Analysis
-
max time kernel
75s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
31-01-2023 21:23
Static task
static1
Behavioral task
behavioral1
Sample
GxMBK.exe
Resource
win7-20221111-en
General
-
Target
GxMBK.exe
-
Size
1.6MB
-
MD5
049b7a8f84d8c8e7932bfc6e97362c30
-
SHA1
f3d85b5214062a92ecacd0a65e02593e44ab188a
-
SHA256
2716cfd0d3479d42e903bd0c835b91fd5918a02fb63bdc1b52f73921bf4b307a
-
SHA512
eb0c58f723a9c6a2d3d29b10f89538845cfbdaa2d4579de4238a0753050154dacc7832cc20f858b757fd6a2e491b5f775262f670309b7691437910c59a106924
-
SSDEEP
24576:bYO8wJFOtz7uuqEP+1MoIpgpgi2esTTPfQHSvMYdihbjct3sP8ZS3pdWMhLaw:koqAI4sTTP4smZ58wl
Malware Config
Extracted
xworm
127.0.0.1:7000
TU53fgvTBLouBDSy
-
install_file
USB.exe
Signatures
-
Drops startup file 1 IoCs
Processes:
GxMBK.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%startupname%.lnk GxMBK.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
GxMBK.exedescription pid process target process PID 1652 set thread context of 1240 1652 GxMBK.exe schtasks.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "381968771" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DB7D83F1-A1B5-11ED-8487-72F0FB4431DC} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0a4e2b4c235d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af00000000020000000000106600000001000020000000f68041f67ab93fc2861b84aae098de7a58ede08c95eb5160494cbac710104b7c000000000e80000000020000200000005518a3dd6deb6fcd88af4bbc390ccb76282a3992d8e9b248320b87b8d4e490d49000000072f88bc3e492a92cca55c13ce5fe3a2470fbfd020e038c7491b46568d7e3090e9891c69e65ac2d85b16ae3501969f31279a880651e32e0c2f2060ba16f719747b91db61fa21b006d9440cbe418d5de132145c4a613e35478b968ebf39f0a2fd12d52f1d1d5c1dba0a0aa4e0b2e7959c9947f65d6a6e2a9fab261657fd87e3ccf84faba92f975435e8dcc77091a0f7bd440000000a242cd7a7ad538eb2a684a888b1fd1e22920ce1fb57fcfe5b3bfe5d84cfa34ad639175a4faea0b26a2ecd58251d57ba0bb7075588c46d315f50e34f270c93381 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af00000000020000000000106600000001000020000000ba36434860b40e057f125c515b8f96074ecbf84f030b6353994eccb0eb2bd18e000000000e8000000002000020000000efde53a6d7993023547b1a5c417ab4fefa7e1dfd59adab65ba2e1c267cd913d2200000000ebb33eeeb2f8900cdf78f44432c1fc1a701aaeb4f003b697a382ce27664dced40000000945251b1e8bb499a27fa045fc07b3b6dd2012cc126823db23a73f5d184abc76c783f4c8c094b3d931ef6b08d38a524ae97d2cd628b4209f3e40b549be0ddf395 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1172 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1172 iexplore.exe 1172 iexplore.exe 1736 IEXPLORE.EXE 1736 IEXPLORE.EXE 1736 IEXPLORE.EXE 1736 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
GxMBK.exeschtasks.exeiexplore.exedescription pid process target process PID 1652 wrote to memory of 1240 1652 GxMBK.exe schtasks.exe PID 1652 wrote to memory of 1240 1652 GxMBK.exe schtasks.exe PID 1652 wrote to memory of 1240 1652 GxMBK.exe schtasks.exe PID 1652 wrote to memory of 1240 1652 GxMBK.exe schtasks.exe PID 1652 wrote to memory of 1240 1652 GxMBK.exe schtasks.exe PID 1652 wrote to memory of 1240 1652 GxMBK.exe schtasks.exe PID 1652 wrote to memory of 1240 1652 GxMBK.exe schtasks.exe PID 1652 wrote to memory of 1240 1652 GxMBK.exe schtasks.exe PID 1652 wrote to memory of 1240 1652 GxMBK.exe schtasks.exe PID 1240 wrote to memory of 1172 1240 schtasks.exe iexplore.exe PID 1240 wrote to memory of 1172 1240 schtasks.exe iexplore.exe PID 1240 wrote to memory of 1172 1240 schtasks.exe iexplore.exe PID 1240 wrote to memory of 1172 1240 schtasks.exe iexplore.exe PID 1172 wrote to memory of 1736 1172 iexplore.exe IEXPLORE.EXE PID 1172 wrote to memory of 1736 1172 iexplore.exe IEXPLORE.EXE PID 1172 wrote to memory of 1736 1172 iexplore.exe IEXPLORE.EXE PID 1172 wrote to memory of 1736 1172 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\GxMBK.exe"C:\Users\Admin\AppData\Local\Temp\GxMBK.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=schtasks.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.03⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1172 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\1VLOML3M.txtFilesize
604B
MD529a278a050def85ef3f2f9e16581e8b5
SHA16d5acf02a9b25951dac25273e734c5ac4edf558e
SHA2568c2077f840485434e905af03d8c9380c48e283561e1c2a7968f25ef71ceea4bd
SHA512feeef1971a0f6fb6669b5965657d2bfaf5de631aadfdc60c67a15aee5d98fd1151622a090f0bbd4f738008cf6946a32f028b116db5b7f85c328d9f68f96f5a19
-
memory/1240-57-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/1240-58-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/1240-60-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/1240-61-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/1240-63-0x000000000040BFCE-mapping.dmp
-
memory/1240-62-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/1240-65-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/1240-67-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/1652-54-0x0000000001310000-0x00000000014A8000-memory.dmpFilesize
1.6MB
-
memory/1652-55-0x0000000074FD1000-0x0000000074FD3000-memory.dmpFilesize
8KB
-
memory/1652-56-0x0000000005630000-0x000000000576C000-memory.dmpFilesize
1.2MB