Analysis
-
max time kernel
179s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 00:29
Static task
static1
Behavioral task
behavioral1
Sample
c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe
Resource
win10v2004-20220812-en
General
-
Target
c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe
-
Size
140KB
-
MD5
271b8920e3ec5ade31bef4126c0791e2
-
SHA1
929fcb36787fcfd962714dcd4af5b034accb782c
-
SHA256
c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad
-
SHA512
e439e78e4543c8c512f52d09a92c5a8d97fd37154b72850be23a8ed9b5ca699f02dfc2e359f76b87fab9b91ff4ccbc8652c2ebb7414e3327cae3034c72e57b05
-
SSDEEP
768:zHMwyVyt4pd04q0zik+vhy7g0EM/LinbQ+d1:roeEn3+pCg0EUGQ+d1
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
gimip.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" gimip.exe -
Executes dropped EXE 1 IoCs
Processes:
gimip.exepid process 4272 gimip.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe -
Adds Run key to start application 2 TTPs 51 IoCs
Processes:
gimip.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /U" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /A" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /i" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /V" gimip.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /q" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /R" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /d" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /p" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /e" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /t" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /s" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /l" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /J" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /B" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /h" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /X" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /a" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /g" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /m" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /W" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /z" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /C" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /M" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /H" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /P" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /Z" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /E" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /I" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /c" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /K" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /v" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /u" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /G" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /n" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /w" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /b" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /L" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /F" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /o" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /j" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /S" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /r" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /D" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /y" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /x" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /Y" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /f" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /Q" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /O" gimip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gimip = "C:\\Users\\Admin\\gimip.exe /T" gimip.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
gimip.exepid process 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe 4272 gimip.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exegimip.exepid process 3232 c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe 4272 gimip.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exegimip.exedescription pid process target process PID 3232 wrote to memory of 4272 3232 c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe gimip.exe PID 3232 wrote to memory of 4272 3232 c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe gimip.exe PID 3232 wrote to memory of 4272 3232 c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe gimip.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe PID 4272 wrote to memory of 3232 4272 gimip.exe c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe"C:\Users\Admin\AppData\Local\Temp\c43da8aa253b20b3b9b2d646995634f41b7b5d0b013899096dfe8d48b4b4e5ad.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\gimip.exe"C:\Users\Admin\gimip.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\gimip.exeFilesize
140KB
MD529c3b751b224c7a71031ec9dcdb2a56e
SHA1d19c37114b1f8a8e5448497f4cc8e58f27f3674f
SHA25697687bb3ed129a7e506ead5540618f498e367eac64bd782f85837a666a98e2c8
SHA512c0710dfa362caa684789cbe5f3d2648c6917ad0c3c453804586393e1d5d9c7024a3b3f2dbd9273dab40ccb6ce7c7afa8bac7c1595c0f26b805151a3309c2e982
-
C:\Users\Admin\gimip.exeFilesize
140KB
MD529c3b751b224c7a71031ec9dcdb2a56e
SHA1d19c37114b1f8a8e5448497f4cc8e58f27f3674f
SHA25697687bb3ed129a7e506ead5540618f498e367eac64bd782f85837a666a98e2c8
SHA512c0710dfa362caa684789cbe5f3d2648c6917ad0c3c453804586393e1d5d9c7024a3b3f2dbd9273dab40ccb6ce7c7afa8bac7c1595c0f26b805151a3309c2e982
-
memory/4272-134-0x0000000000000000-mapping.dmp