b4118b124f3847d2fc69d028c11b078b786547f8391209ddc701a344785a5d19

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GANG-Nuker-main/GANG.py
Size

51KB
MD5

91292a625f10c55332b2ea906176c869
SHA1

4bb924cea3ea0dc9eb9c064b878d6bb930abd8fa
SHA256

474146a09a35c57a45c5e16729d37cbcfbd3dab18b570b308f9231c46833fa5c
SHA512

e98a50782e196172343d7ee7857ddf81e97c9210d5600b77c245d0b8faf9dad3cf5ec7a9d8f96d72124198880973f1f838a9ae08c5ea3d69f1bd6fd8f2527c2f
SSDEEP

1536:ctlxfDENXRV9L4gDSwFqWO6qt9IzJAYR255G+hbQj4A+UN:4lx7PgDSY/O6qt9IzJAYk55G+FQjN+UN

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2776	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2776	AcroRd32.exe
2776	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2608	1924	cmd.exe	29
PID 1924 wrote to memory of 2608	1924	cmd.exe	29
PID 1924 wrote to memory of 2608	1924	cmd.exe	29
PID 2608 wrote to memory of 2776	2608	rundll32.exe	30
PID 2608 wrote to memory of 2776	2608	rundll32.exe	30
PID 2608 wrote to memory of 2776	2608	rundll32.exe	30
PID 2608 wrote to memory of 2776	2608	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\GANG-Nuker-main\GANG.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\GANG-Nuker-main\GANG.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\GANG-Nuker-main\GANG.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d492d0876b609f49a7adabf957125030

SHA1
cf3be6789dc72d92ff7ae6162c75421323ea16eb

SHA256
94724dbb097c52cdf5fcd39ebdb6e4ae8d938b3d7c0b29d48347a7b010ceba67

SHA512
d6744157728d2256772181f3b8587521c361233f1d06d3dfdcaf0dcff358c66fa65e8466762312bc22ec4416aee853c86487e38a31468ca68c2466c0e527805b

Download Submit