Overview
overview
7Static
static
3Text%20on%...if.bat
windows7-x64
1Text%20on%...if.bat
windows10-2004-x64
1Text%20on%...dme.md
windows7-x64
3Text%20on%...dme.md
windows10-2004-x64
3Text%20on%...ki.exe
windows7-x64
1Text%20on%...ki.exe
windows10-2004-x64
1Text%20on%...go.gif
windows7-x64
1Text%20on%...go.gif
windows10-2004-x64
1Text%20on%...al.ttf
windows7-x64
3Text%20on%...al.ttf
windows10-2004-x64
7Text%20on%...dme.md
windows7-x64
3Text%20on%...dme.md
windows10-2004-x64
3Text%20on%...dme.md
windows7-x64
3Text%20on%...dme.md
windows10-2004-x64
3Text%20on%...if.exe
windows7-x64
7Text%20on%...if.exe
windows10-2004-x64
7text_to_gif.pyc
windows7-x64
3text_to_gif.pyc
windows10-2004-x64
3Text%20on%...gif.py
windows7-x64
3Text%20on%...gif.py
windows10-2004-x64
3bane2.png
windows7-x64
3bane2.png
windows10-2004-x64
3Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 22:43
Behavioral task
behavioral1
Sample
Text%20on%20gif/create_gif.bat
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
Text%20on%20gif/create_gif.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Text%20on%20gif/frames/readme.md
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Text%20on%20gif/frames/readme.md
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
Text%20on%20gif/gifski.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
Text%20on%20gif/gifski.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
Text%20on%20gif/logo.gif
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
Text%20on%20gif/logo.gif
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Text%20on%20gif/primordial.ttf
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Text%20on%20gif/primordial.ttf
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
Text%20on%20gif/readme.md
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Text%20on%20gif/readme.md
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
Text%20on%20gif/temp-frames/readme.md
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
Text%20on%20gif/temp-frames/readme.md
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Text%20on%20gif/text_to_gif.exe
Resource
win7-20240220-en
Behavioral task
behavioral16
Sample
Text%20on%20gif/text_to_gif.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
text_to_gif.pyc
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
text_to_gif.pyc
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
Text%20on%20gif/text_to_gif.py
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
Text%20on%20gif/text_to_gif.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
bane2.png
Resource
win7-20240215-en
Behavioral task
behavioral22
Sample
bane2.png
Resource
win10v2004-20240426-en
General
-
Target
Text%20on%20gif/readme.md
-
Size
874B
-
MD5
f05bef4cd45d5209cb317e46ad2237a7
-
SHA1
d7bfe646e6443674ccc3dfdc426db6db4f34a496
-
SHA256
6d558bffc064322125aef07f9e6dd659178601f0992a43bb24a6dc2983ffdd66
-
SHA512
b7e2f0089ee435e98d96e0a56934ac4b7a1f347fbdc32d79c42ef561b1559b83df6805cae9e9ab12bbf684fe0638c7ccc5629b7ea73ffbdb00e0073b29a6164e
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.md\ = "md_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\md_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\md_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\md_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\md_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\md_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.md rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2616 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2616 AcroRd32.exe 2616 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1952 wrote to memory of 2496 1952 cmd.exe 29 PID 1952 wrote to memory of 2496 1952 cmd.exe 29 PID 1952 wrote to memory of 2496 1952 cmd.exe 29 PID 2496 wrote to memory of 2616 2496 rundll32.exe 30 PID 2496 wrote to memory of 2616 2496 rundll32.exe 30 PID 2496 wrote to memory of 2616 2496 rundll32.exe 30 PID 2496 wrote to memory of 2616 2496 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Text%20on%20gif\readme.md1⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Text%20on%20gif\readme.md2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Text%20on%20gif\readme.md"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2616
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5492f9437a655db4ea46bc2490f356297
SHA10e73ac28be2af6a2eb86ef17ecc4ec7c61ff1ee2
SHA2568756bf642ea2456b68b6e7b50a223295bdf359a4340d5bb890e04315f2e7575b
SHA512cb2fae2bd361853060187aa8db2ae96f25d4e49b4e92ff3d2fa1aa6dcc4700ba5a5e133dd888a6b5b30e1cb29b8983878927afa0c622ba29f10aa8b4d9b8f92b