Analysis

  • max time kernel
    144s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    16-06-2024 17:04

General

  • Target

    release.rar

  • Size

    11.3MB

  • MD5

    5c001e7cd4bead1393a073f4db374f2b

  • SHA1

    126db88412f3b4c26c7c03c7ecf003dafa69b671

  • SHA256

    957bc987044ba0adaa749cdca6e8e74b560d2484a00ce8eeda77b4964f25bf97

  • SHA512

    fc48c73a1869cb2f6a89f792e1a50bb3349b4a1625d4ba8e22839c5ded2b4ec7a81763749ec05d4c94081659dd50a6395fbee059a7c24a84640be132121dbdb0

  • SSDEEP

    196608:nCwrLldq0DxetYixAvGUFi0gpuKLoqizxw1p9o3IVTiypXyGv:ho0o9A+UA0gxLonzc9o3IB/sGv

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\release.rar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2352
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\release.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1940
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\release.rar
        3⤵
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2540
        • C:\Program Files\VideoLAN\VLC\vlc.exe
          "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\release.rar"
          4⤵
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:2484

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2484-30-0x000007FEFA980000-0x000007FEFA9B4000-memory.dmp

    Filesize

    208KB

  • memory/2484-29-0x000000013FFE0000-0x00000001400D8000-memory.dmp

    Filesize

    992KB

  • memory/2484-32-0x000007FEFA960000-0x000007FEFA978000-memory.dmp

    Filesize

    96KB

  • memory/2484-33-0x000007FEFA940000-0x000007FEFA957000-memory.dmp

    Filesize

    92KB

  • memory/2484-35-0x000007FEFA900000-0x000007FEFA917000-memory.dmp

    Filesize

    92KB

  • memory/2484-34-0x000007FEFA920000-0x000007FEFA931000-memory.dmp

    Filesize

    68KB

  • memory/2484-36-0x000007FEFA350000-0x000007FEFA361000-memory.dmp

    Filesize

    68KB

  • memory/2484-37-0x000007FEFA330000-0x000007FEFA34D000-memory.dmp

    Filesize

    116KB

  • memory/2484-38-0x000007FEF7450000-0x000007FEF7461000-memory.dmp

    Filesize

    68KB

  • memory/2484-31-0x000007FEF59D0000-0x000007FEF5C86000-memory.dmp

    Filesize

    2.7MB

  • memory/2484-39-0x000007FEF5690000-0x000007FEF589B000-memory.dmp

    Filesize

    2.0MB

  • memory/2484-43-0x000007FEF61A0000-0x000007FEF61B8000-memory.dmp

    Filesize

    96KB

  • memory/2484-41-0x000007FEF6570000-0x000007FEF65B1000-memory.dmp

    Filesize

    260KB

  • memory/2484-42-0x000007FEF6540000-0x000007FEF6561000-memory.dmp

    Filesize

    132KB

  • memory/2484-47-0x000007FEF5650000-0x000007FEF566B000-memory.dmp

    Filesize

    108KB

  • memory/2484-49-0x000007FEF5610000-0x000007FEF5628000-memory.dmp

    Filesize

    96KB

  • memory/2484-48-0x000007FEF5630000-0x000007FEF5641000-memory.dmp

    Filesize

    68KB

  • memory/2484-46-0x000007FEF5670000-0x000007FEF5681000-memory.dmp

    Filesize

    68KB

  • memory/2484-45-0x000007FEF6160000-0x000007FEF6171000-memory.dmp

    Filesize

    68KB

  • memory/2484-50-0x000007FEF55E0000-0x000007FEF5610000-memory.dmp

    Filesize

    192KB

  • memory/2484-44-0x000007FEF6180000-0x000007FEF6191000-memory.dmp

    Filesize

    68KB

  • memory/2484-51-0x000007FEF5570000-0x000007FEF55D7000-memory.dmp

    Filesize

    412KB

  • memory/2484-54-0x000007FEF5470000-0x000007FEF54C7000-memory.dmp

    Filesize

    348KB

  • memory/2484-53-0x000007FEF54D0000-0x000007FEF54E1000-memory.dmp

    Filesize

    68KB

  • memory/2484-52-0x000007FEF54F0000-0x000007FEF556C000-memory.dmp

    Filesize

    496KB

  • memory/2484-58-0x000007FEF53C0000-0x000007FEF53E3000-memory.dmp

    Filesize

    140KB

  • memory/2484-59-0x000007FEF53A0000-0x000007FEF53B1000-memory.dmp

    Filesize

    68KB

  • memory/2484-57-0x000007FEF53F0000-0x000007FEF5408000-memory.dmp

    Filesize

    96KB

  • memory/2484-60-0x000007FEF5380000-0x000007FEF5392000-memory.dmp

    Filesize

    72KB

  • memory/2484-56-0x000007FEF5410000-0x000007FEF5434000-memory.dmp

    Filesize

    144KB

  • memory/2484-55-0x000007FEF5440000-0x000007FEF5468000-memory.dmp

    Filesize

    160KB

  • memory/2484-61-0x000007FEF3470000-0x000007FEF3481000-memory.dmp

    Filesize

    68KB

  • memory/2484-63-0x000007FEF1900000-0x000007FEF1917000-memory.dmp

    Filesize

    92KB

  • memory/2484-66-0x000007FEF1020000-0x000007FEF1031000-memory.dmp

    Filesize

    68KB

  • memory/2484-67-0x000007FEF1000000-0x000007FEF1016000-memory.dmp

    Filesize

    88KB

  • memory/2484-68-0x000007FEF0E50000-0x000007FEF0F15000-memory.dmp

    Filesize

    788KB

  • memory/2484-62-0x000007FEF3370000-0x000007FEF346F000-memory.dmp

    Filesize

    1020KB

  • memory/2484-64-0x000007FEFA320000-0x000007FEFA330000-memory.dmp

    Filesize

    64KB

  • memory/2484-65-0x000007FEF1040000-0x000007FEF106F000-memory.dmp

    Filesize

    188KB

  • memory/2484-72-0x000007FEF04D0000-0x000007FEF0650000-memory.dmp

    Filesize

    1.5MB

  • memory/2484-71-0x000007FEF0650000-0x000007FEF06BD000-memory.dmp

    Filesize

    436KB

  • memory/2484-70-0x000007FEF06C0000-0x000007FEF0722000-memory.dmp

    Filesize

    392KB

  • memory/2484-69-0x000007FEF0FB0000-0x000007FEF0FF2000-memory.dmp

    Filesize

    264KB

  • memory/2484-40-0x000007FEF3DE0000-0x000007FEF4E90000-memory.dmp

    Filesize

    16.7MB