Overview
overview
3Static
static
3TikTokRizz.zip
windows7-x64
1TikTokRizz.zip
windows10-2004-x64
1TikTokRizz....vsidx
windows7-x64
3TikTokRizz....vsidx
windows10-2004-x64
3TikTokRizz....vsidx
windows7-x64
3TikTokRizz....vsidx
windows10-2004-x64
3TikTokRizz....vsidx
windows7-x64
3TikTokRizz....vsidx
windows10-2004-x64
3TikTokRizz....vsidx
windows7-x64
3TikTokRizz....vsidx
windows10-2004-x64
3TikTokRizz...7/.suo
windows7-x64
3TikTokRizz...7/.suo
windows10-2004-x64
3TikTokRizz...t.json
windows7-x64
3TikTokRizz...t.json
windows10-2004-x64
3TikTokRizz...zz.sln
windows7-x64
3TikTokRizz...zz.sln
windows10-2004-x64
3TikTokRizz...config
windows7-x64
3TikTokRizz...config
windows10-2004-x64
3TikTokRizz...ner.cs
windows7-x64
3TikTokRizz...ner.cs
windows10-2004-x64
3TikTokRizz...rm1.cs
windows7-x64
3TikTokRizz...rm1.cs
windows10-2004-x64
3TikTokRizz...m1.vbs
windows7-x64
1TikTokRizz...m1.vbs
windows10-2004-x64
1TikTokRizz...ram.cs
windows7-x64
3TikTokRizz...ram.cs
windows10-2004-x64
3TikTokRizz...nfo.cs
windows7-x64
3TikTokRizz...nfo.cs
windows10-2004-x64
3TikTokRizz...er.vbs
windows7-x64
1TikTokRizz...er.vbs
windows10-2004-x64
1TikTokRizz...es.vbs
windows7-x64
1TikTokRizz...es.vbs
windows10-2004-x64
1Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 13:10
Static task
static1
Behavioral task
behavioral1
Sample
TikTokRizz.zip
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
TikTokRizz.zip
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
TikTokRizz/.vs/TikTokRizz/FileContentIndex/0c4aa1fd-6b50-4cc5-8d96-ce9083219a23.vsidx
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
TikTokRizz/.vs/TikTokRizz/FileContentIndex/0c4aa1fd-6b50-4cc5-8d96-ce9083219a23.vsidx
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
TikTokRizz/.vs/TikTokRizz/FileContentIndex/1038b269-7489-4412-8b9e-92cb85064898.vsidx
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
TikTokRizz/.vs/TikTokRizz/FileContentIndex/1038b269-7489-4412-8b9e-92cb85064898.vsidx
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
TikTokRizz/.vs/TikTokRizz/FileContentIndex/8819d140-dbb1-42f4-88e1-27502f877ffd.vsidx
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
TikTokRizz/.vs/TikTokRizz/FileContentIndex/8819d140-dbb1-42f4-88e1-27502f877ffd.vsidx
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
TikTokRizz/.vs/TikTokRizz/FileContentIndex/c3774f1e-57c8-4ee9-999c-373f4e24a054.vsidx
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
TikTokRizz/.vs/TikTokRizz/FileContentIndex/c3774f1e-57c8-4ee9-999c-373f4e24a054.vsidx
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
TikTokRizz/.vs/TikTokRizz/v17/.suo
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
TikTokRizz/.vs/TikTokRizz/v17/.suo
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
TikTokRizz/.vs/TikTokRizz/v17/DocumentLayout.json
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
TikTokRizz/.vs/TikTokRizz/v17/DocumentLayout.json
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
TikTokRizz/TikTokRizz.sln
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
TikTokRizz/TikTokRizz.sln
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
TikTokRizz/TikTokRizz/App.config
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
TikTokRizz/TikTokRizz/App.config
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
TikTokRizz/TikTokRizz/Form1.Designer.cs
Resource
win7-20240419-en
Behavioral task
behavioral20
Sample
TikTokRizz/TikTokRizz/Form1.Designer.cs
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
TikTokRizz/TikTokRizz/Form1.cs
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
TikTokRizz/TikTokRizz/Form1.cs
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
TikTokRizz/TikTokRizz/Form1.vbs
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
TikTokRizz/TikTokRizz/Form1.vbs
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
TikTokRizz/TikTokRizz/Program.cs
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
TikTokRizz/TikTokRizz/Program.cs
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
TikTokRizz/TikTokRizz/Properties/AssemblyInfo.cs
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
TikTokRizz/TikTokRizz/Properties/AssemblyInfo.cs
Resource
win10v2004-20240426-en
Behavioral task
behavioral29
Sample
TikTokRizz/TikTokRizz/Properties/Resources.Designer.vbs
Resource
win7-20240215-en
Behavioral task
behavioral30
Sample
TikTokRizz/TikTokRizz/Properties/Resources.Designer.vbs
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
TikTokRizz/TikTokRizz/Properties/Resources.vbs
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
TikTokRizz/TikTokRizz/Properties/Resources.vbs
Resource
win10v2004-20240508-en
General
-
Target
TikTokRizz/.vs/TikTokRizz/FileContentIndex/8819d140-dbb1-42f4-88e1-27502f877ffd.vsidx
-
Size
14KB
-
MD5
5307650342e8aa8c28b5e19b26cc72d9
-
SHA1
cb660d94229ffde19c02f128856637cc2e6b20a9
-
SHA256
d51d6199acf9cd8be3dfb535cda40eeb8188e48f4eb9fd325706c5bef80ba7c5
-
SHA512
e61a2d24444e83313ad63aa28ff8debe9e8056605285e32238935be5f877c92ad86455635528509b80a136aa47f80057f38ff6dba263d1d5fe9d599a28104ab2
-
SSDEEP
384:Odtieh9oW4VOP5zVPXQwIk6wI9ZUzn79AIJPXY7YnCTG8n5:K7oOPAwIsn7tJP+x5
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\vsidx_auto_file\shell\Read rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\vsidx_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\vsidx_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.vsidx rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.vsidx\ = "vsidx_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\vsidx_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\vsidx_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\vsidx_auto_file\ rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2652 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2652 AcroRd32.exe 2652 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2172 wrote to memory of 1948 2172 cmd.exe 29 PID 2172 wrote to memory of 1948 2172 cmd.exe 29 PID 2172 wrote to memory of 1948 2172 cmd.exe 29 PID 1948 wrote to memory of 2652 1948 rundll32.exe 30 PID 1948 wrote to memory of 2652 1948 rundll32.exe 30 PID 1948 wrote to memory of 2652 1948 rundll32.exe 30 PID 1948 wrote to memory of 2652 1948 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\TikTokRizz\.vs\TikTokRizz\FileContentIndex\8819d140-dbb1-42f4-88e1-27502f877ffd.vsidx1⤵
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\TikTokRizz\.vs\TikTokRizz\FileContentIndex\8819d140-dbb1-42f4-88e1-27502f877ffd.vsidx2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\TikTokRizz\.vs\TikTokRizz\FileContentIndex\8819d140-dbb1-42f4-88e1-27502f877ffd.vsidx"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2652
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD567b74ee8fd6851d54bfded9bfa28f73e
SHA165b0cb578f8da544b471b4a0f17ffe5de0177684
SHA25615293e8d5d8f21b044dd0ac6c4af58fdbbeab5e30ca7bae921b88ce97de53a78
SHA5121c6048bdb0e83eed4f7b9bc948cea6a5a20e1ddc24c63ca23c6a3390b8fbf3cf3980126816ae2ce06232fb8818666530aaa8d7ee69aac1b10d802e5759575557