Analysis
- max time kernel
144s - max time network
123s - platform
windows7_x64 - resource
win7-20240705-en - resource tags
- submitted
02/08/2024, 19:52
General
- Target source/Bat To Exe Converter.rar
- Size 419KB
- Sample240802-ylnh2ssfrc
- SHA256 180771c0c9a08aec09130dc669fba44a4e9f3b51ea0c916be8edcc8663667fc2
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\source\Bat To Exe Converter.rar"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\source\Bat To Exe Converter.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\source\Bat To Exe Converter.rar3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\source\Bat To Exe Converter.rar"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2028-29-0x000000013FB20000-0x000000013FC18000-memory.dmp
memory/2028-30-0x000007FEF6610000-0x000007FEF6644000-memory.dmp
memory/2028-35-0x000007FEF65B0000-0x000007FEF65C7000-memory.dmp
memory/2028-37-0x000007FEF6570000-0x000007FEF658D000-memory.dmp
memory/2028-38-0x000007FEF6120000-0x000007FEF6131000-memory.dmp
memory/2028-36-0x000007FEF6590000-0x000007FEF65A1000-memory.dmp
memory/2028-31-0x000007FEF5820000-0x000007FEF5AD6000-memory.dmp
memory/2028-34-0x000007FEF65D0000-0x000007FEF65E1000-memory.dmp
memory/2028-33-0x000007FEF65F0000-0x000007FEF6607000-memory.dmp
memory/2028-32-0x000007FEF6B50000-0x000007FEF6B68000-memory.dmp
memory/2028-39-0x000007FEF54E0000-0x000007FEF56EB000-memory.dmp
memory/2028-47-0x000007FEF5430000-0x000007FEF544B000-memory.dmp
memory/2028-55-0x000007FEF5220000-0x000007FEF5248000-memory.dmp
memory/2028-62-0x000007FEF2FC0000-0x000007FEF2FD1000-memory.dmp
memory/2028-61-0x000007FEF2FE0000-0x000007FEF30EE000-memory.dmp
memory/2028-60-0x000007FEF5160000-0x000007FEF5172000-memory.dmp
memory/2028-59-0x000007FEF5180000-0x000007FEF5191000-memory.dmp
memory/2028-58-0x000007FEF51A0000-0x000007FEF51C3000-memory.dmp
memory/2028-57-0x000007FEF51D0000-0x000007FEF51E8000-memory.dmp
memory/2028-56-0x000007FEF51F0000-0x000007FEF5214000-memory.dmp
memory/2028-54-0x000007FEF5250000-0x000007FEF52A7000-memory.dmp
memory/2028-53-0x000007FEF52B0000-0x000007FEF52C1000-memory.dmp
memory/2028-51-0x000007FEF5350000-0x000007FEF53B7000-memory.dmp
memory/2028-50-0x000007FEF53C0000-0x000007FEF53F0000-memory.dmp
memory/2028-49-0x000007FEF53F0000-0x000007FEF5408000-memory.dmp
memory/2028-48-0x000007FEF5410000-0x000007FEF5421000-memory.dmp
memory/2028-40-0x000007FEF3D40000-0x000007FEF4DF0000-memory.dmp
memory/2028-52-0x000007FEF52D0000-0x000007FEF534C000-memory.dmp
memory/2028-46-0x000007FEF5450000-0x000007FEF5461000-memory.dmp
memory/2028-45-0x000007FEF5470000-0x000007FEF5481000-memory.dmp
memory/2028-44-0x000007FEF5490000-0x000007FEF54A1000-memory.dmp
memory/2028-43-0x000007FEF5F30000-0x000007FEF5F48000-memory.dmp
memory/2028-42-0x000007FEF54B0000-0x000007FEF54D1000-memory.dmp
memory/2028-41-0x000007FEF60D0000-0x000007FEF6111000-memory.dmp