47769a82ac9994bf50fdb7ff521d2364775afea3da02d55450448a25e6f94645

Analysis

max time kernel
43s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 05:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
[email protected]
Size 770KB
Sample260930-fxnzvavycx
SHA256 47769a82ac9994bf50fdb7ff521d2364775afea3da02d55450448a25e6f94645
MD5 8cd7c19b6dc76c116cdb84e369fd5d9a
SHA1 5e3ecd3e4ef8adc294db1e3525cdbde46b2b7ddc
SHA512 909d0a2ec4af33c374d7453926e5999badd2f9fa79d0648a7308f63911f673ae34ec275917999199e9fb3a669af5c4aa460e7639c5e346f261decd28b520039a
SSDEEP 24576:ePPNsFNARXFh0Gy9Gtgt09HlncQXZlFeI5D7Cj+o:RNkltHXXZlFeiHab
TLSH
T1E5F4233FE1BB9C49C86195B992BD8FC78578F5331881FE6A96713E2F30194B10BA411B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

aspackv2 collection defense_evasion discovery persistence privilege_escalation trojan upx

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c4b5-46.dat	aspack_v212_v242

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	vav.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\International\Geo\Nation	vav.exe

Executes dropped EXE 2 IoCs

pid	Process
1992	vav.exe
4200	vav.exe

Loads dropped DLL 2 IoCs

pid	Process
2808	regsvr32.exe
2808	regsvr32.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	vav.exe
Key queried	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	vav.exe
Key opened	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	vav.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Antivirus = "C:\\Program Files (x86)\\VAV\\vav.exe"	vav.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Antivirus = "C:\\Program Files (x86)\\VAV\\vav.exe"	vav.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	vav.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\vav.cpl	vav.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4464-0-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/4464-23-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\VAV	[email protected]
File created	C:\Program Files (x86)\VAV\vav0.dat	[email protected]
File opened for modification	C:\Program Files (x86)\VAV\vav.exe	[email protected]
File created	C:\Program Files (x86)\VAV\vav.cpl	[email protected]
File opened for modification	C:\Program Files (x86)\VAV\vav.cpl	[email protected]
File opened for modification	C:\Program Files (x86)\VAV\vav0.dat	[email protected]
File created	C:\Program Files (x86)\VAV\vav1.dat	[email protected]
File opened for modification	C:\Program Files (x86)\VAV\vav1.dat	[email protected]
File created	C:\Program Files (x86)\VAV\vav.exe	[email protected]
File created	C:\Program Files (x86)\VAV\vav.ooo	[email protected]
File opened for modification	C:\Program Files (x86)\VAV\vav.ooo	[email protected]

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 2 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	vav.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	vav.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5864	1992	WerFault.exe	89
4812	4200	WerFault.exe	96

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	vav.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vav.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\Firmware Record Version	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Patch Configuration Used	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\Platform Specific Field 1	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\CPU Family Model Stepping	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\Configuration Data	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Previous Record Version	vav.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\Firmware Record Version	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\Platform Specific Field 1	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Firmware Record Version	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\Update Revision	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\Configuration Data	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\Firmware Record Version	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\FeatureSet	vav.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\VendorIdentifier	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\Patch Configuration Used	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\CPU Meta Data	vav.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\Preferred Record Version	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\Configuration Data	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Preferred Record Version	vav.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\Patch Source	vav.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\Configuration Data	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\VendorIdentifier	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Platform Specific Field 1	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\Patch Configuration Used	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\VendorIdentifier	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\Preferred Record Version	vav.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Current Record Version	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Update Status	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\CPU Meta Data	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\Identifier	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Preferred Record Version	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Previous Update Revision	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\Identifier	vav.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	vav.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CPU Family Model Stepping	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\Previous Record Version	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Identifier	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\Patch Source	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\Patch Configuration Used	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Patch Source	vav.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	vav.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	vav.exe

Enumerates system info in registry 2 TTPs 64 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	vav.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data	vav.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMajorRelease	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMinorRelease	vav.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1\Configuration Data	vav.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information	vav.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	vav.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	vav.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	vav.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Component Information	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data	vav.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	vav.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	vav.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1	vav.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	vav.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	vav.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	vav.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	vav.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	vav.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	vav.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0\Component Information	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier	vav.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BootArchitecture	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1\Identifier	vav.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate	vav.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information	vav.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	vav.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	vav.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	vav.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	vav.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\EnclosureType	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0\Identifier	vav.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BiosMinorRelease	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	vav.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	vav.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1	vav.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Configuration Data	vav.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data	vav.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	vav.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	vav.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	vav.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	vav.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	vav.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	vav.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	vav.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	vav.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	vav.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	vav.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1992	vav.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1992	vav.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1992	vav.exe
1992	vav.exe
1992	vav.exe
1992	vav.exe
4200	vav.exe
1992	vav.exe
1992	vav.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 1992	4464	[email protected]	89
PID 1992 wrote to memory of 2808	1992	vav.exe	94

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	vav.exe

C:\Users\Admin\AppData\Local\Temp\[email protected]
"C:\Users\Admin\AppData\Local\Temp\[email protected]"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Program Files (x86)\VAV\vav.exe
  "C:\Program Files (x86)\VAV\vav.exe"
  2⤵
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Event Triggered Execution: Netsh Helper DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  PID:1992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 156
    3⤵
    - Program crash
    PID:5864
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\Program Files (x86)\VAV\vav.exe"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1992 -ip 1992
1⤵
PID:4532

C:\Program Files (x86)\VAV\vav.exe
"C:\Program Files (x86)\VAV\vav.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 540
  2⤵
  - Program crash
  PID:4812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4200 -ip 4200
1⤵
PID:5520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vav.cpl

Path C:\Program Files (x86)\VAV\vav.cpl
Size 115KB
SHA256 3c476e7da59efc96bb20b95c908f7ec9a72fd48f3a8b4097cf6af8d7f6d0707a
MD5 170ef694beb6bef500d057e98af28a81
SHA1 6f6bb37e574fc70fcd90b5075a9100d254c83286
SHA512 662abbb075d918091d58ce08ca35ecb2e3ab6f3e978f5746c0c66809c78eda78f10c07a9dd1d9ebe97638d70a8710762f8d14b2e6d9aabe7a75be7aefd3dc9a3
SSDEEP 3072:P7Fj7u1MoAwOSxoPMVsf0nQla8vxgs2N+r3r:zFvTRgPvSCsDr3r
TLSH
T194B312837750DC1AC1D891BD7683615C5F6EBE278699925266CE06AFAC700BFF83E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vav.exe

Path C:\Program Files (x86)\VAV\vav.exe
Size 317KB
SHA256 42808502caa08f62af18d6153e08f8c8a07490f0d68c2561529444b088a6afd9
MD5 2ed5d70c5af906b4935931f2fa63d1af
SHA1 5e683b5cc4d98d279f8d404e20923af19ad0e0fd
SHA512 4c05be6d5b0d0f1d573b232569ea3635edf2aaf012282e0bff9a86223e60527e0bff592179b38f84d8c068a1c99b557ff5269393c0c1833a1843c3c38c16557c
SSDEEP 6144:1a6LjdIONX1m++NATRSRiDl5fa9IryFRgPvSCsDr3ra:AEIONXE+uATRP5S97RSHsDr
TLSH
T100641302A781B90DC8E9C1F2988BB22818D97C6E0856471711D97E2FFE1769FED3D11E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vav.ooo

Path C:\Program Files (x86)\VAV\vav.ooo
Size 10B
SHA256 f49875853daa431bb8c724a093cf255da7eff249d4d6f3773d6729105dbdd067
MD5 2bf6f3831e58fdba9281ebc90e77ff3a
SHA1 6a0d07d9bf2a2f7e2a5c9ec8b71b3b08ed10f781
SHA512 840569ce93527a931ef70a120050292d71ccee7380871c9d8434b9ca0e40d417355c2c4df8b29c80c121da68e873640bf1b634eb44407b5b92780c8c5c472a9b
MD5 SHA1 SHA512

Submit Download

vav0.dat

Path C:\Program Files (x86)\VAV\vav0.dat
Size 401KB
SHA256 d24dbaf052764d69dbfdff742289577f9b3003a6c6209d61e9a099b7782af0b6
MD5 bbe8e02db2597e6d9d874718ae5639a8
SHA1 8bf63e606a06ad3a041c438a2eb8e8107198cbc7
SHA512 0c6e2ea8a029489e7f0ee61e082f1543e3eff614b1091de7c4e98c0eeef08ec06e7da159d8b6de8a3aa6206782ae5904df451756def0d7fee30821654ecec22b
SSDEEP 12288:4Bdq3/2agl3HgBzXOvOacnFp0wNl4MQpM1OeKAM0:skuZyXOvyowUOOeLM0
TLSH
T10D94233D36D6E4F906ECCB28881D625E1B61D3B6F14F05578E3B588263B9E638874732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vav1.dat

