Overview
overview
7Static
static
3Text%20on%...if.bat
windows7-x64
1Text%20on%...if.bat
windows10-2004-x64
1Text%20on%...dme.md
windows7-x64
3Text%20on%...dme.md
windows10-2004-x64
3Text%20on%...ki.exe
windows7-x64
1Text%20on%...ki.exe
windows10-2004-x64
1Text%20on%...go.gif
windows7-x64
1Text%20on%...go.gif
windows10-2004-x64
1Text%20on%...al.ttf
windows7-x64
3Text%20on%...al.ttf
windows10-2004-x64
7Text%20on%...dme.md
windows7-x64
3Text%20on%...dme.md
windows10-2004-x64
3Text%20on%...dme.md
windows7-x64
3Text%20on%...dme.md
windows10-2004-x64
3Text%20on%...if.exe
windows7-x64
7Text%20on%...if.exe
windows10-2004-x64
7text_to_gif.pyc
windows7-x64
3text_to_gif.pyc
windows10-2004-x64
3Text%20on%...gif.py
windows7-x64
3Text%20on%...gif.py
windows10-2004-x64
3bane2.png
windows7-x64
3bane2.png
windows10-2004-x64
3Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 22:43
Behavioral task
behavioral1
Sample
Text%20on%20gif/create_gif.bat
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
Text%20on%20gif/create_gif.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Text%20on%20gif/frames/readme.md
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Text%20on%20gif/frames/readme.md
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
Text%20on%20gif/gifski.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
Text%20on%20gif/gifski.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
Text%20on%20gif/logo.gif
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
Text%20on%20gif/logo.gif
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Text%20on%20gif/primordial.ttf
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Text%20on%20gif/primordial.ttf
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
Text%20on%20gif/readme.md
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Text%20on%20gif/readme.md
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
Text%20on%20gif/temp-frames/readme.md
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
Text%20on%20gif/temp-frames/readme.md
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Text%20on%20gif/text_to_gif.exe
Resource
win7-20240220-en
Behavioral task
behavioral16
Sample
Text%20on%20gif/text_to_gif.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
text_to_gif.pyc
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
text_to_gif.pyc
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
Text%20on%20gif/text_to_gif.py
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
Text%20on%20gif/text_to_gif.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
bane2.png
Resource
win7-20240215-en
Behavioral task
behavioral22
Sample
bane2.png
Resource
win10v2004-20240426-en
General
-
Target
text_to_gif.pyc
-
Size
2KB
-
MD5
04a839e300bb18e73c5d4afb5fc972b7
-
SHA1
e80e3066fdbe253846946e0f40a26b4553f109e7
-
SHA256
b1dbd6b35a17199ec30851a91a9319a3764605e8798225b367c0b5b04885af5a
-
SHA512
6435638bd64229d8a7e29f47b65194c4807b6f9f74fe04e1fc9dcec327186b2d912c4b386a0e1578e06c74c714ac6a044fdc350cddcf1aba08b8b13741d7939b
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.pyc rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2768 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2768 AcroRd32.exe 2768 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2632 1924 cmd.exe 29 PID 1924 wrote to memory of 2632 1924 cmd.exe 29 PID 1924 wrote to memory of 2632 1924 cmd.exe 29 PID 2632 wrote to memory of 2768 2632 rundll32.exe 30 PID 2632 wrote to memory of 2768 2632 rundll32.exe 30 PID 2632 wrote to memory of 2768 2632 rundll32.exe 30 PID 2632 wrote to memory of 2768 2632 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\text_to_gif.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\text_to_gif.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\text_to_gif.pyc"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2768
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD584672eb992c1fc61776d86ba0fda0ede
SHA1fb49f9fc39db120d2df3322330bf5b184e5ea699
SHA256799c2ae7f4746573dd3b1e4aa829d466ee37e859e3271706f9c956ec9d20d17d
SHA51234a3399c8841e423f101c3d81752f87121092ab0b8ec42fcc6aae603897e60198579357b9926741a39214a05063ec26447c9e9d1ce6646951d49999297d35de2