Overview
overview
7Static
static
3Text%20on%...if.bat
windows7-x64
1Text%20on%...if.bat
windows10-2004-x64
1Text%20on%...dme.md
windows7-x64
3Text%20on%...dme.md
windows10-2004-x64
3Text%20on%...ki.exe
windows7-x64
1Text%20on%...ki.exe
windows10-2004-x64
1Text%20on%...go.gif
windows7-x64
1Text%20on%...go.gif
windows10-2004-x64
1Text%20on%...al.ttf
windows7-x64
3Text%20on%...al.ttf
windows10-2004-x64
7Text%20on%...dme.md
windows7-x64
3Text%20on%...dme.md
windows10-2004-x64
3Text%20on%...dme.md
windows7-x64
3Text%20on%...dme.md
windows10-2004-x64
3Text%20on%...if.exe
windows7-x64
7Text%20on%...if.exe
windows10-2004-x64
7text_to_gif.pyc
windows7-x64
3text_to_gif.pyc
windows10-2004-x64
3Text%20on%...gif.py
windows7-x64
3Text%20on%...gif.py
windows10-2004-x64
3bane2.png
windows7-x64
3bane2.png
windows10-2004-x64
3Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 22:43
Behavioral task
behavioral1
Sample
Text%20on%20gif/create_gif.bat
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
Text%20on%20gif/create_gif.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Text%20on%20gif/frames/readme.md
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Text%20on%20gif/frames/readme.md
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
Text%20on%20gif/gifski.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
Text%20on%20gif/gifski.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
Text%20on%20gif/logo.gif
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
Text%20on%20gif/logo.gif
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Text%20on%20gif/primordial.ttf
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Text%20on%20gif/primordial.ttf
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
Text%20on%20gif/readme.md
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Text%20on%20gif/readme.md
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
Text%20on%20gif/temp-frames/readme.md
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
Text%20on%20gif/temp-frames/readme.md
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Text%20on%20gif/text_to_gif.exe
Resource
win7-20240220-en
Behavioral task
behavioral16
Sample
Text%20on%20gif/text_to_gif.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
text_to_gif.pyc
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
text_to_gif.pyc
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
Text%20on%20gif/text_to_gif.py
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
Text%20on%20gif/text_to_gif.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
bane2.png
Resource
win7-20240215-en
Behavioral task
behavioral22
Sample
bane2.png
Resource
win10v2004-20240426-en
General
-
Target
Text%20on%20gif/text_to_gif.py
-
Size
4KB
-
MD5
db2711681b9a1d1b0c185dcf26725b0d
-
SHA1
3e6e305ed49997e6d1b2bb0766bd852dcb8e0a8f
-
SHA256
8b77f539695d8f3c0d43acffcd39e97ebd1042d104d881bdca48a82e7a9fca0a
-
SHA512
e19880c8a8ca20c7434a1229a34aea9a52b9811a9d2d0edc0c84df32c71d7fccacdc798fea326548aeac5fa1de00906d5babac6d725a268b6568463fe5371859
-
SSDEEP
96:d2O09vnExOAzXh1eDEKKegPVqCr2l/xxLR1o/v2COxtFjAPPHxLeWvobpqO4Zp6R:ErmUKh1eDUtHyJxfoXixnAXxrobJ4Zp+
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.py rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.py\ = "py_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\shell\Read\command rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2656 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2656 AcroRd32.exe 2656 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2052 wrote to memory of 3068 2052 cmd.exe 29 PID 2052 wrote to memory of 3068 2052 cmd.exe 29 PID 2052 wrote to memory of 3068 2052 cmd.exe 29 PID 3068 wrote to memory of 2656 3068 rundll32.exe 30 PID 3068 wrote to memory of 2656 3068 rundll32.exe 30 PID 3068 wrote to memory of 2656 3068 rundll32.exe 30 PID 3068 wrote to memory of 2656 3068 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Text%20on%20gif\text_to_gif.py1⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Text%20on%20gif\text_to_gif.py2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Text%20on%20gif\text_to_gif.py"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2656
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5e150025d503eff9f672c2b41b1d538a3
SHA112ac612cb01cabd79a09a2a9d26c48cf3938e74e
SHA25654f2b84cc035b358bd6fb1287ee007ff8d033970d8f5f56a67d759b8dfc6f91e
SHA51256b25f26f16cfdd5fd369bbd9020edd65004eb6477f49baadb6fad439088e132d5c423998a7341b379b7e6404bcba799643b7a22f1e11e14a2ce07945a3375d3