Resubmissions

18/08/2024, 12:39

240818-pv2btstdrc 8

18/08/2024, 12:38

240818-pt66patdph 8

Analysis

  • max time kernel
    102s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    18/08/2024, 12:39

General

  • Target

    resources/luascripts/animations/energizegui.lua

  • Size

    53KB

  • MD5

    ed3dfb140afc2dd6d0e743e98afdfcdf

  • SHA1

    5b109156e02b2b9cfd1cb0adf01acbbc07e73c76

  • SHA256

    0529358b29f4f6e153742cb96123bcd7e6e1ea4e865ea0aa9bbe0fec0c5d0152

  • SHA512

    5264c1c219be4c88fd36db24cb7efdd5753e4a1f440447fd03be636e732826690e61bb5bb1d12c1642628d99ea136733a37096cb4b452bd32b3985aa18797eb5

  • SSDEEP

    1536:uq2YCOZhtJW/C0myh01rjdDiqg8JkhX3nRIWyxWWXPGNp3ML9q:uq2YCOZhtJW/C0myh01rjdDiqg8JkhXd

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\resources\luascripts\animations\energizegui.lua
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1820
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\resources\luascripts\animations\energizegui.lua
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2804
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\resources\luascripts\animations\energizegui.lua"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2464

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    275b1488956735dfd2ca46a6c919b0b1

    SHA1

    ecc067698a23af1a962f683d99fd5a567323c16d

    SHA256

    b45bde478f7da3fb1159e5d695663e5d89370b4c2987052607cac95c5881425f

    SHA512

    bf334c4709939e49fcc69b1e5f9a768c580f4ad4ff469b99a0192a27070469c9c2a09331c7d8248f2b0fee4a586140da72aeea92bfbc077e659f028e8cf4ae39