Analysis
-
max time kernel
119s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
14/09/2024, 05:57
General
-
Target
14 reasons why.scr
-
Size
5.2MB
-
MD5
c801ab677b3c8b4252655aad173d65c0
-
SHA1
c72d16f9379af86e2ebe042ff0b700ddb58c3ce5
-
SHA256
f4358e8cd06c6aa0ab141259189c6d796e81b99c6963cf9dd9797c6d4773a314
-
SHA512
79b08e54e4eaf56aafaf9ca5c3c0aa407a73a9b8fa7d2426930da10be86f0d9f1bbeec1bb5ea9809aee22583b39f1a00ed9fc989f2deef6b9d449e45aba8a72f
-
SSDEEP
98304:pAPIfnazMD/x/0feyGoQ940BDlgwdnpka9R/k9t+2MGt+8cYw3FV:pAPUDfyGowBdnpkYRM6uw
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
-
Drops desktop.ini file(s) 22 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 11 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 9 IoCs
-
Suspicious behavior: AddClipboardFormatListener 7 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 27 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\14 reasons why.scr"C:\Users\Admin\AppData\Local\Temp\14 reasons why.scr" /S1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\14 reasons why.scr"C:\Users\Admin\AppData\Local\Temp\14 reasons why.scr" /S2⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\CompareReset.3gpp"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\EditShow.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\EditShow.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\RegisterProtect.rtf" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27B
MD5c178d40ba2c55d01774487c0efb8e39e
SHA1ceea8fe25edfd6705a996bdcf4304c89a5e3838c
SHA256b62864b614b8238fdd623b3a3b6500366774b9a0695c8872d22e95dd36605b8a
SHA512d743285eba254dbdaa6403a41054f868cbfe70092a0b60f6a70dea5bea87fcb00f9ca283eefdc05c253cd4aa3f761b966ce2720dada7148623d31d9c2071f76c
-
Filesize
102B
MD5c0cc2be053fcaaa0344095398046692b
SHA1aa366dcd3410ea68e8437ac715994bb2aac4ef04
SHA256b74d667539648e63fcb70419a9cc574c50d4b3ca1253a39e22aea2fbe9b71294
SHA5128df07b10c9de7e8a12e1ff47e86b552a5c4331e8d930a9de6f130e4df41212deb43b88a5eb181c0c822e21ac4541d8c6cef510c34c950376535be6149e27140c
-
Filesize
48B
MD5c0de6de51f72bb98c14e4a111e2ecf05
SHA13a983e60099162529fb8f79d115f227b2518a2ae
SHA256c5899c727e4b1245ab51c5f8cce52b0e945e61fdfc1ca6a8392a98c5df016920
SHA512823544df0915af44db6db0fd008c0a28d2279ae0b7f1934711430a311fa9f70eff0afbdfd6491c5e81b844e701ef89010f8223ca3a9a9d7da86b776414a6be5c
-
Filesize
26.0MB
MD582218838eb161d07884508cd1f4883bc
SHA11618d63a54c08318c8e64b9b88d15b4c479b8707
SHA2560b01b2a37c0bb68a1a8142fbfeaea0ccfba2e30f114021139c73956232eaf0ea
SHA512db5df30c03e11309178bc533d78ad5a61a3aad94669a289fb7ea796ea7b8e07fcaedf4f2d346b74b4358c7330183e232f0b9f00bc33fd1b195abb2f71b1c6a17
-
Filesize
1KB
MD5c0e1667254f853fd9d6f7b54bcacda43
SHA1aba8e391a3fe0518cdf9a51a77ebde0b0c3129c0
SHA25628191e123c2a73c537503d8d30b8f8fe12973621da0c4da4f29723782feaefec
SHA512dcabceaecebbee3ac618239ba8e6ee832755127524d668ac780a01f87bae69647974be7bcb44b65d73ea583a7bc33d8aca84b117b0e8f8ac476b0d3ba159d762
-
Filesize
471B
MD53e35189fcb9eb864e2dbe97127213531
SHA17763ee297509f97b691cddb139dc4194b5fc345a
SHA2566cc87b595ef6cdf02df75c2f854ee2c2e905dcbf57bd2feaf08d4875215c5ff2
SHA5127a10c5f14de94352640704d4995ecdde4822ad816fc9d4e7dde19721fe7a34e67bfed5622b8e71f962e516133f2c413744ef8e6d40c30506d90cd56e1f6b6808
-
Filesize
471B
MD5ddab9ba6d995c9cccd95964b4ad4ce40
SHA15345a6d122113475b8a2b36b3273efe1ea48f4e8
SHA256f492031400502c7376269631d12a43ee11b3908b03a1bb0da7882bf23b0a7e9b
SHA512ed56b541c9bab8cfbbef667351774a27133d47f3269c193f77bdc0b3108c7d4c090657a9e9c1bfe446d58badb6c56b99565784f4db3e04b85cdd7993a8a0dde4
-
Filesize
412B
MD52a20d2f2a886cb18e55a5294b3b7943b
SHA19a8754b6c1c89be4a33023afb389a640c78d7a5b
SHA256a7dc4d6827baeab08075e55472cf9220dcc89c9cc0b08528ba95c6f2da0b761e
SHA512a4bf7864f2cbd5be564c9a505aab3cf5d44c83b6e7054dd5ff4bf9a9c66bf9fe04dcec9dc84edf230125f79391e7ab385e17fa03eccddcff48b1d0ed58ef4fab
-
Filesize
420B
MD5c54ee7aaa25c58cc7a853ff33890b6af
SHA184e72a8d33b3baec5c05155778e66f425977d33a
SHA256186f0453b64efb4547a26073d20454fafee824cd7e73f43e3254647e154a4853
SHA5126733efa5c9598f1c8db016132976d61047e83b5c709f623ac05f59a842395a58be37b24393cff571c2163d3d695e2762054cdb6ac5a644ea47ba3dcce227e35c
-
Filesize
21B
MD5f1b59332b953b3c99b3c95a44249c0d2
SHA11b16a2ca32bf8481e18ff8b7365229b598908991
SHA256138e49660d259061d8152137abd8829acdfb78b69179890beb489fe3ffe23e0c
SHA5123c1f99ecc394df3741be875fbe8d95e249d1d9ac220805794a22caf81620d5fdd3cce19260d94c0829b3160b28a2b4042e46b56398e60f72134e49254e9679a4
-
Filesize
417B
MD5c56ff60fbd601e84edd5a0ff1010d584
SHA1342abb130dabeacde1d8ced806d67a3aef00a749
SHA256200e8cc8dd12e22c9720be73092eafb620435d4569dbdcdba9404ace2aa4343c
SHA512acd2054fddb33b55b58b870edd4eb6a3cdd3131dfe6139cb3d27054ac2b2a460694c9be9c2a1da0f85606e95e7f393cf16868b6c654e78a664799bc3418da86e
-
Filesize
87B
MD5e4e83f8123e9740b8aa3c3dfa77c1c04
SHA15281eae96efde7b0e16a1d977f005f0d3bd7aad0
SHA2566034f27b0823b2a6a76fe296e851939fd05324d0af9d55f249c79af118b0eb31
SHA512bd6b33fd2bbce4a46991bc0d877695d16f7e60b1959a0defc79b627e569e5c6cac7b4ad4e3e1d8389a08584602a51cf84d44cf247f03beb95f7d307fbba12bb9
-
Filesize
14B
MD56ca4960355e4951c72aa5f6364e459d5
SHA12fd90b4ec32804dff7a41b6e63c8b0a40b592113
SHA25688301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3
SHA5128544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d
-
Filesize
171KB
MD525d016d82d6f85d1c98bbe09f91b6254
SHA12e5ee2b95da0f8c3e6e5c7665ea539cf9d2c3ca2
SHA2562ec3b09e68266b3ca353f75582319a72dd8fb0d95c31f85736275cffa24b34b3
SHA51235584ed666bb2ad40014d65de31ee9d37a79633871d0d0587c2c90f8635d00ec3e9c387b9ddd0ae276c77c75f328c1bd307d2bb420e0de4e5866096d434cde0c
-
Filesize
12KB
MD5e367a5463e235a84b351e23eb11b0f42
SHA19da778fe113d2b9bb413257d37cd7ed0caadeea8
SHA256036cd7b605fb031e5739ea7b10d7719f3a69dccaf0293f99f0c9bbd5e475c83f
