Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
13/07/2024, 07:42
General
-
Target
2 Vkontakte Smart Avatark/2 Vkontakte Smart Avatark .exe
-
Size
149KB
-
MD5
cc4ca16249d1d659b5261f2ef0230b5b
-
SHA1
c1f89e1bcfc913505519e47d89def027061eae71
-
SHA256
8194af2417a6e979cdc1d9df203bbababb0ef5d290cf7609dfb07b378b069609
-
SHA512
6d5c625024a12b36ac5a5213ea472dcf2cb79bfc6bbc7c47f151095b22878da4ac4668db3170b1de8e7646ec38995e054dbcd83979971986831bb50e8ee69f55
-
SSDEEP
3072:uZ1UE7Zk06M6fjScmUdt+LPGvtix2n2Az5S31AibtLOQeJ7aWC:uZpL6MEjwTxqbz5S31jtLOLdC
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2 Vkontakte Smart Avatark\2 Vkontakte Smart Avatark .exe"C:\Users\Admin\AppData\Local\Temp\2 Vkontakte Smart Avatark\2 Vkontakte Smart Avatark .exe"1⤵
- Modifies visibility of file extensions in Explorer
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 11922⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3428 -ip 34281⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
126B
MD5163e20cbccefcdd42f46e43a94173c46
SHA14c7b5048e8608e2a75799e00ecf1bbb4773279ae
SHA2567780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e
SHA512e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8
-
Filesize
149KB
MD5c35cc97ee9090e00f86693bef60c030d
SHA10d19dfa953598d3b69c25f15b0f461a93a366443
SHA25650fcedf68b3edcbbbab773300ab159d064e4b1d3c5728edb03336b94eeab907a
SHA512c8d4693c7ba0c96cba0203b130479042bd3fbea8b176dfe7ecc6d3d14a91f324852eee7fcb52715c4d8feb2bad35e6ff6a86720fbcdea61763ba20634340a0eb
-
Filesize
149KB
MD56699796425912ab0fe7a72245e3b06af
SHA1dc7c201fcd3f8565692467a9c68546cc8b267ea4
SHA256af0606dbc61a47d0d4515c6d1bb78a326362069bffc0b70f16cbef181444f77a
SHA5125d235237e05dd0443735544a1076205c65cacea0f01fdfe5c3c6fe44efc073f4f021c19d174dea6d4015f50938bb34689623961542b8796c8fcd51af19abc4a6
-
Filesize
88KB
-
Filesize
88KB