Analysis
-
max time kernel
165s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-10-2022 17:49
Static task
static1
Behavioral task
behavioral1
Sample
5db1155c14d0bde9dda1cda4119c693382463ae34e0c8b78eb77b0831a7aeda8.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
5db1155c14d0bde9dda1cda4119c693382463ae34e0c8b78eb77b0831a7aeda8.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
5db1155c14d0bde9dda1cda4119c693382463ae34e0c8b78eb77b0831a7aeda8.exe
-
Size
220KB
-
MD5
81a4b276e7b3d4533c18a6778a950510
-
SHA1
fb7d5714f9473dc0365b8e8af900017641417a93
-
SHA256
5db1155c14d0bde9dda1cda4119c693382463ae34e0c8b78eb77b0831a7aeda8
-
SHA512
b242c2dadac570c9d19f59fc41aef40ed50f291ef2d8751893d106bbae219871c2b7639e2ec576e81a917e223599c2407c4c594e085eafda1c8e8774db082445
-
SSDEEP
3072:r29Fc99KwcyAHtyU472ydts1Vsd0WpPGFobtkBdk3ENwG:v9tR6EUEts1VseWpPGFobC3k3ENn
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 5db1155c14d0bde9dda1cda4119c693382463ae34e0c8b78eb77b0831a7aeda8.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" gexas.exe -
Executes dropped EXE 1 IoCs
pid Process 2228 gexas.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 5db1155c14d0bde9dda1cda4119c693382463ae34e0c8b78eb77b0831a7aeda8.exe -
Adds Run key to start application 2 TTPs 55 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /G" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /V" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /J" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /F" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /p" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /Y" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /C" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /l" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /a" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /x" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /n" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /s" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /g" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /f" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /z" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /R" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /O" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /u" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /I" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /h" gexas.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /v" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /X" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /W" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /q" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /S" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /H" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /D" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /K" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /U" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /L" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /Z" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /w" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /m" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /M" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /Q" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /k" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /d" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /i" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /B" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /r" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /b" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /c" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /T" 5db1155c14d0bde9dda1cda4119c693382463ae34e0c8b78eb77b0831a7aeda8.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /P" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /e" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /A" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /t" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /N" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /o" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /y" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /j" gexas.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 5db1155c14d0bde9dda1cda4119c693382463ae34e0c8b78eb77b0831a7aeda8.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /T" gexas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gexas = "C:\\Users\\Admin\\gexas.exe /E" gexas.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2136 5db1155c14d0bde9dda1cda4119c693382463ae34e0c8b78eb77b0831a7aeda8.exe 2136 5db1155c14d0bde9dda1cda4119c693382463ae34e0c8b78eb77b0831a7aeda8.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe 2228 gexas.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2136 5db1155c14d0bde9dda1cda4119c693382463ae34e0c8b78eb77b0831a7aeda8.exe 2228 gexas.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2136 wrote to memory of 2228 2136 5db1155c14d0bde9dda1cda4119c693382463ae34e0c8b78eb77b0831a7aeda8.exe 79 PID 2136 wrote to memory of 2228 2136 5db1155c14d0bde9dda1cda4119c693382463ae34e0c8b78eb77b0831a7aeda8.exe 79 PID 2136 wrote to memory of 2228 2136 5db1155c14d0bde9dda1cda4119c693382463ae34e0c8b78eb77b0831a7aeda8.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\5db1155c14d0bde9dda1cda4119c693382463ae34e0c8b78eb77b0831a7aeda8.exe"C:\Users\Admin\AppData\Local\Temp\5db1155c14d0bde9dda1cda4119c693382463ae34e0c8b78eb77b0831a7aeda8.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\gexas.exe"C:\Users\Admin\gexas.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2228
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
220KB
MD5986198dec2d7cd1dbb35fcb0ce88d12d
SHA1f7b5057e96501481e4d9ff81ab19d455c83be3ff
SHA2561d570227acc2b2cb34ffc09350a3b792104e9e3b2be71144fe9007f924c1f381
SHA512fd571087f357b6e6251f63665b3a5167e3e299d1f105c75f3ecb45b3adcf067143251ffd8c5da0e36ce072c16674b50c66af9799b702a2ac3cd7ce919b734973
-
Filesize
220KB
MD5986198dec2d7cd1dbb35fcb0ce88d12d
SHA1f7b5057e96501481e4d9ff81ab19d455c83be3ff
SHA2561d570227acc2b2cb34ffc09350a3b792104e9e3b2be71144fe9007f924c1f381
SHA512fd571087f357b6e6251f63665b3a5167e3e299d1f105c75f3ecb45b3adcf067143251ffd8c5da0e36ce072c16674b50c66af9799b702a2ac3cd7ce919b734973