93ecd91946ad9ac8e473050e6f494dbd4ff958b7630b2d761ec2f781fb296c71

Resubmissions

10/03/2024, 02:18

240310-cre8zahf77 3

10/03/2024, 01:40

240310-b3qneagf77 3

Analysis

max time kernel
75s
max time network
207s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
10/03/2024, 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Gorilla Tag/Gorilla Tag_Data/level2.ress
Size

102.1MB
MD5

8759ac0269187c043df5b47291f68447
SHA1

0df12abae004c7c073401d9c1427bf2a0aab7a87
SHA256

7645714e438619d724bca36ac4e4c05412ebe160f5936b729a1e34f0c2a821d6
SHA512

c17a26472bb5c6ed5f7bd97ce3f226bd55bafc8cef2113f6e32b365319e3d3a84382c2123972684dc76705a14cd338ff1ba2fc6e842d3846d8c5dfaf7417f2f7
SSDEEP

1572864:w1Vb6icbFNzZ/+p3wd8du2mIEMacbK577j8YbS:GjcfzZ/C3wd8hmIEObK570YbS

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4804	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Gorilla Tag\Gorilla Tag_Data\level2.ress"
1⤵
- Modifies registry class
PID:3620

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads