e6b6644243ee561b6c388581f42117c317967ffa5cf12080838e61e89f98b7ec

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2 Vkontakte Smart Avatark/WinrRarSerialInstall.exe
Size

149KB
MD5

809f5b6750aef3fbd5c7915ec20bd119
SHA1

1d794d9d0184eb1d9b4adf5a55e01dd02bbb76d8
SHA256

960cd42ade15c84c566a5510449082e4f27b70d35cf857d129e141f8b08e3b96
SHA512

ca3dab3463e773d45e9514fe2e07754071a5f17855153676f6580767548c092544ea283cbb113d4da4356a0ed5e4f6792a2569ae6d20b55410c977c061120700
SSDEEP

3072:cPyB0GTWtakxp4lCcqUAlrGP+2OzN+Uli:0yBRq8kgGUA1o5M2

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	WinrRarSerialInstall.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	WinrRarSerialInstall.exe
File opened (read-only)	\??\T:	WinrRarSerialInstall.exe
File opened (read-only)	\??\O:	WinrRarSerialInstall.exe
File opened (read-only)	\??\J:	WinrRarSerialInstall.exe
File opened (read-only)	\??\G:	WinrRarSerialInstall.exe
File opened (read-only)	\??\Y:	WinrRarSerialInstall.exe
File opened (read-only)	\??\W:	WinrRarSerialInstall.exe
File opened (read-only)	\??\U:	WinrRarSerialInstall.exe
File opened (read-only)	\??\S:	WinrRarSerialInstall.exe
File opened (read-only)	\??\H:	WinrRarSerialInstall.exe
File opened (read-only)	\??\E:	WinrRarSerialInstall.exe
File opened (read-only)	\??\X:	WinrRarSerialInstall.exe
File opened (read-only)	\??\R:	WinrRarSerialInstall.exe
File opened (read-only)	\??\Q:	WinrRarSerialInstall.exe
File opened (read-only)	\??\M:	WinrRarSerialInstall.exe
File opened (read-only)	\??\K:	WinrRarSerialInstall.exe
File opened (read-only)	\??\I:	WinrRarSerialInstall.exe
File opened (read-only)	\??\V:	WinrRarSerialInstall.exe
File opened (read-only)	\??\P:	WinrRarSerialInstall.exe
File opened (read-only)	\??\N:	WinrRarSerialInstall.exe
File opened (read-only)	\??\L:	WinrRarSerialInstall.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\autorun.inf	WinrRarSerialInstall.exe
File opened for modification	C:\autorun.inf	WinrRarSerialInstall.exe
File opened for modification	C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\CD Burning\autorun.inf	WinrRarSerialInstall.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACRORD32.EXE	WinrRarSerialInstall.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3096	1492	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1492	WinrRarSerialInstall.exe
1492	WinrRarSerialInstall.exe

C:\Users\Admin\AppData\Local\Temp\2 Vkontakte Smart Avatark\WinrRarSerialInstall.exe
"C:\Users\Admin\AppData\Local\Temp\2 Vkontakte Smart Avatark\WinrRarSerialInstall.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 724
  2⤵
  - Program crash
  PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1492 -ip 1492
1⤵
PID:3548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\autorun.inf

Filesize
126B

MD5
163e20cbccefcdd42f46e43a94173c46

SHA1
4c7b5048e8608e2a75799e00ecf1bbb4773279ae

SHA256
7780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e

SHA512
e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8

Download Submit
C:\zPharaoh.exe

Filesize
69KB

MD5
254b5de720f303b12d9da39f1f554c40

SHA1
3ce03c5601f3465b136dfbc69ee709dd2d3def72

SHA256
b02192c1260e8102c039a5c692eca613335678a8418de6ef84ff6d3db8e00867

SHA512
9c9be5ebc2f50d41688ab7f4a7f5f27f3ea137511fc6f770b1fa79b0531d9f4119b8d921665b150ce95433c80a002c9827e1df5d15639cc6b053a5858c16f833

Download Submit
memory/1492-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1492-28-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download