Analysis

  • max time kernel
    115s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-03-2023 15:51

General

  • Target

    a6d220a60ae00e263d7d48374bdb837f582519348531f45b24a490a57be0cc7f.exe

  • Size

    722KB

  • MD5

    8fbfdf4836a7c846f8d521f0f84f8ac6

  • SHA1

    2cbc9757d41d0ace60a438841332bdc0db918170

  • SHA256

    a6d220a60ae00e263d7d48374bdb837f582519348531f45b24a490a57be0cc7f

  • SHA512

    4d18826ad948a93072bb4462ddf75445bb819e0574a4dd2e9cec5563bed2ffb52cde2b65975f290903df8d76ed5a5a27e3ea9a85967a6ec55fd7b93e130b7797

  • SSDEEP

    12288:3FLdWzxxXQoSku69hsIEeYhYoq0XFkHsd7iVIqN39:nWzbQCucfYhYoqFHsBiVt3

Score
10/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Glary Utilities\English.lng

Ransom Note
[Language] Description= English [Globals] 10001= File 10002= Edit 10003= View 10004= Help 10005= Exit 10006= Stop 10007= Refresh 10008= Properties 10009= Name 10010= Open 10011= Size 10012= OK 10013= Cancel 10014= Close 10015= Yes 10016= No 10017= Browse... 10018= Home Page 10019= About 10020= Export... 10021= Open Folder 10022= Tasks 10023= Help Contents 10024= Next 10025= Back 10026= Options 10027= Description 10028= Finish 10029= Recycle Bin 10030= Add 10031= Remove 10032= Default 10033= Creation Date 10034= Delete 10035= Recommend to friends 10036= Purchase Now 10037= Enter a Registration Code 10038= Menu 10039= Check for Updates 10040= Languages 10041= Are you sure you want to send these selected items to the Recycle Bin? 10043= Some files can't be deleted. Make sure the files are not currently in use and that the disk is not full or write protected. 10044= Warning 10045= Information 10046= Error 10047= Confirmation 10048= Initialization 10050= Recommended 10051= Apply 10052= Tools 10053= The program won't run due to a missing or corrupted file, please try the install again to fix the problem. Click 'Yes' to download the latest version of Glary Utilities. 10055= History 10054= View History 10056= Reset Window Layout 10060= You may need to restart this software for language changes to task effect.{\r\n}Are you sure you want to exit and restart it? 10061= Notify me when new version is available 10062= Automatically update to the latest version 10063= Upgrade to Pro 10070= Will be ignored in %s seconds. [Integrator] 10801= Clean Up & Repair 10802= Optimize & Improve 10803= Privacy & Security 10804= Files & Folders 10805= System Tools 10806= Status 10807= Program Status 10808= Current Version: 10809= Last Update: 10810= Database Date: 10811= License Status 10812= Type: 10813= Free Edition 10814= Professional Edition 10815= Expiration Date: 10816= Never 10817= Register your paid product by clicking the button below. 10818= Register 10819= AutoCare Settings 10799= Modules 10820= Settings 10821= General 10822= Language: 10823= Load Glary Utilities automatically on Windows startup. 10824= Minimize to tray when you close the program window 10825= Context Menu 10826= Select the context menus that you want to integrate into Windows Explorer. 10827= Automatic Update 10828= Execute Web Update at a scheduled time. 10829= Schedule: 10830= Not Available for Free Edition 10831= Change Schedule 10832= Auto Care 10833= Erase privacy tracks on Windows logoff or shutdown. 10834= Privacy Tracks 10835= Select tracks that you want to erase on Windows logoff or shutdown 10836= Automatic 1-Click Maintenance 10837= Execute 1-Click Maintenance at a scheduled time. 10838= Restore Center 10839= Restore Center Protection 10840= Select the modules that you want to have protected by Restore Center here. 10841= Available modules: 10842= Backup Options 10843= Delete backups automatically: 10844= Limit the number of backups to: 10845= Ignore List 10846= After one week 10847= After 2 weeks 10848= After 3 weeks 10849= After one month 10850= After 2 months 10851= After 3 months 10852= Automatic 1-Click Maintenance Options 10853= Only scan for issues 10854= Scan and repair issues 10855= Select tracks you want to erase 10856= Show balloon tips when minimize to tray 10857= Check for updates when program starts 10900= Undo Changes 10901= Manage all your System Restore points(Removing the latest one is disabled for system safety) 10902= System Restore 10903= Create Restore Points 10904= Restore Point creation Failed! System Restore may be disabled on this system, or you do not have the access permissions. 