a44b106f4f8eab5412968126484f86c6889ef41ed472211dcbbcf1f83e51c01f

Resubmissions

08/03/2024, 05:33

240308-f81g1sgc66 3

08/03/2024, 05:29

240308-f62bjagb97 3

Analysis

max time kernel
1561s
max time network
1564s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Gorilla-Tag-ShibaGT-Gold-Mod-Menu-main/ShibaGT Gold.sln
Size

1012B
MD5

ad731f187f0fab3a769ac19f12bcf5fc
SHA1

c31cde27d388263c7250623a0fed5c564b672041
SHA256

a9c34022db4db6aecf955530c523fb6189dd9fdc78d01ef62aebbce575bb3454
SHA512

d6369e5498e1028abcb3d2527c88d7438d017e739e4e1da0611e19e06f6341e27716bad006f430dda095942c40f9866cc8e5a270ea8d90315c41887794bbd6f5

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\sln_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\sln_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\sln_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.sln	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.sln\ = "sln_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\sln_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\sln_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\sln_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2524	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2524	AcroRd32.exe
2524	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 300 wrote to memory of 2668	300	cmd.exe	29
PID 300 wrote to memory of 2668	300	cmd.exe	29
PID 300 wrote to memory of 2668	300	cmd.exe	29
PID 2668 wrote to memory of 2524	2668	rundll32.exe	30
PID 2668 wrote to memory of 2524	2668	rundll32.exe	30
PID 2668 wrote to memory of 2524	2668	rundll32.exe	30
PID 2668 wrote to memory of 2524	2668	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Gorilla-Tag-ShibaGT-Gold-Mod-Menu-main\ShibaGT Gold.sln"
1⤵
- Suspicious use of WriteProcessMemory
PID:300
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Gorilla-Tag-ShibaGT-Gold-Mod-Menu-main\ShibaGT Gold.sln
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Gorilla-Tag-ShibaGT-Gold-Mod-Menu-main\ShibaGT Gold.sln"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c4c300f190db214119f2de2cb82f60e3

SHA1
6735d4e2cab8c40cf2ae33001623b64144748b16

SHA256
261ab5ac49848915ca37916134e1cd878f759b1f5ee028b0145df60a02c2a3fd

SHA512
2ac37c16126026cc84342098879f094fb07f966677b41f42dd5c080e132702920a0ab39b96314af213a750c1ab6b207bd162a5c3914be05be339fc70be1bcecc

Download Submit