Analysis

  • max time kernel
    27s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    27-06-2024 14:23

General

  • Target

    Venus_Tool.rar

  • Size

    9.4MB

  • MD5

    7f607e521c074beb44d6367edb47dab7

  • SHA1

    7c289b2452562f101a290ed22c8935c7e774276e

  • SHA256

    58be5988b695cac73ceb09a2626505f57774c5120c35566f8524fd5c317f8cbb

  • SHA512

    844f2e6ca456f44ef5d7ae5f18bd5c4ec762d1396297e326f02551a37d8db9374df472a9cf8506b52472bb30dc6c76ca444b3ad35533c983d7cd5e691eca9d9c

  • SSDEEP

    196608:qpx++xyS2rmsbDSie8LyMhQbzfHbzRscpEVq2KJyXLtj5zOdn:oxv92r5xeAhgzfRslqHJyhJO1

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 14 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Venus_Tool.rar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:396
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Venus_Tool.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2760
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Venus_Tool.rar
        3⤵
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2624
        • C:\Program Files\VideoLAN\VLC\vlc.exe
          "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Venus_Tool.rar"
          4⤵
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:2552

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2552-37-0x000007FEF6C70000-0x000007FEF6CA4000-memory.dmp

    Filesize

    208KB

  • memory/2552-36-0x000000013FA30000-0x000000013FB28000-memory.dmp

    Filesize

    992KB

  • memory/2552-39-0x000007FEF5970000-0x000007FEF5988000-memory.dmp

    Filesize

    96KB

  • memory/2552-40-0x000007FEF5950000-0x000007FEF5967000-memory.dmp

    Filesize

    92KB

  • memory/2552-41-0x000007FEF5930000-0x000007FEF5941000-memory.dmp

    Filesize

    68KB

  • memory/2552-42-0x000007FEF5910000-0x000007FEF5927000-memory.dmp

    Filesize

    92KB

  • memory/2552-43-0x000007FEF58F0000-0x000007FEF5901000-memory.dmp

    Filesize

    68KB

  • memory/2552-44-0x000007FEF58D0000-0x000007FEF58ED000-memory.dmp

    Filesize

    116KB

  • memory/2552-38-0x000007FEF5AC0000-0x000007FEF5D76000-memory.dmp

    Filesize

    2.7MB

  • memory/2552-45-0x000007FEF58B0000-0x000007FEF58C1000-memory.dmp

    Filesize

    68KB

  • memory/2552-55-0x000007FEF44B0000-0x000007FEF44C1000-memory.dmp

    Filesize

    68KB

  • memory/2552-58-0x000007FEF43F0000-0x000007FEF4457000-memory.dmp

    Filesize

    412KB

  • memory/2552-60-0x000007FEF4350000-0x000007FEF4361000-memory.dmp

    Filesize

    68KB

  • memory/2552-59-0x000007FEF4370000-0x000007FEF43EC000-memory.dmp

    Filesize

    496KB

  • memory/2552-57-0x000007FEF4460000-0x000007FEF4490000-memory.dmp

    Filesize

    192KB

  • memory/2552-61-0x000007FEF42F0000-0x000007FEF4347000-memory.dmp

    Filesize

    348KB

  • memory/2552-56-0x000007FEF4490000-0x000007FEF44A8000-memory.dmp

    Filesize

    96KB

  • memory/2552-62-0x000007FEF42C0000-0x000007FEF42E8000-memory.dmp

    Filesize

    160KB

  • memory/2552-63-0x000007FEF4290000-0x000007FEF42B4000-memory.dmp

    Filesize

    144KB

  • memory/2552-64-0x000007FEF4270000-0x000007FEF4288000-memory.dmp

    Filesize

    96KB

  • memory/2552-65-0x000007FEF4240000-0x000007FEF4263000-memory.dmp

    Filesize

    140KB

  • memory/2552-66-0x000007FEF4220000-0x000007FEF4231000-memory.dmp

    Filesize

    68KB

  • memory/2552-54-0x000007FEF44D0000-0x000007FEF44EB000-memory.dmp

    Filesize

    108KB

  • memory/2552-67-0x000007FEF4200000-0x000007FEF4212000-memory.dmp

    Filesize

    72KB

  • memory/2552-68-0x000007FEF32B0000-0x000007FEF32C7000-memory.dmp

    Filesize

    92KB

  • memory/2552-53-0x000007FEF44F0000-0x000007FEF4501000-memory.dmp

    Filesize

    68KB

  • memory/2552-52-0x000007FEF4510000-0x000007FEF4521000-memory.dmp

    Filesize

    68KB

  • memory/2552-51-0x000007FEF4530000-0x000007FEF4541000-memory.dmp

    Filesize

    68KB

  • memory/2552-50-0x000007FEF4550000-0x000007FEF4568000-memory.dmp

    Filesize

    96KB

  • memory/2552-49-0x000007FEF4570000-0x000007FEF4591000-memory.dmp

    Filesize

    132KB

  • memory/2552-48-0x000007FEF45A0000-0x000007FEF45E1000-memory.dmp

    Filesize

    260KB

  • memory/2552-47-0x000007FEF45F0000-0x000007FEF47FB000-memory.dmp

    Filesize

    2.0MB

  • memory/2552-46-0x000007FEF4800000-0x000007FEF58B0000-memory.dmp

    Filesize

    16.7MB