Path C:\Program Files (x86)\VAV\vav1.dat
Size 32KB
SHA256 30d924f1db0322640e9c65f349cdf4d51fd45ea6d3263cebd4433ab2c6d979a2
MD5 a3e99d65018a5a49ae5bfe366da24c12
SHA1 d2f2bf216530ade6a386df363b1b01f0824f0fd4
SHA512 6df6b64c08b241a20f536ccb8dbaf4f324c421abf8977b98585b06505d18eaa2459718f3259b8669ca244762f98dd05c6ba8c35db4b9eb2471148f2a56b75f8c
SSDEEP 768:hX+bncGyyacvd10px5a/WVF8Ilxp1ExOOwZ8qjv5uJR3:hXkcqmxVdlxc58LNg
TLSH
T1BCE2F1F71E30F5E6A0605BE79EF6090B940B6CF615682ED5E0B4A3ECF070D02CD94229
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

g2[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VKUT4MF3\g2[1]
Size 613B
SHA256 b0bafcaa21b73ff3b4f06f7304f08f90693eaca58c92ca4ee22ef7dcdafd823c
MD5 727a63363c1c5e84451ea8ef27ed1c8d
SHA1 aad7fb2b949e5045bbd9612a468611f55e47e4ca
SHA512 bf0fc89c1057adebff595d4aa6639ea9fb6a15a07f5882223f568eda4c6b39e07f3b3972a77e106a20057a4a2584835ccf96831bd44eb5426710014c173b267b
TLSH
T1EFF0479E90B50A51D46E06F150C5CD405F44121B14D611DD9897B3938B2C566CB2D1CC
MD5 SHA1 SHA512 TLSH

Submit Download

g3[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VKUT4MF3\g3[1]
Size 1023B
SHA256 5adf118b3b1a73e88fd25981132f01bcb77b7961a0b219a71fb13c8e88d681eb
MD5 aefd444122479195a041153e433d7c84
SHA1 aa68d0404afe9aa4bbd15f1c732370b8aa323072
SHA512 131e0bc9e0a3badb4c9b29e26f36861c2876b7fc6a775ceba6393c37d8575fc6ef7fe2c7f91c1e1202b361e25aa0243f3a7f260adf8b36e157bca31196fa0d8b
TLSH
T1D811C58414CEC0EADE8295343C3DEFC80B48341AD63C7409988EE318EA998C203408B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1992-41-0x00000000025C0000-0x00000000025C1000-memory.dmp

Download

memory/1992-113-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/1992-29-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/1992-27-0x0000000002510000-0x0000000002511000-memory.dmp

Download

memory/1992-26-0x00000000006E0000-0x00000000006E1000-memory.dmp

Download

memory/1992-25-0x0000000002540000-0x0000000002541000-memory.dmp

Download

memory/1992-40-0x00000000025B0000-0x00000000025B1000-memory.dmp

Download

memory/1992-43-0x00000000026B0000-0x00000000026B1000-memory.dmp

Download

memory/1992-42-0x00000000025E0000-0x00000000025E1000-memory.dmp

Download

memory/1992-39-0x00000000026C0000-0x00000000026C1000-memory.dmp

Download

memory/1992-38-0x0000000002680000-0x0000000002681000-memory.dmp

Download

memory/1992-37-0x00000000026E0000-0x00000000026E1000-memory.dmp

Download

memory/1992-36-0x0000000002650000-0x0000000002651000-memory.dmp

Download

memory/1992-35-0x00000000026F0000-0x00000000026F1000-memory.dmp

Download

memory/1992-34-0x0000000002670000-0x0000000002671000-memory.dmp

Download

memory/1992-33-0x0000000002580000-0x0000000002581000-memory.dmp

Download

memory/1992-140-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/1992-44-0x0000000002660000-0x0000000002661000-memory.dmp

Download

memory/1992-31-0x00000000023B0000-0x00000000023B1000-memory.dmp

Download

memory/1992-32-0x0000000002520000-0x0000000002521000-memory.dmp

Download

memory/1992-136-0x0000000002690000-0x0000000002691000-memory.dmp

Download

memory/1992-135-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/1992-53-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/1992-134-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/1992-66-0x00000000023C0000-0x00000000023EC000-memory.dmp

Download

memory/1992-28-0x0000000002500000-0x0000000002501000-memory.dmp

Download

memory/1992-24-0x00000000023C0000-0x00000000023EC000-memory.dmp

Download

memory/1992-21-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/1992-92-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/1992-133-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/1992-104-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/1992-30-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Download

memory/1992-114-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/1992-115-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/1992-116-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/1992-123-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/1992-124-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/1992-125-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/1992-132-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/2808-50-0x0000000000CC0000-0x0000000000D4D000-memory.dmp

Download

memory/2808-51-0x0000000000CC0000-0x0000000000D4D000-memory.dmp

Download

memory/4200-54-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/4464-23-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4464-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads