Overview
overview
3Static
static
3Tundra.zip
windows10-2004-x64
1Tundra/ExploitDLL.dll
windows10-2004-x64
1Tundra/Fas...ox.dll
windows10-2004-x64
1Tundra/Tundra.exe
windows10-2004-x64
1Tundra/scr...ts.lua
windows10-2004-x64
3Tundra/scr...ld.lua
windows10-2004-x64
3Tundra/scr...lf.lua
windows10-2004-x64
3Tundra/scr...le.lua
windows10-2004-x64
3Tundra/scr...ed.lua
windows10-2004-x64
3Analysis
-
max time kernel
442s -
max time network
1170s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
25/02/2024, 04:11 UTC
Static task
static1
Behavioral task
behavioral1
Sample
Tundra.zip
Resource
win10v2004-20240221-en
Behavioral task
behavioral2
Sample
Tundra/ExploitDLL.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
Tundra/FastColoredTextBox.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral4
Sample
Tundra/Tundra.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
Tundra/scripts/BreakJoints.lua
Resource
win10v2004-20240221-en
Behavioral task
behavioral6
Sample
Tundra/scripts/Infinite Yield.lua
Resource
win10v2004-20240221-en
Behavioral task
behavioral7
Sample
Tundra/scripts/Kick Yourself.lua
Resource
win10v2004-20240221-en
Behavioral task
behavioral8
Sample
Tundra/scripts/Saving File.lua
Resource
win10v2004-20240221-en
Behavioral task
behavioral9
Sample
Tundra/scripts/Walkspeed.lua
Resource
win10v2004-20240221-en
General
-
Target
Tundra/scripts/Infinite Yield.lua
-
Size
96B
-
MD5
35c5cb88d98851ccbcf96829dcaac710
-
SHA1
6345e4621c06c238b84e8f18fd8e215f190d96e3
-
SHA256
f1d3c6491d5614428d99bdc12e1ca5f3b9aeebfd919606162c0d838a4fb21ffa
-
SHA512
71aaeb5c53ca848011a1fa5427c062cb22a0821ea72909559e76c52abb35edf5bac9eefbe69682f6c1e14d3c10d3a982d8ee56468ab818b441404e738e03cc64
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2828415587-3732861812-1919322417-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2828415587-3732861812-1919322417-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5088 OpenWith.exe
Processes
Network
-
Remote address:8.8.8.8:53Request9.228.82.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request41.110.16.96.in-addr.arpaIN PTRResponse41.110.16.96.in-addr.arpaIN PTRa96-16-110-41deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request0.204.248.87.in-addr.arpaIN PTRResponse0.204.248.87.in-addr.arpaIN PTRhttps-87-248-204-0lhrllnwnet
-
Remote address:8.8.8.8:53Request194.178.17.96.in-addr.arpaIN PTRResponse194.178.17.96.in-addr.arpaIN PTRa96-17-178-194deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request13.227.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request210.143.182.52.in-addr.arpaIN PTRResponse
-
70 B 156 B 1 1
DNS Request
9.228.82.20.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
41.110.16.96.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
86.23.85.13.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
206.23.85.13.in-addr.arpa
-
71 B 116 B 1 1
DNS Request
0.204.248.87.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
194.178.17.96.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
13.227.111.52.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
210.143.182.52.in-addr.arpa