21c20732aa5d87200c0df10139a844ebd9c19ee6486fab3ba78a6ea92f968935

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 13:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TikTokRizz/.vs/TikTokRizz/FileContentIndex/0c4aa1fd-6b50-4cc5-8d96-ce9083219a23.vsidx
Size

40KB
MD5

2b3397890e716e1068a0e8c108f64b14
SHA1

d26e75d4ed789fbb67a92868e7c3b4a7aac44f55
SHA256

4e32d10cbabcfad25578044ec0fdcf287abc0d71c7d105e22843d7c23eacb4be
SHA512

dc0798bc8a5628fe982a7512b918c402fa8c45c1bf585a8f52922ba561bffac43d07c35fbfa6dd6971ce5d969ac26bb32e4b3573366dc2dfc3fd69efbc72330d
SSDEEP

768:RTWtI+q8hPYYrBheSZL2dJwUfVCilyNu+cBUZm/Wk2rr4vxD2+1U0WK:RsrgYrBheSZSdaUfciINBcBUZm/7Ckvp

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\vsidx_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\vsidx_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\vsidx_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.vsidx	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.vsidx\ = "vsidx_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\vsidx_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\vsidx_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\vsidx_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2508	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2508	AcroRd32.exe
2508	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2572	2872	cmd.exe	29
PID 2872 wrote to memory of 2572	2872	cmd.exe	29
PID 2872 wrote to memory of 2572	2872	cmd.exe	29
PID 2572 wrote to memory of 2508	2572	rundll32.exe	30
PID 2572 wrote to memory of 2508	2572	rundll32.exe	30
PID 2572 wrote to memory of 2508	2572	rundll32.exe	30
PID 2572 wrote to memory of 2508	2572	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\TikTokRizz\.vs\TikTokRizz\FileContentIndex\0c4aa1fd-6b50-4cc5-8d96-ce9083219a23.vsidx
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\TikTokRizz\.vs\TikTokRizz\FileContentIndex\0c4aa1fd-6b50-4cc5-8d96-ce9083219a23.vsidx
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\TikTokRizz\.vs\TikTokRizz\FileContentIndex\0c4aa1fd-6b50-4cc5-8d96-ce9083219a23.vsidx"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
51ea9b8dd7a4ac7141e43f9276b732c9

SHA1
e50bc56cb11b1d8a43802b8bcb221815d9f7f8a7

SHA256
a9d90dc5ab8e18b71c4e8cfbfdd90622e6eedd89b66952a0be76ec54329a5e80

SHA512
eb5a813abd2a37e5b13193699daf8f8203049620d7f9d7e9a654b9b609b963c9f9ad5129501ebe36f3dcc9002a5a3228c8d872638e2fe445ba10a0acb02c5ecf

Download Submit