Analysis
-
max time kernel
143s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-09-2024 10:09
Static task
static1
Behavioral task
behavioral1
Sample
MV. TBN 58 SHIP PARTICULARS.01.pdf.rar
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
MV. TBN 58 SHIP PARTICULARS.01.pdf.rar
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
MV. TBN 58 SHIP PARTICULARS.01.pdf.scr
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
MV. TBN 58 SHIP PARTICULARS.01.pdf.scr
Resource
win10v2004-20240910-en
General
-
Target
MV. TBN 58 SHIP PARTICULARS.01.pdf.rar
-
Size
590KB
-
MD5
1bf3b553056464b26ee2645c4580066f
-
SHA1
0e2a454f2516b54abe4cd0cb08aa5b51ded6637a
-
SHA256
2703f63ffb3b7a2ec6d07ddfb7eed7af46556e00043426ec051dcfa8fbc36736
-
SHA512
f1ef31d030af19f2fa671fee47f71c00e5caa04a7e1b1277e2baa5dffbecf472a348d73b58012cb09a5f4b1d86847ec2dfaea6e2189e7ee4b5466e591e78f969
-
SSDEEP
12288:A9SxMnxZXlvRM6eJ6DL72r+9+oxlQaAk/UXRLvw:As+b15M626D2r+ooP5x/Ke
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2636 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2636 vlc.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 2636 vlc.exe 2636 vlc.exe 2636 vlc.exe 2636 vlc.exe 2636 vlc.exe 2636 vlc.exe 2636 vlc.exe 2636 vlc.exe -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 2636 vlc.exe 2636 vlc.exe 2636 vlc.exe 2636 vlc.exe 2636 vlc.exe 2636 vlc.exe 2636 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2636 vlc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1956 wrote to memory of 1952 1956 cmd.exe 31 PID 1956 wrote to memory of 1952 1956 cmd.exe 31 PID 1956 wrote to memory of 1952 1956 cmd.exe 31 PID 1952 wrote to memory of 2868 1952 rundll32.exe 33 PID 1952 wrote to memory of 2868 1952 rundll32.exe 33 PID 1952 wrote to memory of 2868 1952 rundll32.exe 33 PID 2868 wrote to memory of 2636 2868 rundll32.exe 35 PID 2868 wrote to memory of 2636 2868 rundll32.exe 35 PID 2868 wrote to memory of 2636 2868 rundll32.exe 35
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\MV. TBN 58 SHIP PARTICULARS.01.pdf.rar"1⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MV. TBN 58 SHIP PARTICULARS.01.pdf.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MV. TBN 58 SHIP PARTICULARS.01.pdf.rar3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\MV. TBN 58 SHIP PARTICULARS.01.pdf.rar"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2636
-
-
-