Analysis
-
max time kernel
1724s -
max time network
1507s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
03-08-2024 07:47
Behavioral task
behavioral1
Sample
R D X E 6 5.rar
Resource
win7-20240704-en
windows7-x64
8 signatures
1800 seconds
Behavioral task
behavioral2
Sample
R D X E 6 5/Client.exe
Resource
win7-20240729-en
windows7-x64
0 signatures
1800 seconds
Behavioral task
behavioral3
Sample
R D X E 6 5/Roblox Executor.exe
Resource
win7-20240729-en
windows7-x64
16 signatures
1800 seconds
General
-
Target
R D X E 6 5.rar
-
Size
10.7MB
-
MD5
bf488a28c0aa529bf8ff779b673d58fb
-
SHA1
687f8e7164f642d746a7c7b7dd5c1c70d1e1453c
-
SHA256
f29f8a8d5cf10644a4fecee5eefacfdad688b0b96540cd68ea4ae7058bfe327b
-
SHA512
3c02bd2718eaf58c7cd70c6cebf1c797a5cab5a684918eaa5068e836897c5ef4091f3dca1badb1bb86557a8ad103b1de39b5e19efd60029baf67f13244e0c542
-
SSDEEP
196608:qfMWCbdJFQ4G78fFZ0sqBCaSqLHjgIoX8ExcBjP3hIksFQQdO5:hWCJfBFZ0sCd4IoMecV/hHsOQc
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1248 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1248 vlc.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 1248 vlc.exe 1248 vlc.exe 1248 vlc.exe 1248 vlc.exe 1248 vlc.exe 1248 vlc.exe 1248 vlc.exe 1248 vlc.exe -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 1248 vlc.exe 1248 vlc.exe 1248 vlc.exe 1248 vlc.exe 1248 vlc.exe 1248 vlc.exe 1248 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1248 vlc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3004 wrote to memory of 2288 3004 cmd.exe 30 PID 3004 wrote to memory of 2288 3004 cmd.exe 30 PID 3004 wrote to memory of 2288 3004 cmd.exe 30 PID 2288 wrote to memory of 2748 2288 rundll32.exe 31 PID 2288 wrote to memory of 2748 2288 rundll32.exe 31 PID 2288 wrote to memory of 2748 2288 rundll32.exe 31 PID 2748 wrote to memory of 1248 2748 rundll32.exe 33 PID 2748 wrote to memory of 1248 2748 rundll32.exe 33 PID 2748 wrote to memory of 1248 2748 rundll32.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\R D X E 6 5.rar"1⤵
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\R D X E 6 5.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\R D X E 6 5.rar3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\R D X E 6 5.rar"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1248
-
-
-