21c20732aa5d87200c0df10139a844ebd9c19ee6486fab3ba78a6ea92f968935

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 13:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TikTokRizz/TikTokRizz/Program.cs
Size

542B
MD5

d9fcd3aba416bb760e7ae043e545133f
SHA1

c1e792334c443f3971e1856a359c96c35ec056e8
SHA256

112d0d2ddf062e754494dc83650789eb1f2f0bf3607487743226508c083067ec
SHA512

5604457b93fe5a7faf09e0bbeaae270eee34910094a04a331035d39100b13376f2939cdaa8c9d472948936c9205f89f1dfb2bc61962f68fc4d1659d4c0e7c6cb

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2416	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2416	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2416	AcroRd32.exe
2416	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 2416	112	cmd.exe	29
PID 112 wrote to memory of 2416	112	cmd.exe	29
PID 112 wrote to memory of 2416	112	cmd.exe	29
PID 112 wrote to memory of 2416	112	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\TikTokRizz\TikTokRizz\Program.cs
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:112
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\TikTokRizz\TikTokRizz\Program.cs"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
44d466fb0e954516caeee92f27b2ab15

SHA1
d6d812d2c04a282479d20b91b43763945bc5196b

SHA256
4edeb5f5740fba663a2f6df88c73161c600b4ffb6cb575405c4d5d074e781ab7

SHA512
a7c46c0a416291d32d23197fc4af890c1b310c9d97d647c741e59f16503ce487dd21a6b46e692581b8c4a3c98358d8119a069561e82262752a78296b7bc21766

Download Submit