Analysis
-
max time kernel
152s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 20:06
Static task
static1
Behavioral task
behavioral1
Sample
593239d8f2e5e4915868caefd8479e87fd2d12a624aaffb816dc502baa0b772e.exe
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
593239d8f2e5e4915868caefd8479e87fd2d12a624aaffb816dc502baa0b772e.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
593239d8f2e5e4915868caefd8479e87fd2d12a624aaffb816dc502baa0b772e.exe
-
Size
256KB
-
MD5
920381bd0eb7ae3ec91c37c95713a008
-
SHA1
75eadb20c4ed4d9a5b7de85fd895b8e84975d2c8
-
SHA256
593239d8f2e5e4915868caefd8479e87fd2d12a624aaffb816dc502baa0b772e
-
SHA512
38d3f39be30762ff89b60997671509676bcd7e486c697cd5985270a3f46a2e99b8f249a6ef1dac75f9473913a7d6dcf55eba2ae0a423cd469c7b85aaf2bbedda
-
SSDEEP
3072:k3ZVoe+Plp/nskpCUv5T79fzCC/M7BFsqMabeYiUDoZG/33ygot:yf2PlptNvl9fm0UBFsqMabeYiUDogvFg
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 593239d8f2e5e4915868caefd8479e87fd2d12a624aaffb816dc502baa0b772e.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" gaibio.exe -
Executes dropped EXE 1 IoCs
pid Process 3064 gaibio.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 593239d8f2e5e4915868caefd8479e87fd2d12a624aaffb816dc502baa0b772e.exe -
Adds Run key to start application 2 TTPs 55 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /J" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /z" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /W" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /V" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /U" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /T" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /h" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /b" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /Y" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /Z" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /q" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /H" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /c" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /P" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /A" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /Q" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /t" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /S" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /a" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /K" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /g" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /O" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /m" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /D" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /X" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /R" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /o" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /i" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /k" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /F" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /u" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /y" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /f" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /l" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /e" gaibio.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 593239d8f2e5e4915868caefd8479e87fd2d12a624aaffb816dc502baa0b772e.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /E" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /N" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /G" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /s" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /M" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /r" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /x" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /j" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /p" gaibio.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /d" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /B" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /w" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /I" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /R" 593239d8f2e5e4915868caefd8479e87fd2d12a624aaffb816dc502baa0b772e.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /n" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /L" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /C" gaibio.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaibio = "C:\\Users\\Admin\\gaibio.exe /v" gaibio.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3108 593239d8f2e5e4915868caefd8479e87fd2d12a624aaffb816dc502baa0b772e.exe 3108 593239d8f2e5e4915868caefd8479e87fd2d12a624aaffb816dc502baa0b772e.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe 3064 gaibio.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3108 593239d8f2e5e4915868caefd8479e87fd2d12a624aaffb816dc502baa0b772e.exe 3064 gaibio.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3108 wrote to memory of 3064 3108 593239d8f2e5e4915868caefd8479e87fd2d12a624aaffb816dc502baa0b772e.exe 82 PID 3108 wrote to memory of 3064 3108 593239d8f2e5e4915868caefd8479e87fd2d12a624aaffb816dc502baa0b772e.exe 82 PID 3108 wrote to memory of 3064 3108 593239d8f2e5e4915868caefd8479e87fd2d12a624aaffb816dc502baa0b772e.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\593239d8f2e5e4915868caefd8479e87fd2d12a624aaffb816dc502baa0b772e.exe"C:\Users\Admin\AppData\Local\Temp\593239d8f2e5e4915868caefd8479e87fd2d12a624aaffb816dc502baa0b772e.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\gaibio.exe"C:\Users\Admin\gaibio.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3064
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD5dde2871111354794c5f2fec74cfb1268
SHA1e23655a147dc367b23d43ff83a83911ae2726d6c
SHA256aa1eb68d4c879a9ad112009bfaf483a614a06cd17f3727d33865901d7ad64a86
SHA5129ce3c9b962835290be72317ef589324402aee8bc5a77ba28756af87038cfa4436d5ae5927ce9e8c3e3b111478ee1b61499deda9912e0797a1decf7d47aa04ddb
-
Filesize
256KB
MD5dde2871111354794c5f2fec74cfb1268
SHA1e23655a147dc367b23d43ff83a83911ae2726d6c
SHA256aa1eb68d4c879a9ad112009bfaf483a614a06cd17f3727d33865901d7ad64a86
SHA5129ce3c9b962835290be72317ef589324402aee8bc5a77ba28756af87038cfa4436d5ae5927ce9e8c3e3b111478ee1b61499deda9912e0797a1decf7d47aa04ddb