c291f69fe2c0a95a9949ac15d06182344d646cf591752e0db27e2a09c90a97e6

Resubmissions

15/07/2024, 11:21

240715-ngf83awgpd 3

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 11:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

garrysmod/addons/gwater2/materials/gwater2/normals.vmt
Size

47B
MD5

b781992df1141588d79d9ecc2523481a
SHA1

23eb802f54fde0a1e82a237504970b9920606aa7
SHA256

d896c612bea892d8b47a97a994ab9c4d7ceb97b1cb1f50d1410f2ab054da0c00
SHA512

1be5100b93183c7fd535655b8f434dd0f6062066341284fc0f255bc4bc4d3ce5c69f6e1a03512ce447d1d54e1a493e7a0b746762409aea5c3aab0e9a35573e4d

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.vmt	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\vmt_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\vmt_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\vmt_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\vmt_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\vmt_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\vmt_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.vmt\ = "vmt_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2604	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2604	AcroRd32.exe
2604	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2672	2664	cmd.exe	31
PID 2664 wrote to memory of 2672	2664	cmd.exe	31
PID 2664 wrote to memory of 2672	2664	cmd.exe	31
PID 2672 wrote to memory of 2604	2672	rundll32.exe	32
PID 2672 wrote to memory of 2604	2672	rundll32.exe	32
PID 2672 wrote to memory of 2604	2672	rundll32.exe	32
PID 2672 wrote to memory of 2604	2672	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\garrysmod\addons\gwater2\materials\gwater2\normals.vmt
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\garrysmod\addons\gwater2\materials\gwater2\normals.vmt
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\garrysmod\addons\gwater2\materials\gwater2\normals.vmt"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
12f0e84e57dddc9adede9a1cc1af3eb7

SHA1
3eda86f7f68c0b37b4d397a267a6eeb1d918979b

SHA256
59005837748e8b1a2d53b8a3d280285e57b72ce4a018b5dd9c97e745ddc94530

SHA512
bd57034ec42af87cf3ce52b9ba3a8634267a3511fadc17ffd0c2e97071567b8037f30d111ea69b39f5be38c551df735b891d176be643123b57a9ebd45404d5ae

Download Submit