21c20732aa5d87200c0df10139a844ebd9c19ee6486fab3ba78a6ea92f968935

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 13:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TikTokRizz/TikTokRizz/Properties/AssemblyInfo.cs
Size

1KB
MD5

57036aefe203d1cabde8cffbd625f566
SHA1

9f7dc1057ea9ea14c1a86b2420f2f5d7b8c2db73
SHA256

7ea5ee68eab42bbcd35de3d1aee27ee25ca1319eeac55a5a51a0a187eebd3a70
SHA512

521de4e5ebd69f419062113dc20f580f4b94768e7537124e79788173b5b044c31f609e561fa6ae4a1363f7a331a35bb814f4dd71531c1847f58d74a865e7916d

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2492	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2492	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2492	AcroRd32.exe
2492	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2492	2368	cmd.exe	29
PID 2368 wrote to memory of 2492	2368	cmd.exe	29
PID 2368 wrote to memory of 2492	2368	cmd.exe	29
PID 2368 wrote to memory of 2492	2368	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\TikTokRizz\TikTokRizz\Properties\AssemblyInfo.cs
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\TikTokRizz\TikTokRizz\Properties\AssemblyInfo.cs"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3457d9d33c80457685bdd768f96f4a39

SHA1
23f4a339cc445b40720c0ae057f7fc07afa99f44

SHA256
439b678d434beb65c0ec2ac28a538c015cd3ba6531127e6abac7b2815b1b3a91

SHA512
be93157d6a4696436899f731792709440fdbf23294c7544ff35d49ecf3daa123099479ef440460bcd368d64ac3c68f41492bbb7f065107ea34a06030fc149495

Download Submit