Analysis
- max time kernel
144s - max time network
37s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
- submitted
01/06/2024, 03:45
General
- Target VSTPlugins.rar
- Size 738.4MB
- Sample240601-ea5teagg6w
- SHA256 c0c017f18b0afe8d9fd84617fb87153ac2ffd01f93db2e9b13144f3e242277da
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 5 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\VSTPlugins.rar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\VSTPlugins.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\VSTPlugins.rar3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\VSTPlugins.rar"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3052-33-0x000007FEFB2B0000-0x000007FEFB2C7000-memory.dmp
memory/3052-32-0x000007FEFB2D0000-0x000007FEFB2E8000-memory.dmp
memory/3052-31-0x000007FEF6370000-0x000007FEF6626000-memory.dmp
memory/3052-30-0x000007FEFB2F0000-0x000007FEFB324000-memory.dmp
memory/3052-29-0x000000013FBC0000-0x000000013FCB8000-memory.dmp
memory/3052-38-0x000007FEF7760000-0x000007FEF7771000-memory.dmp
memory/3052-37-0x000007FEF83F0000-0x000007FEF840D000-memory.dmp
memory/3052-36-0x000007FEF8410000-0x000007FEF8421000-memory.dmp
memory/3052-35-0x000007FEFB270000-0x000007FEFB287000-memory.dmp
memory/3052-39-0x000007FEF5EE0000-0x000007FEF60EB000-memory.dmp
memory/3052-34-0x000007FEFB290000-0x000007FEFB2A1000-memory.dmp
memory/3052-60-0x000007FEF4BF0000-0x000007FEF4C02000-memory.dmp
memory/3052-59-0x000007FEF4C10000-0x000007FEF4C21000-memory.dmp
memory/3052-58-0x000007FEF4C30000-0x000007FEF4C53000-memory.dmp
memory/3052-57-0x000007FEF4C60000-0x000007FEF4C78000-memory.dmp
memory/3052-56-0x000007FEF4C80000-0x000007FEF4CA4000-memory.dmp
memory/3052-55-0x000007FEF4CB0000-0x000007FEF4CD8000-memory.dmp
memory/3052-54-0x000007FEF4CE0000-0x000007FEF4D37000-memory.dmp
memory/3052-53-0x000007FEF69A0000-0x000007FEF69B1000-memory.dmp
memory/3052-52-0x000007FEF4D40000-0x000007FEF4DBC000-memory.dmp
memory/3052-51-0x000007FEF4DC0000-0x000007FEF4E27000-memory.dmp
memory/3052-50-0x000007FEF69C0000-0x000007FEF69F0000-memory.dmp
memory/3052-49-0x000007FEF69F0000-0x000007FEF6A08000-memory.dmp
memory/3052-48-0x000007FEF6A10000-0x000007FEF6A21000-memory.dmp
memory/3052-47-0x000007FEF6A30000-0x000007FEF6A4B000-memory.dmp
memory/3052-46-0x000007FEF6A50000-0x000007FEF6A61000-memory.dmp
memory/3052-45-0x000007FEF6A70000-0x000007FEF6A81000-memory.dmp
memory/3052-44-0x000007FEF6A90000-0x000007FEF6AA1000-memory.dmp
memory/3052-43-0x000007FEF76C0000-0x000007FEF76D8000-memory.dmp
memory/3052-42-0x000007FEF76E0000-0x000007FEF7701000-memory.dmp
memory/3052-41-0x000007FEF7710000-0x000007FEF7751000-memory.dmp
memory/3052-40-0x000007FEF4E30000-0x000007FEF5EE0000-memory.dmp