a44b106f4f8eab5412968126484f86c6889ef41ed472211dcbbcf1f83e51c01f

Resubmissions

08/03/2024, 05:33

240308-f81g1sgc66 3

08/03/2024, 05:29

240308-f62bjagb97 3

Analysis

max time kernel
1805s
max time network
1819s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Gorilla-Tag-ShibaGT-Gold-Mod-Menu-main/ShibaGT Gold/Displyy_Template/UI/MenusGUI.cs
Size

17KB
MD5

75022c4adc8307afa569e740dd0ecdc1
SHA1

e7dc71b179516d85a859866d012495d9933b8515
SHA256

43ae23dac2c77cf7a3733edc347de00e5253c1ae22322fa020fec6ad469566bf
SHA512

d50a4391d45c69f9889293fcb541283581f723bcc3e668cdda8456e9e63a8d358c3091d4df18f4408992bd16704a00283c2aec3f298874367d1c025eac70cdc3
SSDEEP

384:9EkwyNbmsOnGnUnHn73M44xfLIDtWr0pWFw6w1w8wyIuw1wbIBj/m:ikwRnGnUnHn7844xfLIDtWVFw6w1w8wG

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
3044	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3044	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3044	AcroRd32.exe
3044	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 3044	2784	cmd.exe	29
PID 2784 wrote to memory of 3044	2784	cmd.exe	29
PID 2784 wrote to memory of 3044	2784	cmd.exe	29
PID 2784 wrote to memory of 3044	2784	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Gorilla-Tag-ShibaGT-Gold-Mod-Menu-main\ShibaGT Gold\Displyy_Template\UI\MenusGUI.cs"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Gorilla-Tag-ShibaGT-Gold-Mod-Menu-main\ShibaGT Gold\Displyy_Template\UI\MenusGUI.cs"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8b42cb0b305eedc0fdd1a0c799b852b8

SHA1
306af5a35a5cf7e4a6cec9f7891d46ce66069632

SHA256
33bc711e486d40f524647b20f72057e0527f453e4b0233926a9ddbd1e2570828

SHA512
6967238d1ed7389b80d7bd2b78eb7bee4352d8783ac804b7af3e85b9530f6684762abb8f7502792444958e196e264552c037c3595aa0cd1a9466a4e89b499040

Download Submit