7c2fb345d867554750c52e5b03141f47a39d03bfe085dd71006218a19111e0b6

Analysis

max time kernel
307s
max time network
1611s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
01/10/2024, 23:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Into-the-Radius-2.rar
Size

151.3MB
MD5

90180cdfbc975add4410f0db8590e518
SHA1

85d36b68cfeb31789a344e48fc84dd7a883638e3
SHA256

7c2fb345d867554750c52e5b03141f47a39d03bfe085dd71006218a19111e0b6
SHA512

21983c9812545d99c02ae46ee716c34399e804b7aaa3b9332c8aa1fdcafe0aa2e58dabf450caca87fdcbf0e4f94344d0d7c0c23f5d22e55b257664551047a0e8
SSDEEP

3145728:XrTZGDViNnxXLceU/aqYhLMwcVtI3FWBwHY3l2pIP7YoNtSxU+VGfSkN0MzzSanm:XrT4D0Nnx7m/aqY0vQNHY3ai4JVGKkNi

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3744	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5064	OpenWith.exe
3744	vlc.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3744	vlc.exe
3744	vlc.exe
3744	vlc.exe
3744	vlc.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3744	vlc.exe
3744	vlc.exe
3744	vlc.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
5064	OpenWith.exe
5064	OpenWith.exe
5064	OpenWith.exe
5064	OpenWith.exe
5064	OpenWith.exe
5064	OpenWith.exe
5064	OpenWith.exe
5064	OpenWith.exe
5064	OpenWith.exe
3744	vlc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 3744	5064	OpenWith.exe	72
PID 5064 wrote to memory of 3744	5064	OpenWith.exe	72

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Into-the-Radius-2.rar
1⤵
- Modifies registry class
PID:440

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Into-the-Radius-2.rar"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3744

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3744-7-0x00007FF7C8BF0000-0x00007FF7C8CE8000-memory.dmp

Filesize
992KB

Download
memory/3744-8-0x00007FFDBC2F0000-0x00007FFDBC324000-memory.dmp

Filesize
208KB

Download
memory/3744-9-0x00007FFDB6E60000-0x00007FFDB7116000-memory.dmp

Filesize
2.7MB

Download
memory/3744-10-0x00007FFDA8CC0000-0x00007FFDA9D70000-memory.dmp

Filesize
16.7MB

Download