388f9597ceb743647162cc71e5546c08b69b6a191cc6d09f7eabacba9abbf466

Resubmissions

22-01-2024 21:54

240122-1skrvadeaq 8

22-01-2024 21:43

240122-1lebgsdder 7

Analysis

max time kernel
270s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-01-2024 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Disney Tarzan/TARZAN/tarzan.exe
Size

1.1MB
MD5

eca7d4ba9bbb4695495578e0e7d69485
SHA1

1862e7938db16faaa486d054ff02113d271833a2
SHA256

e9abf3193ca0a98101fd9f784a012dcc581e527878e7a2c3df99c507d97ab111
SHA512

a3da7d355851cc5b7e83c41413c71cf7908e01812110950c98dd9239cc3b7a733cb1bb0490aa58fae983d1531c18c75ea52564794e9624fde4dc1a133a9a2e5b
SSDEEP

12288:xljqnA1aln7oOJyFg9LCN66gpJfaogUopHtTEgr6Lj3G3m7hd74QzWZzA/Io:xleACn7oOJyFELC0cb8AIhdMoWp2

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	1028	rundll32.exe
7	1028	rundll32.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	tarzan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\OOBGameInstalled = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\ServiceLocation	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3040	tarzan.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3040	tarzan.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 1028	3040	tarzan.exe	28
PID 3040 wrote to memory of 1028	3040	tarzan.exe	28
PID 3040 wrote to memory of 1028	3040	tarzan.exe	28
PID 3040 wrote to memory of 1028	3040	tarzan.exe	28
PID 3040 wrote to memory of 1028	3040	tarzan.exe	28
PID 3040 wrote to memory of 1028	3040	tarzan.exe	28
PID 3040 wrote to memory of 1028	3040	tarzan.exe	28

C:\Users\Admin\AppData\Local\Temp\Disney Tarzan\TARZAN\tarzan.exe
"C:\Users\Admin\AppData\Local\Temp\Disney Tarzan\TARZAN\tarzan.exe"
1⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\system32\gameux.dll,GameUXShim {8aea69cd-af7d-4a47-a01c-4b692443b1e0};C:\Users\Admin\AppData\Local\Temp\Disney Tarzan\TARZAN\tarzan.exe;3040
  2⤵
  - Blocklisted process makes network request
  - Modifies registry class
  PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3040-3-0x0000000000400000-0x0000000000C4A000-memory.dmp

Filesize
8.3MB

Download
memory/3040-6-0x0000000000400000-0x0000000000C4A000-memory.dmp

Filesize
8.3MB

Download