SHA512c48c49c94a8e70cb30da66eb66e049daa61df6b708dc2574ad9bf8dcdf3acff3dd0e37b79e557d099654ec8207347516b6c334d53c35926f4c768363bd4cbf1b
-
Filesize
24KB
MD58665de22b67e46648a5a147c1ed296ca
SHA1b289a96fee9fa77dd8e045ae8fd161debd376f48
SHA256b5cbae5c48721295a51896f05abd4c9566be7941cda7b8c2aecb762e6e94425f
SHA512bb03ea9347d302abf3b6fece055cdae0ad2d7c074e8517f230a90233f628e5803928b9ba7ba79c343e58dacb3e7a6fc16b94690a5ab0c71303959654a18bb5da
-
Filesize
24KB
MD5085ebd119f5fc6b8f63720fac1166ff5
SHA1af066018aadec31b8e70a124a158736aca897306
SHA256b8411fe8ec499074fca9047f6983d920279e84ddf3b02b2dd5c08cf07ec44687
SHA512adb0522830db26123347cb485c43b156f5c888510e52091ba0fafc22b650ad29630c027746c920321905c28259dce7ff63dded93a79efddd5567c68312117875
-
Filesize
2KB
MD55347479cf485379ef6d79ff0ee02dd7a
SHA1720d3f841df3e95f0e990bafd47199a0be22581b
SHA256d537cf96d492b1c1a42e92b8d4af7aa44278a48ec3d54fbe6d637ceacbf98aea
SHA512743d96c4c9243bbd4ca9b504c4603e9b694a8d4f924316077eb529269a5370dcc3b0e99c10c8bd3e63660d92d31800e38269b09a656218da36cdfbc6f3458e29
-
Filesize
2KB
MD5416bb6a70ec2066562e110ff0c182e3b
SHA1d93b7c380e9a6bd48d5cd7e69cd78df8fad12e4d
SHA256c8077129ac6c5a33687453cec3b5c4c3bf8f9aaceb34c5667a1a18e18531742f
SHA512893cd692dd6326fa3d27a2396ddb5bc100b2ef0873216d6ac0c16844daec7a572d88b02283299c762b5dd01c7ab363c0d12bc25c67ab5d5b89b4e370337a6b36
-
Filesize
95KB
MD5f34eb034aa4a9735218686590cba2e8b
SHA12bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA2569d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
SHA512d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
-
Filesize
81KB
MD586d1b2a9070cd7d52124126a357ff067
SHA118e30446fe51ced706f62c3544a8c8fdc08de503
SHA25662173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e
SHA5127db4b7e0c518a02ae901f4b24e3860122acc67e38e73f98f993fe99eb20bb3aa539db1ed40e63d6021861b54f34a5f5a364907ffd7da182adea68bbdd5c2b535
-
Filesize
248KB
MD520c77203ddf9ff2ff96d6d11dea2edcf
SHA10d660b8d1161e72c993c6e2ab0292a409f6379a5
SHA2569aac010a424c757c434c460c3c0a6515d7720966ab64bad667539282a17b4133
SHA5122b24346ece2cbd1e9472a0e70768a8b4a5d2c12b3d83934f22ebdc9392d9023dcb44d2322ada9edbe2eb0e2c01b5742d2a83fa57ca23054080909ec6eb7cf3ca
-
Filesize
63KB
MD5d4674750c732f0db4c4dd6a83a9124fe
SHA1fd8d76817abc847bb8359a7c268acada9d26bfd5
SHA256caa4d2f8795e9a55e128409cc016e2cc5c694cb026d7058fc561e4dd131ed1c9
SHA51297d57cfb80dd9dd822f2f30f836e13a52f771ee8485bc0fd29236882970f6bfbdfaac3f2e333bba5c25c20255e8c0f5ad82d8bc8a6b6e2f7a07ea94a9149c81e
-
Filesize
154KB
MD57447efd8d71e8a1929be0fac722b42dc
SHA16080c1b84c2dcbf03dcc2d95306615ff5fce49a6
SHA25660793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be
SHA512c6295d45ed6c4f7534c1a38d47ddc55fea8b9f62bbdc0743e4d22e8ad0484984f8ab077b73e683d0a92d11bf6588a1ae395456cfa57da94bb2a6c4a1b07984de
-
Filesize
77KB
MD5819166054fec07efcd1062f13c2147ee
SHA193868ebcd6e013fda9cd96d8065a1d70a66a2a26