10905= To enable System Restore, perform the following steps: Start Control Panel -> System -> System Restore tab. Clear the "Turn off System Restore on all drives" check box to enable System Restore. Click OK. 10906= Please select a restore point first! 10907= Please save your changes and close any open programs. Windows will restart automatically during the restore process. 10908= Please select a backup first! 10909= Hint 10910= Glary Utilities is still running. 10911= Backups 10912= Are you sure you want to restore %s? 10913= Restored successfully. 10914= New Restore Point was successfully created. 10915= Please select a restore point you'd like to restore to, and then click 'Restore' button. 10916= FAQ 10917= Skins 10918= Portable Version 10919= Emergency Support [License Dialog] 20001= This is a time limited trial version. 20002= You can test the full functionality of the software for %s days without obligation. 20003= If you like the software and would like to use it beyond the test period, click "Order Now". 20004= Test period: day %s of %s2 20005= This trial version has expired. You were able to test the full functionality of the software for %s days. 20006= If you like the software and would like to continue using it, click "Order Now". 20007= Test period expired 20008= Not Registered 20009= Copyright(c) 20010= This product is licensed to: 20011= Warning: This computer program is protected by copyright law and international treaties. Unauthorized reproduction or distribution of this program may result in severe civil and criminal penalties and will be prosecuted to the maximum extent possible under the law. 20012= Web Site 20013= Order Now 20014= Enter Code 20015= Keep Testing 20016= Your name: 20017= Registration code 20018= If you do not have a Registration Code for unlocking this trial version, you can 20019= Order one online. 20020= The registration code you entered is invalid. Please check the code to make sure that it was entered correctly. 20021= Thanks to the following people for their contributions 20022= Upgrade Now! 20023= Please enter your license information 20024= License Type: 20025= To obtain your license, 20026= Home Page: 20027= Upgrade Now 20037= Please enter your name! 20038= License code: 20039= Activate Now 20040= Do not have a license? 20041= Click here to get one. 20042= I lost my license code. 20043= Activate %s Pro Edition 20044= License Name: 20045= Expiration Date: 20046= %s day(s) left 20047= Expired %s day(s) ago 20048= Renew 20049= Export License 20050= Glary Utilities License Manager 20051= E.g. AC6E-D9C6-FAB8-A8C8 20052= License Manager 20053= License information has been successfully saved to: 20054= Click here to buy now 20055= Trial Version 20056= EULA 20057= Privacy Policy 20058= Switch License [Updater] 30000= Check for Update 30001= Unable to retrieve information from %s 30002= Your computer is running the most recent version of %s. No update is available at this time. 30003= You are using %s : %s2. 30004= A newer version of %s is available for download: %s2. Please click "OK" to open a page with download details, or click cancel if you do not want to upgrade at this time. 30005= Updated successfully 30006= Retrieving updated version (%s)... 30007= Retrieving Reference updated file (%s)... 30008= Checking for updates... 30009= Ready 30010= Performing WebUpdate... 30011= Estimated time left: 30012= Transfer Rate: 30013= Unknown 30014= %s sec 30015= %s of %s2 copied 30016= %s/Sec 30017= You have to upgrade to PRO version of %s to use this feature. Upgrade now? 30018= %s is available now. Click this message to install it. 30019= %s min %s2 sec 30020= Retrieving language updated file (%s)... 30021= Version %s available. Update now! 30022= Glary Utilities Update 30023= A new version of Glary Utilities is available! 