Overview
overview
3Static
static
1dolphSol-M...ch.zip
windows7-x64
1dolphSol-M...ch.zip
windows10-2004-x64
1dolphSol-M...ibutes
windows7-x64
3dolphSol-M...ibutes
windows10-2004-x64
3dolphSol-M...NG.yml
windows7-x64
3dolphSol-M...NG.yml
windows10-2004-x64
3dolphSol-M...ignore
windows7-x64
3dolphSol-M...ignore
windows10-2004-x64
3dolphSol-M...s.json
windows7-x64
3dolphSol-M...s.json
windows10-2004-x64
3dolphSol-M...ICENSE
windows7-x64
1dolphSol-M...ICENSE
windows10-2004-x64
1dolphSol-M...in.ahk
windows7-x64
3dolphSol-M...in.ahk
windows10-2004-x64
3dolphSol-M...res.md
windows7-x64
3dolphSol-M...res.md
windows10-2004-x64
3dolphSol-M...DME.md
windows7-x64
3dolphSol-M...DME.md
windows10-2004-x64
3dolphSol-M...on.png
windows7-x64
3dolphSol-M...on.png
windows10-2004-x64
3dolphSol-M...yn.ico
windows7-x64
3dolphSol-M...yn.ico
windows10-2004-x64
3dolphSol-M...SM.ico
windows7-x64
3dolphSol-M...SM.ico
windows10-2004-x64
3dolphSol-M...on.png
windows7-x64
3dolphSol-M...on.png
windows10-2004-x64
3dolphSol-M...st.png
windows7-x64
3dolphSol-M...st.png
windows10-2004-x64
3dolphSol-M...st.png
windows7-x64
3dolphSol-M...st.png
windows10-2004-x64
3dolphSol-M...fp.jpg
windows7-x64
3dolphSol-M...fp.jpg
windows10-2004-x64
3Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
09/08/2024, 06:48
Static task
static1
Behavioral task
behavioral1
Sample
dolphSol-Macro-Amraki-Patch.zip
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
dolphSol-Macro-Amraki-Patch.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
dolphSol-Macro-Amraki-Patch/.gitattributes
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
dolphSol-Macro-Amraki-Patch/.gitattributes
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
dolphSol-Macro-Amraki-Patch/.github/FUNDING.yml
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
dolphSol-Macro-Amraki-Patch/.github/FUNDING.yml
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
dolphSol-Macro-Amraki-Patch/.gitignore
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
dolphSol-Macro-Amraki-Patch/.gitignore
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
dolphSol-Macro-Amraki-Patch/.vscode/settings.json
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
dolphSol-Macro-Amraki-Patch/.vscode/settings.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
dolphSol-Macro-Amraki-Patch/LICENSE
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
dolphSol-Macro-Amraki-Patch/LICENSE
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
dolphSol-Macro-Amraki-Patch/Main.ahk
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
dolphSol-Macro-Amraki-Patch/Main.ahk
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
dolphSol-Macro-Amraki-Patch/Planned Features.md
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
dolphSol-Macro-Amraki-Patch/Planned Features.md
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
dolphSol-Macro-Amraki-Patch/README.md
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
dolphSol-Macro-Amraki-Patch/README.md
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
dolphSol-Macro-Amraki-Patch/images/UIInformation.png
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
dolphSol-Macro-Amraki-Patch/images/UIInformation.png
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
dolphSol-Macro-Amraki-Patch/images/auryn.ico
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
dolphSol-Macro-Amraki-Patch/images/auryn.ico
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
dolphSol-Macro-Amraki-Patch/images/dSM.ico
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
dolphSol-Macro-Amraki-Patch/images/dSM.ico
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
dolphSol-Macro-Amraki-Patch/images/discordIcon.png
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
dolphSol-Macro-Amraki-Patch/images/discordIcon.png
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
dolphSol-Macro-Amraki-Patch/images/glitchTest.png
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
dolphSol-Macro-Amraki-Patch/images/glitchTest.png
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
dolphSol-Macro-Amraki-Patch/images/nullTest.png
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
dolphSol-Macro-Amraki-Patch/images/nullTest.png
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
dolphSol-Macro-Amraki-Patch/images/pfp.jpg
Resource
win7-20240729-en
Behavioral task
behavioral32
Sample
dolphSol-Macro-Amraki-Patch/images/pfp.jpg
Resource
win10v2004-20240802-en
General
-
Target
dolphSol-Macro-Amraki-Patch/.vscode/settings.json
-
Size
92B
-
MD5
8d7cfaf419f64016c2b95cc47105221f
-
SHA1
5c3651752e2a2448b85665ea47b869b99f34ad6c
-
SHA256
e7cb6b38d3f0cd2191db59ba9d0c788bc3a56025a0cd0aee6db3a2fb38abb6db
-
SHA512
10926ea7f1fb796f676de1e78f9a8abc7a6b490bc9617dc07ceaa8178389762d7361b2b7df1c10f806123f0ce4be0fc7a4a57f70921efb2bd9514b4445168868
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\json_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\json_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\json_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\.json\ = "json_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\json_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\json_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\.json rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1984 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1984 AcroRd32.exe 1984 AcroRd32.exe 1984 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3040 wrote to memory of 2528 3040 cmd.exe 31 PID 3040 wrote to memory of 2528 3040 cmd.exe 31 PID 3040 wrote to memory of 2528 3040 cmd.exe 31 PID 2528 wrote to memory of 1984 2528 rundll32.exe 32 PID 2528 wrote to memory of 1984 2528 rundll32.exe 32 PID 2528 wrote to memory of 1984 2528 rundll32.exe 32 PID 2528 wrote to memory of 1984 2528 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\dolphSol-Macro-Amraki-Patch\.vscode\settings.json1⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\dolphSol-Macro-Amraki-Patch\.vscode\settings.json2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\dolphSol-Macro-Amraki-Patch\.vscode\settings.json"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1984
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD50b12aedff6c8c23690393ba2e6e27e38
SHA10785df510e2f46c0100b5003fc8211b3b3239d1a
SHA2563aeaeef9b845f25b3cab0aaf5aef368340f106ec7cfadc0d6243f48b40a22553
SHA512109ac7787c50c70e08fcff046cb5f82194e33680315993e6a8d3128ab2e71f5538917b6639d20c1b46c0252fc562a71cbda57a7322b428d8d8c125ace810e280