Overview
overview
10Static
static
10ampscripts.tar.gz
windows7-x64
3ampscripts.tar.gz
windows10-2004-x64
3sample.tar
windows7-x64
3sample.tar
windows10-2004-x64
3ICMP
ubuntu-22.04-amd64
7arma
ubuntu-24.04-amd64
7fivem.txt
windows7-x64
1fivem.txt
windows10-2004-x64
1fn-lag.txt
windows7-x64
1fn-lag.txt
windows10-2004-x64
1frantech.txt
windows7-x64
1frantech.txt
windows10-2004-x64
1game-clap.txt
windows7-x64
1game-clap.txt
windows10-2004-x64
1game-lag.txt
windows7-x64
1game-lag.txt
windows10-2004-x64
1game.txt
windows7-x64
1game.txt
windows10-2004-x64
1gamev2.txt
windows7-x64
1gamev2.txt
windows10-2004-x64
1gamev3.txt
windows7-x64
1gamev3.txt
windows10-2004-x64
1killall.txt
windows7-x64
1killall.txt
windows10-2004-x64
1killall1.txt
windows7-x64
1killall1.txt
windows10-2004-x64
1ldap.txt
windows7-x64
1ldap.txt
windows10-2004-x64
1ldapv2.txt
windows7-x64
1ldapv2.txt
windows10-2004-x64
1mdns.txt
windows7-x64
1mdns.txt
windows10-2004-x64
1Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 08:06
Behavioral task
behavioral1
Sample
ampscripts.tar.gz
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ampscripts.tar.gz
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
sample.tar
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
sample.tar
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
ICMP
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral6
Sample
arma
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral7
Sample
fivem.txt
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
fivem.txt
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
fn-lag.txt
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
fn-lag.txt
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
frantech.txt
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
frantech.txt
Resource
win10v2004-20240704-en
Behavioral task
behavioral13
Sample
game-clap.txt
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
game-clap.txt
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
game-lag.txt
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
game-lag.txt
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
game.txt
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
game.txt
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
gamev2.txt
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
gamev2.txt
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
gamev3.txt
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
gamev3.txt
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
killall.txt
Resource
win7-20240705-en
Behavioral task
behavioral24
Sample
killall.txt
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
killall1.txt
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
killall1.txt
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
ldap.txt
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
ldap.txt
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
ldapv2.txt
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
ldapv2.txt
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
mdns.txt
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
mdns.txt
Resource
win10v2004-20240709-en
General
-
Target
ampscripts.tar.gz
-
Size
22.2MB
-
MD5
ba076bac396e719d5cc23494ea4bc932
-
SHA1
62d179108eeb87f1757e82ecffba764e51d5788f
-
SHA256
442bc1d9cc915c514f56d07d44d05d8caab80ae521e29f5a2a3b54058d77aa95
-
SHA512
c3eee81870b85b9571335c0029a4526263572d628a5676a90f67af5983c734d27f03d724d95b985fee17e6d4196e6ea285560dbaf056d2c96a56cf7c569bb9be
-
SSDEEP
393216:CSCkKbJcPGGf2Yd/TL33ThnMfCO6vr22eGudbkSK9ubnTg9volOCWyWiVnp2D+r+:CMKNCGGuYnMKvrNlu1kyTguFWyJVp2K+
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 352 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 352 AcroRd32.exe 352 AcroRd32.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2808 wrote to memory of 2692 2808 cmd.exe 32 PID 2808 wrote to memory of 2692 2808 cmd.exe 32 PID 2808 wrote to memory of 2692 2808 cmd.exe 32 PID 2692 wrote to memory of 2208 2692 rundll32.exe 33 PID 2692 wrote to memory of 2208 2692 rundll32.exe 33 PID 2692 wrote to memory of 2208 2692 rundll32.exe 33 PID 2208 wrote to memory of 352 2208 rundll32.exe 35 PID 2208 wrote to memory of 352 2208 rundll32.exe 35 PID 2208 wrote to memory of 352 2208 rundll32.exe 35 PID 2208 wrote to memory of 352 2208 rundll32.exe 35
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ampscripts.tar.gz1⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ampscripts.tar.gz2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ampscripts.tar.gz3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ampscripts.tar.gz"4⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:352
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD51538719d549bbd91a066f396e78bb184
SHA1cd88a7289ac1e546972a66c877cb6c5dc0279273
SHA256aaee6742bffb4da48244bf511b3f7beafe5e077973cfc1e5d106e77a2c89dd8f
SHA512a9cb7c3903b5fbd6b68447bee662092fba12597397c7523989d97adbd03a715f7ba95e41ffb7c02cc464c26448b61d22c5d6a0096be73e9867e9aa9f5b33a123