Analysis
-
max time kernel
171s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2022 20:58
Static task
static1
Behavioral task
behavioral1
Sample
141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe
-
Size
815KB
-
MD5
25f4e2ca4a326c626cedffc5ccb9c170
-
SHA1
f1bb2121f75f32e32715dee877ef2f3ec5edc1e1
-
SHA256
141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb
-
SHA512
2ed80454d712239519658c2dedbd29b62662cc4c3811cacfe0077bf9f95801708753939dc79a1a8f711dbbb8eae48c2cb37626b0a79725a6a6e31f96d35304c6
-
SSDEEP
12288:52JylsKTOeDQ4dvfLKVOTDPc7IudTc67BmN6IN2Irz0vu+agPh:52JyxqYv5GIQc90InrRoh
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2440 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.mm 2808 GOG.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe" GOG.exe Key created \REGISTRY\MACHINE\SoftWare\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.mm Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe" 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.mm Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SoftWare\Microsoft\Windows\CurrentVersion\Run 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.mm Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe" 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.mm Key created \REGISTRY\MACHINE\SoftWare\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe" GOG.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SoftWare\Microsoft\Windows\CurrentVersion\Run GOG.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened (read-only) \??\B: 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\notification_helper.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\7-Zip\7z.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\GOG.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.mm File opened for modification C:\Windows\GOG.exe 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.mm File created C:\Windows\GOG.exe GOG.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2 GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\WinX = "1" GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\NowCount = "0" GOG.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1692 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe 1692 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe 2808 GOG.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1692 wrote to memory of 2440 1692 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe 76 PID 1692 wrote to memory of 2440 1692 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe 76 PID 1692 wrote to memory of 2440 1692 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe 76 PID 2440 wrote to memory of 2808 2440 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.mm 77 PID 2440 wrote to memory of 2808 2440 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.mm 77 PID 2440 wrote to memory of 2808 2440 141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.mm 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe"C:\Users\Admin\AppData\Local\Temp\141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.mmC:\Users\Admin\AppData\Local\Temp\141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.mm /zhj2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\GOG.exeC:\Windows\GOG.exe /zhj3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2808
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.mm
Filesize768KB
MD513a200e017109016dde150396025f670
SHA12f22fd5c34538c2063b525e7b8e79ea4d38f123e
SHA256637b9bc41c67f62fbbd79a04e0574b7c9d717573e9dd968f1319eacb082d0683
SHA512445b9d02d49b259b0f7e0e1fc2217806b01c17e0f5487f192f4be6c28203602f3fb18d0d154a408daa8fb04ed117646654c18e318cbf7e8f830a4efbb3f37371
-
C:\Users\Admin\AppData\Local\Temp\141351a0635265ff761c5f62865a85bdf8f6e4b5ab09d544414e11354000cafb.mm
Filesize768KB
MD513a200e017109016dde150396025f670
SHA12f22fd5c34538c2063b525e7b8e79ea4d38f123e
SHA256637b9bc41c67f62fbbd79a04e0574b7c9d717573e9dd968f1319eacb082d0683
SHA512445b9d02d49b259b0f7e0e1fc2217806b01c17e0f5487f192f4be6c28203602f3fb18d0d154a408daa8fb04ed117646654c18e318cbf7e8f830a4efbb3f37371
-
Filesize
768KB
MD513a200e017109016dde150396025f670
SHA12f22fd5c34538c2063b525e7b8e79ea4d38f123e
SHA256637b9bc41c67f62fbbd79a04e0574b7c9d717573e9dd968f1319eacb082d0683
SHA512445b9d02d49b259b0f7e0e1fc2217806b01c17e0f5487f192f4be6c28203602f3fb18d0d154a408daa8fb04ed117646654c18e318cbf7e8f830a4efbb3f37371
-
Filesize
768KB
MD513a200e017109016dde150396025f670
SHA12f22fd5c34538c2063b525e7b8e79ea4d38f123e
SHA256637b9bc41c67f62fbbd79a04e0574b7c9d717573e9dd968f1319eacb082d0683
SHA512445b9d02d49b259b0f7e0e1fc2217806b01c17e0f5487f192f4be6c28203602f3fb18d0d154a408daa8fb04ed117646654c18e318cbf7e8f830a4efbb3f37371