Overview
overview
10Static
static
3SKRIPTGG-F...in.zip
windows7-x64
1SKRIPTGG-F...in.zip
windows10-2004-x64
1SKRIPTGG-F...DME.md
windows7-x64
3SKRIPTGG-F...DME.md
windows10-2004-x64
3SKRIPTGG-F...pt.rar
windows7-x64
10SKRIPTGG-F...pt.rar
windows10-2004-x64
7launcher.exe
windows7-x64
10launcher.exe
windows10-2004-x64
10SKRIPTGG-F...se.dll
windows7-x64
1SKRIPTGG-F...se.dll
windows10-2004-x64
1Resubmissions
27-03-2024 17:10
240327-vp3klabh7y 1027-03-2024 17:07
240327-vnfdnsbh4w 327-03-2024 17:03
240327-vknwmsbg61 10Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-03-2024 17:03
Static task
static1
Behavioral task
behavioral1
Sample
SKRIPTGG-FIVEM-main.zip
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SKRIPTGG-FIVEM-main.zip
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
SKRIPTGG-FIVEM-main/README.md
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
SKRIPTGG-FIVEM-main/README.md
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
SKRIPTGG-FIVEM-main/Skript.rar
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
SKRIPTGG-FIVEM-main/Skript.rar
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
launcher.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
launcher.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
SKRIPTGG-FIVEM-main/license.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
SKRIPTGG-FIVEM-main/license.dll
Resource
win10v2004-20240226-en
General
-
Target
SKRIPTGG-FIVEM-main/README.md
-
Size
383B
-
MD5
cb0b4cd4ce17d2d75fa1626447c0ef78
-
SHA1
bb26911f880dbb56bbcabd75e249fd861e092f3a
-
SHA256
6f353b611f52ff5238c7633de9fb36d90d3e1b29fa34e0ca8a70665520a89768
-
SHA512
2047d9afafec24a82152fbc3638cfbd35dcf32cb9502317b0bd7c90f0c7f008740495791583d16668a7ed224a82f8bf9068574706679f0ae147c36b07467bbe7
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.md rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.md\ = "md_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\md_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\md_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\md_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\md_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\md_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid Process 2576 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid Process 2576 AcroRd32.exe 2576 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid Process procid_target PID 2300 wrote to memory of 2552 2300 cmd.exe 29 PID 2300 wrote to memory of 2552 2300 cmd.exe 29 PID 2300 wrote to memory of 2552 2300 cmd.exe 29 PID 2552 wrote to memory of 2576 2552 rundll32.exe 30 PID 2552 wrote to memory of 2576 2552 rundll32.exe 30 PID 2552 wrote to memory of 2576 2552 rundll32.exe 30 PID 2552 wrote to memory of 2576 2552 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\SKRIPTGG-FIVEM-main\README.md1⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SKRIPTGG-FIVEM-main\README.md2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SKRIPTGG-FIVEM-main\README.md"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2576
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD53d4858b0fa8adde8e522b448f6808926
SHA1575c49b25d206152ed2953c77f949e7c36b4f56e
SHA256ed9fd4b256cd5e8180d88d4e70dfacf61c24605ba9a0a87e7b25e9125f102e1c
SHA5126be53fbe1e0ef15e22cc3af06ddc3a6dab275f3166c71d7b9db2e4e15429a71c50f9e8677f1c1236522f393ffa78b15dac822cab12dbf60690df6ef9f60dde31