Analysis
-
max time kernel
151s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23/11/2022, 18:37
Static task
static1
Behavioral task
behavioral1
Sample
1d798673f5d41623c4f65872bd883a90d389da40df7c227b2eb3b5c3b8a14cb1.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
1d798673f5d41623c4f65872bd883a90d389da40df7c227b2eb3b5c3b8a14cb1.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
1d798673f5d41623c4f65872bd883a90d389da40df7c227b2eb3b5c3b8a14cb1.exe
-
Size
248KB
-
MD5
438f15978a689903f82189512d2fc7c0
-
SHA1
bc4e467cbe88f7b486682a5d434e0177188196db
-
SHA256
1d798673f5d41623c4f65872bd883a90d389da40df7c227b2eb3b5c3b8a14cb1
-
SHA512
976c29b48e3f57082cd830b09041b21482841cc1c77f387a43ecdcd1426fec78abe720e912ab9c5513df8aa519aee9a913a13d705047ae3e0bfc9796cc33d327
-
SSDEEP
3072:YkR1SrXrkY8YUL4qx9RIHgil3UuhSa3U3dD8d6Oy+MIrnj3JjNK:B1Sjrkx15x9SHVeOjf
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 1d798673f5d41623c4f65872bd883a90d389da40df7c227b2eb3b5c3b8a14cb1.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" gtduw.exe -
Executes dropped EXE 1 IoCs
pid Process 952 gtduw.exe -
Loads dropped DLL 2 IoCs
pid Process 2016 1d798673f5d41623c4f65872bd883a90d389da40df7c227b2eb3b5c3b8a14cb1.exe 2016 1d798673f5d41623c4f65872bd883a90d389da40df7c227b2eb3b5c3b8a14cb1.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtduw = "C:\\Users\\Admin\\gtduw.exe /j" gtduw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtduw = "C:\\Users\\Admin\\gtduw.exe /a" gtduw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtduw = "C:\\Users\\Admin\\gtduw.exe /m" gtduw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtduw = "C:\\Users\\Admin\\gtduw.exe /r" gtduw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtduw = "C:\\Users\\Admin\\gtduw.exe /o" gtduw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtduw = "C:\\Users\\Admin\\gtduw.exe /n" gtduw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtduw = "C:\\Users\\Admin\\gtduw.exe /e" gtduw.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ gtduw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtduw = "C:\\Users\\Admin\\gtduw.exe /k" gtduw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtduw = "C:\\Users\\Admin\\gtduw.exe /t" gtduw.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 1d798673f5d41623c4f65872bd883a90d389da40df7c227b2eb3b5c3b8a14cb1.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtduw = "C:\\Users\\Admin\\gtduw.exe /v" 1d798673f5d41623c4f65872bd883a90d389da40df7c227b2eb3b5c3b8a14cb1.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtduw = "C:\\Users\\Admin\\gtduw.exe /h" gtduw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtduw = "C:\\Users\\Admin\\gtduw.exe /p" gtduw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtduw = "C:\\Users\\Admin\\gtduw.exe /d" gtduw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtduw = "C:\\Users\\Admin\\gtduw.exe /x" gtduw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtduw = "C:\\Users\\Admin\\gtduw.exe /z" gtduw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtduw = "C:\\Users\\Admin\\gtduw.exe /c" gtduw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtduw = "C:\\Users\\Admin\\gtduw.exe /y" gtduw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtduw = "C:\\Users\\Admin\\gtduw.exe /q" gtduw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtduw = "C:\\Users\\Admin\\gtduw.exe /v" gtduw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtduw = "C:\\Users\\Admin\\gtduw.exe /b" gtduw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtduw = "C:\\Users\\Admin\\gtduw.exe /w" gtduw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtduw = "C:\\Users\\Admin\\gtduw.exe /s" gtduw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtduw = "C:\\Users\\Admin\\gtduw.exe /f" gtduw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtduw = "C:\\Users\\Admin\\gtduw.exe /u" gtduw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtduw = "C:\\Users\\Admin\\gtduw.exe /i" gtduw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtduw = "C:\\Users\\Admin\\gtduw.exe /g" gtduw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtduw = "C:\\Users\\Admin\\gtduw.exe /l" gtduw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2016 1d798673f5d41623c4f65872bd883a90d389da40df7c227b2eb3b5c3b8a14cb1.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe 952 gtduw.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2016 1d798673f5d41623c4f65872bd883a90d389da40df7c227b2eb3b5c3b8a14cb1.exe 952 gtduw.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2016 wrote to memory of 952 2016 1d798673f5d41623c4f65872bd883a90d389da40df7c227b2eb3b5c3b8a14cb1.exe 27 PID 2016 wrote to memory of 952 2016 1d798673f5d41623c4f65872bd883a90d389da40df7c227b2eb3b5c3b8a14cb1.exe 27 PID 2016 wrote to memory of 952 2016 1d798673f5d41623c4f65872bd883a90d389da40df7c227b2eb3b5c3b8a14cb1.exe 27 PID 2016 wrote to memory of 952 2016 1d798673f5d41623c4f65872bd883a90d389da40df7c227b2eb3b5c3b8a14cb1.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d798673f5d41623c4f65872bd883a90d389da40df7c227b2eb3b5c3b8a14cb1.exe"C:\Users\Admin\AppData\Local\Temp\1d798673f5d41623c4f65872bd883a90d389da40df7c227b2eb3b5c3b8a14cb1.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\gtduw.exe"C:\Users\Admin\gtduw.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:952
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
MD50ab41071e42ed233a0aa5c1b9765efed
SHA1f2a7ca2f2f09b6d0c5b3ec3140e1ea3a4a0c4354
SHA256b95a0f6c952bc30cdafe92165d5f3a1458196202aace5d3eccabcc6646c9cb53
SHA5121c8ce98be72545dc96a19194a5c1fb69c9a59a831f283ad41e92670894cb4ba02a9cd03be976ccdb506966287adcc0894d9c70a9fa279749a3b7e8d15cc9c4b6
-
Filesize
248KB
MD50ab41071e42ed233a0aa5c1b9765efed
SHA1f2a7ca2f2f09b6d0c5b3ec3140e1ea3a4a0c4354
SHA256b95a0f6c952bc30cdafe92165d5f3a1458196202aace5d3eccabcc6646c9cb53
SHA5121c8ce98be72545dc96a19194a5c1fb69c9a59a831f283ad41e92670894cb4ba02a9cd03be976ccdb506966287adcc0894d9c70a9fa279749a3b7e8d15cc9c4b6
-
Filesize
248KB
MD50ab41071e42ed233a0aa5c1b9765efed
SHA1f2a7ca2f2f09b6d0c5b3ec3140e1ea3a4a0c4354
SHA256b95a0f6c952bc30cdafe92165d5f3a1458196202aace5d3eccabcc6646c9cb53
SHA5121c8ce98be72545dc96a19194a5c1fb69c9a59a831f283ad41e92670894cb4ba02a9cd03be976ccdb506966287adcc0894d9c70a9fa279749a3b7e8d15cc9c4b6
-
Filesize
248KB
MD50ab41071e42ed233a0aa5c1b9765efed
SHA1f2a7ca2f2f09b6d0c5b3ec3140e1ea3a4a0c4354
SHA256b95a0f6c952bc30cdafe92165d5f3a1458196202aace5d3eccabcc6646c9cb53
SHA5121c8ce98be72545dc96a19194a5c1fb69c9a59a831f283ad41e92670894cb4ba02a9cd03be976ccdb506966287adcc0894d9c70a9fa279749a3b7e8d15cc9c4b6