Analysis
-
max time kernel
35s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
14/09/2024, 11:37
General
-
Target
TokLom.rar
-
Size
11KB
-
MD5
895f642ef590da8573c0e304f6ce6177
-
SHA1
ad39a7680fec2fb72aa5ca6ec4be13b9483d5b5f
-
SHA256
131bb7dad777b8f4c3857c10c3c6669a1eb936357fa205dbe0fff63c39265870
-
SHA512
3f87727fccec5bf018b0318dc2659ee5e76212ba776b123d28a57e18fa27e2456ff57ae2f5baadf443bdf1fe9f96d94cf5641e135be847cc83521c0195914491
-
SSDEEP
192:YAfrPEwz3zmwzMMILit6QG5KB7Tm/Q18UqZ8EVcxwOwe2OkwMS6recPCqfTigzQV:BP73bzoitdBvaaacQwDM9rRTJU
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 44 IoCs
-
Suspicious use of SendNotifyMessage 43 IoCs
-
Suspicious use of SetWindowsHookEx 30 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\TokLom.rar1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\TokLom.rar"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
-
Filesize
348KB
-
Filesize
992KB
-
Filesize
92KB
-
Filesize
96KB
-
Filesize
192KB
-
Filesize
260KB
-
Filesize
132KB
-
Filesize
96KB
-
Filesize
68KB
-
Filesize
208KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
116KB
-
Filesize
2.0MB
-
Filesize
68KB
-
Filesize
92KB
-
Filesize
2.7MB
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
68KB
-
Filesize
496KB
-
Filesize
16.7MB
-
Filesize
1.7MB
-
Filesize
412KB
-
Filesize
24.4MB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB