730e0fe71b44a9681238a2ad4c04d50779442dc690184744d7f85bac6a21f82d

Analysis

max time kernel
148s
max time network
49s
platform
windows7_x64
resource
win7-20220812-de
resource tags

arch:x64arch:x86image:win7-20220812-delocale:de-deos:windows7-x64systemwindows
submitted
11/09/2022, 20:51

Target

GrieferGames Launcher.exe
Size

450.0MB
MD5

dfffb7b07b552180391033ee3eae0146
SHA1

48b09362c70d3b0b1714e4eaa9346ed829377f31
SHA256

730e0fe71b44a9681238a2ad4c04d50779442dc690184744d7f85bac6a21f82d
SHA512

a380d699ae01ff5594ff8c80f2e92bd816340a6aa57c728306034b38dec800cd4a1c770dd9e8b1fd1785b4d33147231b9750ac871381a787d468aa5bb17bb883
SSDEEP

49152:jbU8Je1gDL18/swgZQ9rXHZiTKKgsbU8Je1gDL18/swgZQ9rXHZiTKKg:fUUe1IL6/om9CUUe1IL6/om9

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1376	GrieferGames Launcher.exe
1708	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1376	GrieferGames Launcher.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 1312	1376	GrieferGames Launcher.exe	29
PID 1376 wrote to memory of 1312	1376	GrieferGames Launcher.exe	29
PID 1376 wrote to memory of 1312	1376	GrieferGames Launcher.exe	29
PID 1376 wrote to memory of 1312	1376	GrieferGames Launcher.exe	29
PID 1376 wrote to memory of 1312	1376	GrieferGames Launcher.exe	29
PID 1376 wrote to memory of 1312	1376	GrieferGames Launcher.exe	29
PID 1376 wrote to memory of 1312	1376	GrieferGames Launcher.exe	29
PID 1312 wrote to memory of 1708	1312	cmd.exe	31
PID 1312 wrote to memory of 1708	1312	cmd.exe	31
PID 1312 wrote to memory of 1708	1312	cmd.exe	31
PID 1312 wrote to memory of 1708	1312	cmd.exe	31
PID 1312 wrote to memory of 1708	1312	cmd.exe	31
PID 1312 wrote to memory of 1708	1312	cmd.exe	31
PID 1312 wrote to memory of 1708	1312	cmd.exe	31

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1376-54-0x0000000075A31000-0x0000000075A33000-memory.dmp

Filesize
8KB

Download
memory/1376-55-0x00000000000E0000-0x00000000000E2000-memory.dmp

Filesize
8KB

Download
memory/1376-57-0x00000000000E0000-0x00000000004FE000-memory.dmp

Filesize
4.1MB

Download
memory/1376-56-0x00000000000E0000-0x00000000004FE000-memory.dmp

Filesize
4.1MB

Download
memory/1376-63-0x00000000000E0000-0x00000000004FE000-memory.dmp

Filesize
4.1MB

Download
memory/1708-62-0x0000000071380000-0x000000007192B000-memory.dmp

Filesize
5.7MB

Download