30024= Glary Utilities %s is now available - you have %s2. Would you like to download the new version now? 30025= Release Notes: 30026= Skip This Version 30027= Remind Me Later 30028= Download 30029= Automatically download updates in the future 30030= Current Version: %s [Context Menu] 40001= Analyze Diskspace with Glary Utilities 40002= Join with Glary Utilities 40003= Split with Glary Utilities 40004= Decrypt with Glary Utilities 40005= Encrypt with Glary Utilities 40006= Shred with Glary Utilities 40007= Find Empty Folders with Glary Utilities 40008= Disk Defrag with Glary Utilities 40009= Defrag the Disk with Glary Utilities 40010= Defrag the Folder with Glary Utilities 40011= Defrag the File with Glary Utilities [Registry Cleaner] 11001= Registry Repair 11901= Clean up your registry to improve your system's performance 11002= Select the sections to scan 11003= Action 11004= Scan registry 11005= Repair your registry 11006= Restore previous repairs 11007= Tools 11008= Your selected issues have been successfully repaired. 11009= Are you sure you want to add the item to the ignore list? This item will not be found again. 11010= The file has been saved to: 11011= Summary of found issues: 11012= 1 issue found 11013= %s issues found 11014= 1 issue selected for repairing 11015= %s issues selected for repairing 11016= No issues found 11017= No issues selected for repairing 11018= (%s issues found) 11019= Analyzing 11020= Section: 11021= Correction: 11022= Open in Regedit 11023= Open this entry in Regedit 11024= Delete this entry 11025= Leave this entry without change 11026= Exclude this entry always(Never find again) 11027= Properties 11028= Open this shortcut properties 11029= Delete this shortcut 11030= Leave this shortcut without change 11031= Scan finished 11032= Repair 11033= Click Repair to solve them automatically or click Close to view details. 11034= Repair finished 11035= Scanning 11036= Repairing 11037= Restore 11038= Please select a backup which you want to restore and click 'Restore' button. 11039= Backup 11040= Are you sure you want to restore %s to the system registry? 11041= %s has been successfully restored into the registry. 11042= The entry %s points to the missing file or folder %s2 11043= This registry key points to missing key %s 11044= This registry key contains no data, it can be deleted. 11045= This registry key points to the missing CLSID %s 11046= This registry key points to the missing icon file %s 11047= The context menu entry %s points to the missing program %s2 11048= This registry is incomplete because the subkey Command is missing. 11049= This registry key is incomplete because it doesn't contain any data that are needed by windows. 11050= This registry key points to the missing InprocServer %s. The associated CLSID can be deleted. 11051= This registry key points to the missing LocalServer32 %s. The associated CLSID can be deleted. 11052= This registry key Points to the missing type library %s 11053= This registry key points to the missing folder %s 11054= The registry key %s contains no data. The associated Type library can be deleted. 11055= This registry key points to the missing file %s 11056= The indicated file %s could not be found. 11057= The file %s that is associated with the entry %s2 doesn't exists. 11058= The entry %s points to the missing help file %s2 11059= Missing shared file %s 11060= The shared file %s is not in use anymore. 11061= This entry ImagePath points to the missing file %s. The associated Services can be deleted. 11062= The entry %s points to the missing file %s2 11063= This shortcut points to the missing target %s 11064= This registry key contains a reference to the Start menu folder %s , which has been removed or deleted. 11065= The entry %s points to the missing program %s2 11066= This uninstall entry doesn't contain any data needed by windows to remove the program or component. 11067= The required uninstall program %s could not be found 11068= The entry %s points to the missing folder %s2 11069= Delete key : 11070= Delete value : 11071= Delete file : 11072= Ignore List Manager 11073= The list of entries are currently being ignored when scanning the Registry. If you want %s to include one of these entries, then remove its checkmark. 11074= Registry Key 11075= Select a destination folder to backup changes made by repairing 11076= Limit the number of backups to: 11077= %s already exists. Do you want to replace it? 11078= Replace 11079= Summary of found issues: (%s issues found, %s2 issues selected for repairing) 11080= Summary of found issues: (1 issue found, 1 issue selected for repairing) 11081= (1 issue found) 11082= Summary of found issues: (No issues found, no issues selected for repairing) 11083= Scanning... 11084= No issues found, no issues selected for repairing. 