21c20732aa5d87200c0df10139a844ebd9c19ee6486fab3ba78a6ea92f968935

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 13:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TikTokRizz/.vs/TikTokRizz/FileContentIndex/8819d140-dbb1-42f4-88e1-27502f877ffd.vsidx
Size

14KB
MD5

5307650342e8aa8c28b5e19b26cc72d9
SHA1

cb660d94229ffde19c02f128856637cc2e6b20a9
SHA256

d51d6199acf9cd8be3dfb535cda40eeb8188e48f4eb9fd325706c5bef80ba7c5
SHA512

e61a2d24444e83313ad63aa28ff8debe9e8056605285e32238935be5f877c92ad86455635528509b80a136aa47f80057f38ff6dba263d1d5fe9d599a28104ab2
SSDEEP

384:Odtieh9oW4VOP5zVPXQwIk6wI9ZUzn79AIJPXY7YnCTG8n5:K7oOPAwIsn7tJP+x5

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\vsidx_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\vsidx_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\vsidx_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.vsidx	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.vsidx\ = "vsidx_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\vsidx_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\vsidx_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\vsidx_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2652	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2652	AcroRd32.exe
2652	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 1948	2172	cmd.exe	29
PID 2172 wrote to memory of 1948	2172	cmd.exe	29
PID 2172 wrote to memory of 1948	2172	cmd.exe	29
PID 1948 wrote to memory of 2652	1948	rundll32.exe	30
PID 1948 wrote to memory of 2652	1948	rundll32.exe	30
PID 1948 wrote to memory of 2652	1948	rundll32.exe	30
PID 1948 wrote to memory of 2652	1948	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\TikTokRizz\.vs\TikTokRizz\FileContentIndex\8819d140-dbb1-42f4-88e1-27502f877ffd.vsidx
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\TikTokRizz\.vs\TikTokRizz\FileContentIndex\8819d140-dbb1-42f4-88e1-27502f877ffd.vsidx
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\TikTokRizz\.vs\TikTokRizz\FileContentIndex\8819d140-dbb1-42f4-88e1-27502f877ffd.vsidx"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
67b74ee8fd6851d54bfded9bfa28f73e

SHA1
65b0cb578f8da544b471b4a0f17ffe5de0177684

SHA256
15293e8d5d8f21b044dd0ac6c4af58fdbbeab5e30ca7bae921b88ce97de53a78

SHA512
1c6048bdb0e83eed4f7b9bc948cea6a5a20e1ddc24c63ca23c6a3390b8fbf3cf3980126816ae2ce06232fb8818666530aaa8d7ee69aac1b10d802e5759575557

Download Submit