SHA256e6deb751039cd5424a139708475ce83f9c042d43e650765a716cb4a924b07e4f
SHA512da3a440c94cb99b8af7d2bc8f8f0631ae9c112bd04badf200edbf7ea0c48d012843b4a9fb9f1e6d3a9674fd3d4eb6f0fa78fd1121fad1f01f3b981028538b666
-
Filesize
859KB
MD5c4989bceb9e7e83078812c9532baeea7
SHA1aafb66ebdb5edc327d7cb6632eb80742be1ad2eb
SHA256a0f5c7f0bac1ea9dc86d60d20f903cc42cff3f21737426d69d47909fc28b6dcd
SHA512fb6d431d0f2c8543af8df242337797f981d108755712ec6c134d451aa777d377df085b4046970cc5ac0991922ddf1f37445a51be1a63ef46b0d80841222fb671
-
Filesize
3.3MB
MD59d7a0c99256c50afd5b0560ba2548930
SHA176bd9f13597a46f5283aa35c30b53c21976d0824
SHA2569b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939
SHA512cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2
-
Filesize
4.3MB
MD563a1fa9259a35eaeac04174cecb90048
SHA10dc0c91bcd6f69b80dcdd7e4020365dd7853885a
SHA25614b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed
SHA512896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b
-
Filesize
29KB
MD5a653f35d05d2f6debc5d34daddd3dfa1
SHA11a2ceec28ea44388f412420425665c3781af2435
SHA256db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9
SHA5125aede99c3be25b1a962261b183ae7a7fb92cb0cb866065dc9cd7bb5ff6f41cc8813d2cc9de54670a27b3ad07a33b833eaa95a5b46dad7763ca97dfa0c1ce54c9
-
Filesize
1.1MB
MD581d62ad36cbddb4e57a91018f3c0816e
SHA1fe4a4fc35df240b50db22b35824e4826059a807b
SHA2561fb2d66c056f69e8bbdd8c6c910e72697874dae680264f8fb4b4df19af98aa2e
SHA5127d15d741378e671591356dfaad4e1e03d3f5456cbdf87579b61d02a4a52ab9b6ecbffad3274cede8c876ea19eaeb8ba4372ad5986744d430a29f50b9caffb75d
-
Filesize
517B
MD5158e7387c7ba67ad9a4c24b73f6ce412
SHA1ff64db47ae190083e88989065587d4e05741c68f
SHA2566136a27244181b68d4b2f04f1432ab40116c55626c16e37062bb390cae18d69e
SHA512ac00e587d641c84e6ee53c70c172968a44bc609967cbe3b611f385ac7682dc6c6c539a393f2ff875a2ac24054e7e22fae832de012cf7f7a5a37ef4570c7c24c9
-
Filesize
313B
MD51122379611c5deb49136f7e22f4c53a8
SHA151ace13eedc524f10f63d6fcfc6553b9e01cbfc3
SHA256c4941691a440327f209e6674d6e270d67fd6235840a353ca53e326e67d666795
SHA512395eef6cac34f875df91519bb288220c77206fd296426f21227c90abe856acd5c3defe8b1ea9f4461c63e233b422884c2bd0dbb0313c7476a2da34ed8f79d6aa
-
Filesize
778KB
MD52accb04da0ff6e2b6b3fb0cd19e7d2c4
SHA1a5cba600151c1d8d49b7e49069675b5bd44dcbbe
SHA256869108c99436ff5999563899ce9f9e1d8857be00a91e947817a802e3b060b471
SHA5127b039748412725d1983c62dc3b23f520e7c2ef8cfed8c30a0cc6e93570e42975a63fc4e236052f7963bbe1afa525093a4151898d867e02482d96442b9b16425c
-
Filesize
999B
MD5c3ca5b4419b612b25ad1601cb93d5b14
SHA11d4ebebc1f19b9998887cdbb41610c00e26dbde4
SHA256f2cadc2922b4e4346284f44526f4e06dbd1e6eea5b2ffa904b208581d205f6c8
SHA5120e7db37403ebff86b9441c614c355092abbf1d109214b14f4bf7e4842a8a1764611aecd973f8ae2cc8516ff2cfee21ff108a1ed3c8a4de415ad742aee77bccf9
-
Filesize
2.7MB
-
Filesize
16.7MB
-
Filesize
992KB
-
Filesize
208KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB