Resubmissions
06-08-2024 11:22
240806-ng2vrs1hkf 1006-08-2024 10:55
240806-m1enxaxdmk 706-08-2024 10:51
240806-mxymls1eje 306-08-2024 10:49
240806-mw4r8sxcnj 10Analysis
-
max time kernel
84s -
max time network
56s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
06-08-2024 10:51
Static task
static1
Behavioral task
behavioral1
Sample
✪➳S͜͡eTuP✔!!・2025・!!P͜A@s$w0rD~KEY!#~.rar
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
✪➳S͜͡eTuP✔!!・2025・!!P͜A@s$w0rD~KEY!#~.rar
Resource
win10v2004-20240802-en
General
-
Target
✪➳S͜͡eTuP✔!!・2025・!!P͜A@s$w0rD~KEY!#~.rar
-
Size
8.5MB
-
MD5
4842923543c235197601ce5edc83151f
-
SHA1
0cf299e2c90094aff18a9953dfb6f4b10a4de397
-
SHA256
761e8398a24d05d612b20c4dc7519b1f15835ea393534a5d230c14eecc93bc83
-
SHA512
95c31450d070b7d1e26753ae0337490971c3992b84fd5ab304e279f7be06b2c37be27108174c055abb83283528f15cc73ada193e64a68bf84f4bf7717d7764f7
-
SSDEEP
196608:KXMwoXXUMMuabSO9PlXD1s7f8bsCvOsU2mldGpKnWsXGOt:7wYvO99Xh42sCHml9WOt
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
helppane.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main helppane.exe -
Modifies registry class 2 IoCs
Processes:
rundll32.exerundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 2636 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
rundll32.exevlc.exepid process 2108 rundll32.exe 2636 vlc.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
helppane.exedescription pid process Token: SeTakeOwnershipPrivilege 2116 helppane.exe Token: SeTakeOwnershipPrivilege 2116 helppane.exe Token: SeTakeOwnershipPrivilege 2116 helppane.exe Token: SeTakeOwnershipPrivilege 2116 helppane.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
Processes:
vlc.exehelppane.exepid process 2636 vlc.exe 2636 vlc.exe 2636 vlc.exe 2636 vlc.exe 2636 vlc.exe 2636 vlc.exe 2636 vlc.exe 2636 vlc.exe 2636 vlc.exe 2116 helppane.exe -
Suspicious use of SendNotifyMessage 8 IoCs
Processes:
vlc.exepid process 2636 vlc.exe 2636 vlc.exe 2636 vlc.exe 2636 vlc.exe 2636 vlc.exe 2636 vlc.exe 2636 vlc.exe 2636 vlc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
vlc.exehelppane.exepid process 2636 vlc.exe 2116 helppane.exe 2116 helppane.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
cmd.exerundll32.exerundll32.exedescription pid process target process PID 1880 wrote to memory of 2108 1880 cmd.exe rundll32.exe PID 1880 wrote to memory of 2108 1880 cmd.exe rundll32.exe PID 1880 wrote to memory of 2108 1880 cmd.exe rundll32.exe PID 2108 wrote to memory of 2716 2108 rundll32.exe rundll32.exe PID 2108 wrote to memory of 2716 2108 rundll32.exe rundll32.exe PID 2108 wrote to memory of 2716 2108 rundll32.exe rundll32.exe PID 2716 wrote to memory of 2636 2716 rundll32.exe vlc.exe PID 2716 wrote to memory of 2636 2716 rundll32.exe vlc.exe PID 2716 wrote to memory of 2636 2716 rundll32.exe vlc.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\✪➳S͜͡eTuP✔!!・2025・!!P͜A@s$w0rD~KEY!#~.rar1⤵
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\✪➳S͜͡eTuP✔!!・2025・!!P͜A@s$w0rD~KEY!#~.rar2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\✪➳S͜͡eTuP✔!!・2025・!!P͜A@s$w0rD~KEY!#~.rar3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\✪➳S͜͡eTuP✔!!・2025・!!P͜A@s$w0rD~KEY!#~.rar"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2636
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1896
-
C:\Windows\helppane.exeC:\Windows\helppane.exe -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2116