Resubmissions
31-07-2024 04:57
240731-flg26axflr 3Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
31-07-2024 04:57
General
-
Target
Hoic.rar
-
Size
1.7MB
-
MD5
ba60fe26a85d5f5b6338d562930aeff2
-
SHA1
499b6643dd5a7f1dd4d57506041c1207e657bce0
-
SHA256
59e0d15fcdf92551a204c7e71776a88f54ea9df74e2ba2cfb04e7582c04dec81
-
SHA512
2fcc74e1c44ae2a9829d53eb6f7946965ad6f8d88b2ebaf8df223c881b99066c155cc94a3c566cfe08ebfe1eded6615df410ee30dc0c9877aba1c9daa44217ec
-
SSDEEP
49152:YQs04R8oXUEgIRnwN/INLZw8NoibprkwSIdwHQa:zSRYfNANLZw8NLbZudh
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 58 IoCs
-
Suspicious use of SendNotifyMessage 57 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Hoic.rar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Hoic.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Hoic.rar3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Hoic.rar"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
155B
MD5316d70846c4e0f9603aeacc8e6f9f9d9
SHA1913df646348e3af2e728868016c4da9a36c8644a
SHA2560b00aebd135206e7463ede8392dbd69e0cba41d0027520099ba5185fbadd21a5
SHA5125ce88eb2f7ff7da7a84cf4fa7e23cad16d38d9e77495cb5948b791e58d3c5c7f65f9164aa43f704f94e6d2a4ac6dbbc2bea929421aa475e35f307966b5d98947
-
Filesize
18B
MD5c827a2591780274602f87ff14a28239d
SHA1f55b701fc01c08d2fb83814f5e0c9e2dccc26192
SHA256394cf3c4659d4a38d63d37ba07e1c5b334c72b7bb8d222601a7314f22b9654cf
SHA512355c4fcbcc2f2bcc610182e7a274995255120dff1ad7a93cc77daf343c03572110b715b1e6bf495b9ee33bb97d5e3726ef139f6367680496db3fb8861136751c
-
Filesize
208KB
-
Filesize
992KB
-
Filesize
96KB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
2.7MB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
116KB
-
Filesize
68KB
-
Filesize
2.0MB
-
Filesize
260KB
-
Filesize
132KB
-
Filesize
96KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
108KB
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
192KB
-
Filesize
412KB
-
Filesize
16.7MB
-
Filesize
496KB
-
Filesize
68KB
-
Filesize
348KB
-
Filesize
160KB
-
Filesize
144KB
-
Filesize
96KB
-
Filesize
140KB
-
Filesize
68KB
-
Filesize
72KB
-
Filesize
1.1MB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
88KB
-
Filesize
168KB
-
Filesize
72KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
188KB
-
Filesize
76KB
-
Filesize
68KB
-
Filesize
348KB
-
Filesize
788KB
-
Filesize
76KB
-
Filesize
68KB
-
Filesize
80KB
-
Filesize
72KB
-
Filesize
80KB
-
Filesize
120KB
-
Filesize
92KB
-
Filesize
84KB
-
Filesize
80KB
-
Filesize
176KB
-
Filesize
76KB
-
Filesize
196KB
-
Filesize
88KB
-
Filesize
68KB
-
Filesize
72KB
-
Filesize
64KB