6eaf8f27666e511d620066188ca34760ac44d3241e90554bc5cc696cdea0d88b

General

Target

6eaf8f27666e511d620066188ca34760ac44d3241e90554bc5cc696cdea0d88b.exe
Size

248KB
MD5

34bf25da402351ff5a346fed32ba6280
SHA1

f208adc9f7c253db5edf6cf8263cbf57655bb7e2
SHA256

6eaf8f27666e511d620066188ca34760ac44d3241e90554bc5cc696cdea0d88b
SHA512

0858b8075f5aa14a5c01fa1197987d43c13418fb309b3fa8bdb33048b4da3a8e16e677743939c566c5a73ec8fe7b3337173324d9b1a65493b6c8a36dcba497ac
SSDEEP

3072:gr1Pci6xjLw6fF44m1shLv0diVjtt3PQ0pU3623sWMGCX799A2Uuu6WSLOXnt7sp:grRAw6+4m1umwptvpIMGaQ66jtc

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

6eaf8f27666e511d620066188ca34760ac44d3241e90554bc5cc696cdea0d88b.exegiaxiud.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	6eaf8f27666e511d620066188ca34760ac44d3241e90554bc5cc696cdea0d88b.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	giaxiud.exe

Executes dropped EXE 1 IoCs

Processes:

giaxiud.exe

pid process

1816 giaxiud.exe

pid	process
1816	giaxiud.exe

Loads dropped DLL 2 IoCs

Processes:

6eaf8f27666e511d620066188ca34760ac44d3241e90554bc5cc696cdea0d88b.exe

pid	process
564	6eaf8f27666e511d620066188ca34760ac44d3241e90554bc5cc696cdea0d88b.exe
564	6eaf8f27666e511d620066188ca34760ac44d3241e90554bc5cc696cdea0d88b.exe

Adds Run key to start application 2 TTPs 29 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

giaxiud.exe6eaf8f27666e511d620066188ca34760ac44d3241e90554bc5cc696cdea0d88b.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\giaxiud = "C:\\Users\\Admin\\giaxiud.exe /n"	giaxiud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\giaxiud = "C:\\Users\\Admin\\giaxiud.exe /k"	giaxiud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\giaxiud = "C:\\Users\\Admin\\giaxiud.exe /c"	giaxiud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\giaxiud = "C:\\Users\\Admin\\giaxiud.exe /v"	giaxiud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\giaxiud = "C:\\Users\\Admin\\giaxiud.exe /s"	giaxiud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\giaxiud = "C:\\Users\\Admin\\giaxiud.exe /q"	giaxiud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\giaxiud = "C:\\Users\\Admin\\giaxiud.exe /a"	giaxiud.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\	6eaf8f27666e511d620066188ca34760ac44d3241e90554bc5cc696cdea0d88b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\giaxiud = "C:\\Users\\Admin\\giaxiud.exe /i"	giaxiud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\giaxiud = "C:\\Users\\Admin\\giaxiud.exe /y"	giaxiud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\giaxiud = "C:\\Users\\Admin\\giaxiud.exe /t"	giaxiud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\giaxiud = "C:\\Users\\Admin\\giaxiud.exe /m"	giaxiud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\giaxiud = "C:\\Users\\Admin\\giaxiud.exe /u"	giaxiud.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\	giaxiud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\giaxiud = "C:\\Users\\Admin\\giaxiud.exe /x"	giaxiud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\giaxiud = "C:\\Users\\Admin\\giaxiud.exe /w"	giaxiud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\giaxiud = "C:\\Users\\Admin\\giaxiud.exe /z"	giaxiud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\giaxiud = "C:\\Users\\Admin\\giaxiud.exe /e"	giaxiud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\giaxiud = "C:\\Users\\Admin\\giaxiud.exe /o"	giaxiud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\giaxiud = "C:\\Users\\Admin\\giaxiud.exe /h"	giaxiud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\giaxiud = "C:\\Users\\Admin\\giaxiud.exe /p"	giaxiud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\giaxiud = "C:\\Users\\Admin\\giaxiud.exe /r"	giaxiud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\giaxiud = "C:\\Users\\Admin\\giaxiud.exe /d"	giaxiud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\giaxiud = "C:\\Users\\Admin\\giaxiud.exe /j"	giaxiud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\giaxiud = "C:\\Users\\Admin\\giaxiud.exe /f"	giaxiud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\giaxiud = "C:\\Users\\Admin\\giaxiud.exe /b"	giaxiud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\giaxiud = "C:\\Users\\Admin\\giaxiud.exe /b"	6eaf8f27666e511d620066188ca34760ac44d3241e90554bc5cc696cdea0d88b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\giaxiud = "C:\\Users\\Admin\\giaxiud.exe /l"	giaxiud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\giaxiud = "C:\\Users\\Admin\\giaxiud.exe /g"	giaxiud.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

