Overview
overview
7Static
static
3Text%20on%...if.bat
windows7-x64
1Text%20on%...if.bat
windows10-2004-x64
1Text%20on%...dme.md
windows7-x64
3Text%20on%...dme.md
windows10-2004-x64
3Text%20on%...ki.exe
windows7-x64
1Text%20on%...ki.exe
windows10-2004-x64
1Text%20on%...go.gif
windows7-x64
1Text%20on%...go.gif
windows10-2004-x64
1Text%20on%...al.ttf
windows7-x64
3Text%20on%...al.ttf
windows10-2004-x64
7Text%20on%...dme.md
windows7-x64
3Text%20on%...dme.md
windows10-2004-x64
3Text%20on%...dme.md
windows7-x64
3Text%20on%...dme.md
windows10-2004-x64
3Text%20on%...if.exe
windows7-x64
7Text%20on%...if.exe
windows10-2004-x64
7text_to_gif.pyc
windows7-x64
3text_to_gif.pyc
windows10-2004-x64
3Text%20on%...gif.py
windows7-x64
3Text%20on%...gif.py
windows10-2004-x64
3bane2.png
windows7-x64
3bane2.png
windows10-2004-x64
3Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 22:43
Behavioral task
behavioral1
Sample
Text%20on%20gif/create_gif.bat
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
Text%20on%20gif/create_gif.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Text%20on%20gif/frames/readme.md
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Text%20on%20gif/frames/readme.md
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
Text%20on%20gif/gifski.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
Text%20on%20gif/gifski.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
Text%20on%20gif/logo.gif
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
Text%20on%20gif/logo.gif
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Text%20on%20gif/primordial.ttf
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Text%20on%20gif/primordial.ttf
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
Text%20on%20gif/readme.md
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Text%20on%20gif/readme.md
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
Text%20on%20gif/temp-frames/readme.md
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
Text%20on%20gif/temp-frames/readme.md
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Text%20on%20gif/text_to_gif.exe
Resource
win7-20240220-en
Behavioral task
behavioral16
Sample
Text%20on%20gif/text_to_gif.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
text_to_gif.pyc
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
text_to_gif.pyc
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
Text%20on%20gif/text_to_gif.py
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
Text%20on%20gif/text_to_gif.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
bane2.png
Resource
win7-20240215-en
Behavioral task
behavioral22
Sample
bane2.png
Resource
win10v2004-20240426-en
General
-
Target
Text%20on%20gif/primordial.ttf
-
Size
146KB
-
MD5
218f0c6d566a54de2117fc95850ca7e4
-
SHA1
74c8bab19577bb70cdc07c275c43b0523be291e7
-
SHA256
c9be9577d52e91c639d8cc27874acfa71550a4bda0bf131be542789032ba3d82
-
SHA512
7189407ac443b1e8fad649500f8e7a34139c185f99b7adeb63dccade09219276654a9242e3d1538b54875739eef6b8f2ab866392d25af56078d6b0f982ab5b0f
-
SSDEEP
3072:EsN7wu32g+kAxMjqGX2G7uyWEpBjeR86C2E8H7O1j7B3PODG9t1a7lHHiDgE879Z:EsN8u32g+lxMjqGGByWEjjeR86mwyEl
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1100 wrote to memory of 2016 1100 cmd.exe 29 PID 1100 wrote to memory of 2016 1100 cmd.exe 29 PID 1100 wrote to memory of 2016 1100 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Text%20on%20gif\primordial.ttf1⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\System32\fontview.exe"C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\Text%20on%20gif\primordial.ttf2⤵PID:2016
-