53c37b78-54ee-4d4f-93b24a8977b2aad5}
          2⤵
            PID:184
        • C:\Program Files\VideoLAN\VLC\vlc.exe
          "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "C:\Users\Admin\Desktop\StepStop.WTV"
          1⤵
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:4852

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/4852-25-0x00007FF777DF0000-0x00007FF777EE8000-memory.dmp

          Filesize

          992KB

          Download

        • memory/4852-26-0x00007FFE7A4B0000-0x00007FFE7A4E4000-memory.dmp

          Filesize

          208KB

          Download

        • memory/4852-27-0x00007FFE722E0000-0x00007FFE72596000-memory.dmp

          Filesize

          2.7MB

          Download

        • memory/4852-28-0x00007FFE6FF30000-0x00007FFE70FE0000-memory.dmp

          Filesize

          16.7MB

          Download