6eaf8f27666e511d620066188ca34760ac44d3241e90554bc5cc696cdea0d88b.exegiaxiud.exe

pid	process
564	6eaf8f27666e511d620066188ca34760ac44d3241e90554bc5cc696cdea0d88b.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe
1816	giaxiud.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

6eaf8f27666e511d620066188ca34760ac44d3241e90554bc5cc696cdea0d88b.exegiaxiud.exe

pid process

564 6eaf8f27666e511d620066188ca34760ac44d3241e90554bc5cc696cdea0d88b.exe
1816 giaxiud.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6eaf8f27666e511d620066188ca34760ac44d3241e90554bc5cc696cdea0d88b.exe

description	pid	process	target process
PID 564 wrote to memory of 1816	564	6eaf8f27666e511d620066188ca34760ac44d3241e90554bc5cc696cdea0d88b.exe	giaxiud.exe
PID 564 wrote to memory of 1816	564	6eaf8f27666e511d620066188ca34760ac44d3241e90554bc5cc696cdea0d88b.exe	giaxiud.exe
PID 564 wrote to memory of 1816	564	6eaf8f27666e511d620066188ca34760ac44d3241e90554bc5cc696cdea0d88b.exe	giaxiud.exe
PID 564 wrote to memory of 1816	564	6eaf8f27666e511d620066188ca34760ac44d3241e90554bc5cc696cdea0d88b.exe	giaxiud.exe

C:\Users\Admin\AppData\Local\Temp\6eaf8f27666e511d620066188ca34760ac44d3241e90554bc5cc696cdea0d88b.exe
"C:\Users\Admin\AppData\Local\Temp\6eaf8f27666e511d620066188ca34760ac44d3241e90554bc5cc696cdea0d88b.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:564

C:\Users\Admin\giaxiud.exe
"C:\Users\Admin\giaxiud.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\giaxiud.exe

Filesize
248KB

MD5
166bc4ef923150eb4dca4f8ef07d94a6

SHA1
dc587b5a5d42c4fdcb3a68cc821e473cb693500b

SHA256
2b87caf94f41794cbd27aad5426436e7fc0c6aa938064d09ed9f101f0aa40229

SHA512
b8c6befdd88018eba3f500a7f046448b3c4428ffdcb1f5831304c93ce3ad788b1992ca1af16a92e46103e2f89600a7a20203dccfd4b9b2a4ecd10bc8a5ece992

Download Submit
C:\Users\Admin\giaxiud.exe

Filesize
248KB

MD5
166bc4ef923150eb4dca4f8ef07d94a6

SHA1
dc587b5a5d42c4fdcb3a68cc821e473cb693500b

SHA256
2b87caf94f41794cbd27aad5426436e7fc0c6aa938064d09ed9f101f0aa40229

SHA512
b8c6befdd88018eba3f500a7f046448b3c4428ffdcb1f5831304c93ce3ad788b1992ca1af16a92e46103e2f89600a7a20203dccfd4b9b2a4ecd10bc8a5ece992

Download Submit
\Users\Admin\giaxiud.exe

Filesize
248KB

MD5
166bc4ef923150eb4dca4f8ef07d94a6

SHA1
dc587b5a5d42c4fdcb3a68cc821e473cb693500b

SHA256
2b87caf94f41794cbd27aad5426436e7fc0c6aa938064d09ed9f101f0aa40229

SHA512
b8c6befdd88018eba3f500a7f046448b3c4428ffdcb1f5831304c93ce3ad788b1992ca1af16a92e46103e2f89600a7a20203dccfd4b9b2a4ecd10bc8a5ece992

Download Submit
\Users\Admin\giaxiud.exe

Filesize
248KB

MD5
166bc4ef923150eb4dca4f8ef07d94a6

SHA1
dc587b5a5d42c4fdcb3a68cc821e473cb693500b

SHA256
2b87caf94f41794cbd27aad5426436e7fc0c6aa938064d09ed9f101f0aa40229

SHA512
b8c6befdd88018eba3f500a7f046448b3c4428ffdcb1f5831304c93ce3ad788b1992ca1af16a92e46103e2f89600a7a20203dccfd4b9b2a4ecd10bc8a5ece992

Download Submit
memory/564-56-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1816-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads