c291f69fe2c0a95a9949ac15d06182344d646cf591752e0db27e2a09c90a97e6

Resubmissions

15/07/2024, 11:21

240715-ngf83awgpd 3

Analysis

max time kernel
103s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 11:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

garrysmod/addons/gwater2/materials/gwater2/smooth.vmt
Size

30B
MD5

d25241a8eb60d0a99090ffe6d0a344ee
SHA1

d6cf211ca6959f6b7c950d317dbaa700408223fe
SHA256

afefd5ae9904a164d0fb99fa84988a4adb42d0ad9961a597d3da98d389ec09ee
SHA512

af68ef57ec5380b98afbcd64907b9c952ebff66f4293c1d684f8a0007ee2183b01f5b60a8e42c5176e403c3ce2399f5fd44f9a8b0712ac9d09597682526815a5

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.vmt\ = "vmt_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\vmt_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\vmt_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\vmt_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.vmt	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\vmt_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\vmt_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\vmt_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2244	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2244	AcroRd32.exe
2244	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2816	2948	cmd.exe	30
PID 2948 wrote to memory of 2816	2948	cmd.exe	30
PID 2948 wrote to memory of 2816	2948	cmd.exe	30
PID 2816 wrote to memory of 2244	2816	rundll32.exe	31
PID 2816 wrote to memory of 2244	2816	rundll32.exe	31
PID 2816 wrote to memory of 2244	2816	rundll32.exe	31
PID 2816 wrote to memory of 2244	2816	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\garrysmod\addons\gwater2\materials\gwater2\smooth.vmt
1⤵
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\garrysmod\addons\gwater2\materials\gwater2\smooth.vmt
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\garrysmod\addons\gwater2\materials\gwater2\smooth.vmt"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b39c51162d19b1367bf8288794fc64db

SHA1
5131509ece0e54e1b0db45da1ce8ce1daf4afc6f

SHA256
33835d90a231151f801976f888d81648cee2705d48dbb006724ea5c72ca29bad

SHA512
f24e0a618433de010bf096e3085c8e1fab4a29d234d6a3b6d3a19d62e6fc03cc2e3548a348ae9a60403bf6173aa9012d49d22af8d02dee3c5546585b96ccdbc8

Download Submit