11085= %s issue found, %s2 issue selected for repairing. 11086= %s issues found, %s2 issues selected for repairing. 11087= Repairing... 11088= Export Registry File 11089= Current key: 11090= Exported key: 11091= %s issue(s) selected for repairing 11092= Exported successfully! 11093= %s issues found, %s2 issues fixed. 11094= %s issue found, %s2 issue fixed. 11095= Today fixed: %s issues, total: %s2 issues. 11096= Today fixed: %s issue, total: %s2 issues. 11097= Today fixed: %s issue, total: %s2 issue. 11098= %s Issues 11099= 1 Issue 11100= No Issues 11101= Please choose at least one item to scan! 11102= Please choose at least one item to clean! 11103= Click 'Scan registry' to scan your registry for issues. 11104= %s issue(s) found, %s2 issue(s) selected for repairing. 11105= %s issues fixed 11106= %s issue fixed 1101001= My Computer 1101002= Registry Integrity 1101003= Adware and Spyware 1101004= Unused Software 1101005= Custom Controls 1101006= File Extensions 1101007= File Associations 1101008= Start Menu 1101009= Startup Programs 1101010= Shared Programs 1101011= Software Locations 1101012= Add/Remove Programs 1101013= Windows Fonts 1101014= Help and Resources 1101015= Sounds and Appevents 1101016= MRU and History Lists 1101017= Device Drivers 1101018= Windows Services 1101019= Virtual Devices 1101020= ARP Cache 1101021= Deep Scan 1101022= Files and Folders 1101023= MUI Cache 1101024= Application Settings 1101027= Missing MUI reference 1102001= Copy Desc 1103001= Delete All [Disk Analysis] 19001= Disk Space Analyzer 19101= Glary Disk Explorer 19901= Display the disk space usage of your files and folders 19003= Explorer 19004= Command Prompt 19005= Delete(to Recycle Bin) 19006= Show Toolbar 19007= Show Statusbar 19008= Show File Types 19009= Show Large Files 19010= Files 19011= Folders 19012= Attribute 19013= Percentage 19014= File Type 19015= Description 19016= File Name 19017= Folder 19018= Modified 19019= Loading File Types... 19020= [Files] 19021= My Computer 19022= Select Drives 19023= All Local Drives 19024= Individual Drives 19025= A Folder 19026= Total Size 19027= Free Space 19028= Used/Total 19029= Select Folder: 1801001= Analyze 1801002= Back 1801003= Computer 1801004= 1801005= Show Extensions 1801006= All Types 1801007= Videos 1801008= Compressed 1801009= Musics 1801010= Images 1801011= Documents 1801012= Other 1801013= Extension 1801014= Number of files 1801016= Type 1801017= Location 1801018= Modified Date 1801019= Free Size 1801020= Toolbar 1801021= Navigation 1801022= Details 1801023= Show All files 1801024= Files and Folders 1801025= Analyze drive now 1801026= Drive has not yet been analyzed. \nBecause the drive has not yet been analyzed, no information regarding disk space usage, file type or the largest files is available, During the analysis, information regarding the selected drives, the files and folders they contain and the disk space usage is collected and displayed. 1801027= Only check this 1801028= File size: 1801029= Total size: 1801030= Accessed on: 1801031= Modified on: 1801032= Created on: 1801033= %s items selected 1801034= Size: 1801035= Total contents 1801036= Unknown 1801037= Used space: 1801038= Analyzed 1801039= Not analyzed 1801040= Expand the folder when it is selected 1801041= Pie Charts 1801042= Other 1801043= Empty 1801044= Forward 1801045= CSV file(*.csv)|*.csv|All Files(*.*)|*.* 1801046= Size on disk 1802001= Finished 1802002= Failed 1802003= Interrupted 1802004= Analysis of your storage locations 1802005= Please wait Disk Analysis finishes analyzing the selected storage locations. 180300

Signatures

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a6d220a60ae00e263d7d48374bdb837f582519348531f45b24a490a57be0cc7f.exe
    "C:\Users\Admin\AppData\Local\Temp\a6d220a60ae00e263d7d48374bdb837f582519348531f45b24a490a57be0cc7f.exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:1476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Glary Utilities\English.lng

    Filesize

    251KB

    MD5

    ae7b8d3bac927d668d252e7d4c42180b

    SHA1

    947a354db2de6178c03f26add2bd0699541d2d43

    SHA256

    3e071527260c0cdb9d5c452420b7704b55211e1cdaa0d5167275ecb15387842f

    SHA512

    1ff7c4b4e1d769b872899b505ac3e9dffded968bc6dee0524a374294bee975e72a68bee186688832693d8ecf9984356b73b0b4883aa97e7fe2085348f418dc3f