Analysis

  • max time kernel
    283s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    12/06/2024, 18:46

General

  • Target

    nexus.rar

  • Size

    406KB

  • MD5

    a7c38e1cb67f8608fa21aea2e18dfd9c

  • SHA1

    4b3f722f9080609c483e5a27caab358005d2cb49

  • SHA256

    458503dc11c4c8344cbfcd03e3907f15a6f0861c32ec28fed3659d41c56e167f

  • SHA512

    e5badae75c3cae2b856c71706e7a8a9fe32c2177a09d1002f10af554b590e1dc26ce74e16d2e6f99aaaa976e255feac4d4b6c403aae191c013ccfe45ed0afd21

  • SSDEEP

    12288:HsWxYO53NAFGcgDN4WPf0A+icha0ylQ9sVOOxz0:H/9NfCWngFylQ9qOW0

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\nexus.rar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2260
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\nexus.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2676
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\nexus.rar
        3⤵
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2704
        • C:\Program Files\VideoLAN\VLC\vlc.exe
          "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\nexus.rar"
          4⤵
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:2460

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2460-25-0x000007FEF72F0000-0x000007FEF7324000-memory.dmp

    Filesize

    208KB

  • memory/2460-24-0x000000013F960000-0x000000013FA58000-memory.dmp

    Filesize

    992KB

  • memory/2460-27-0x000007FEF72D0000-0x000007FEF72E8000-memory.dmp

    Filesize

    96KB

  • memory/2460-26-0x000007FEF5BB0000-0x000007FEF5E66000-memory.dmp

    Filesize

    2.7MB

  • memory/2460-28-0x000007FEF72B0000-0x000007FEF72C7000-memory.dmp

    Filesize

    92KB

  • memory/2460-29-0x000007FEF6E20000-0x000007FEF6E31000-memory.dmp

    Filesize

    68KB

  • memory/2460-30-0x000007FEFBA70000-0x000007FEFBA87000-memory.dmp

    Filesize

    92KB

  • memory/2460-31-0x000007FEFBA50000-0x000007FEFBA61000-memory.dmp

    Filesize

    68KB

  • memory/2460-32-0x000007FEFB7B0000-0x000007FEFB7CD000-memory.dmp

    Filesize

    116KB

  • memory/2460-33-0x000007FEFB790000-0x000007FEFB7A1000-memory.dmp

    Filesize

    68KB

  • memory/2460-59-0x000007FEF37B0000-0x000007FEF37C1000-memory.dmp

    Filesize

    68KB

  • memory/2460-34-0x000007FEF49D0000-0x000007FEF5A80000-memory.dmp

    Filesize

    16.7MB

  • memory/2460-58-0x000007FEF37D0000-0x000007FEF37E1000-memory.dmp

    Filesize

    68KB

  • memory/2460-57-0x000007FEF4400000-0x000007FEF4413000-memory.dmp

    Filesize

    76KB

  • memory/2460-56-0x000007FEF4420000-0x000007FEF4441000-memory.dmp

    Filesize

    132KB

  • memory/2460-55-0x000007FEF4450000-0x000007FEF4462000-memory.dmp

    Filesize

    72KB

  • memory/2460-54-0x000007FEF4470000-0x000007FEF4481000-memory.dmp

    Filesize

    68KB

  • memory/2460-53-0x000007FEF4260000-0x000007FEF4283000-memory.dmp

    Filesize

    140KB

  • memory/2460-52-0x000007FEF4490000-0x000007FEF44A8000-memory.dmp

    Filesize

    96KB

  • memory/2460-51-0x000007FEF44B0000-0x000007FEF44D4000-memory.dmp

    Filesize

    144KB

  • memory/2460-50-0x000007FEF44E0000-0x000007FEF4508000-memory.dmp

    Filesize

    160KB

  • memory/2460-49-0x000007FEF4510000-0x000007FEF4567000-memory.dmp

    Filesize

    348KB

  • memory/2460-48-0x000007FEF4570000-0x000007FEF4581000-memory.dmp

    Filesize

    68KB

  • memory/2460-47-0x000007FEF4590000-0x000007FEF460C000-memory.dmp

    Filesize

    496KB

  • memory/2460-46-0x000007FEF4610000-0x000007FEF4677000-memory.dmp

    Filesize

    412KB

  • memory/2460-45-0x000007FEF5E70000-0x000007FEF5EA0000-memory.dmp

    Filesize

    192KB

  • memory/2460-44-0x000007FEF5EA0000-0x000007FEF5EB8000-memory.dmp

    Filesize

    96KB

  • memory/2460-43-0x000007FEF6440000-0x000007FEF6451000-memory.dmp

    Filesize

    68KB

  • memory/2460-42-0x000007FEF6D30000-0x000007FEF6D4B000-memory.dmp

    Filesize

    108KB

  • memory/2460-41-0x000007FEF7340000-0x000007FEF7351000-memory.dmp

    Filesize

    68KB

  • memory/2460-35-0x000007FEF6460000-0x000007FEF666B000-memory.dmp

    Filesize

    2.0MB

  • memory/2460-40-0x000007FEF78A0000-0x000007FEF78B1000-memory.dmp

    Filesize

    68KB

  • memory/2460-39-0x000007FEF78C0000-0x000007FEF78D1000-memory.dmp

    Filesize

    68KB

  • memory/2460-38-0x000007FEF8110000-0x000007FEF8128000-memory.dmp

    Filesize

    96KB

  • memory/2460-37-0x000007FEF7E30000-0x000007FEF7E51000-memory.dmp

    Filesize

    132KB

  • memory/2460-36-0x000007FEF78E0000-0x000007FEF7921000-memory.dmp

    Filesize

    260KB