Overview

overview

7

Static

static

1

URLScan

urlscan

1

https://cdn.discorda...

windows10-2004-x64

7

Analysis

  • max time kernel
    113s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-03-2023 01:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://cdn.discordapp.com/attachments/1056524440537661541/1070108074217574530/GalaxyProtector.zip

Score
7/10
agilenet

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 29 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://cdn.discordapp.com/attachments/1056524440537661541/1070108074217574530/GalaxyProtector.zip
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2992
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2992 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1708
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4560
    • C:\Users\Admin\Downloads\New folder\GalaxyProtector.exe
      "C:\Users\Admin\Downloads\New folder\GalaxyProtector.exe"
      1⤵
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:2396
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
      1⤵
        PID:3912

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4VT6R2QM\GalaxyProtector[1].zip
        Filesize

        1.5MB

        MD5

        d1d05ac075309e69934d9a3d65428b7c

        SHA1

        4990a768f0aa4658bdd6bf190e9872eb4a01d0aa

        SHA256

        0809c3983095fa08281661dc6e7e2773a7e926e1c29cc91d542b0842a85dc3cf

        SHA512

        f343adca957f4c510d52db677212fb89c9b2d8b28ec15196f2e77f7b8bc26c6be34ab79d81672cf8a444bf3906c4ed71d0430f869b0b3208293eca8e73a64396

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4VT6R2QM\suggestions[1].en-US
        Filesize

        17KB

        MD5

        5a34cb996293fde2cb7a4ac89587393a

        SHA1

        3c96c993500690d1a77873cd62bc639b3a10653f

        SHA256

        c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

        SHA512

        e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\fe18e516-f12f-4073-bf13-52a839118bfb\GunaDotNetRT.dll
        Filesize

        136KB

        MD5

        9af5eb006bb0bab7f226272d82c896c7

        SHA1

        c2a5bb42a5f08f4dc821be374b700652262308f0

        SHA256

        77dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db

        SHA512

        7badd41be4c1039302fda9bba19d374ec9446ce24b7db33b66bee4ef38180d1abcd666d2aea468e7e452aa1e1565eedfefed582bf1c2fe477a4171d99d48772a

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\fe18e516-f12f-4073-bf13-52a839118bfb\GunaDotNetRT.dll
        Filesize

        136KB

        MD5

        9af5eb006bb0bab7f226272d82c896c7

        SHA1

        c2a5bb42a5f08f4dc821be374b700652262308f0

        SHA256

        77dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db

        SHA512

        7badd41be4c1039302fda9bba19d374ec9446ce24b7db33b66bee4ef38180d1abcd666d2aea468e7e452aa1e1565eedfefed582bf1c2fe477a4171d99d48772a

        Download Submit

      • C:\Users\Admin\Downloads\GalaxyProtector.zip.3unzqnx.partial
        Filesize

        1.5MB

        MD5

        d1d05ac075309e69934d9a3d65428b7c

        SHA1

        4990a768f0aa4658bdd6bf190e9872eb4a01d0aa

        SHA256

        0809c3983095fa08281661dc6e7e2773a7e926e1c29cc91d542b0842a85dc3cf

        SHA512

        f343adca957f4c510d52db677212fb89c9b2d8b28ec15196f2e77f7b8bc26c6be34ab79d81672cf8a444bf3906c4ed71d0430f869b0b3208293eca8e73a64396

        Download Submit

      • memory/2396-166-0x00000000710E0000-0x0000000071117000-memory.dmp

        Filesize

        220KB

        Download

      • memory/2396-167-0x00000000061B0000-0x000000000624C000-memory.dmp

        Filesize

        624KB

        Download

      • memory/2396-155-0x0000000005560000-0x000000000556A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/2396-154-0x00000000055D0000-0x0000000005662000-memory.dmp

        Filesize

        584KB

        Download

      • memory/2396-164-0x00000000733D0000-0x0000000073459000-memory.dmp

        Filesize

        548KB

        Download

      • memory/2396-153-0x0000000005AE0000-0x0000000006084000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/2396-165-0x0000000005730000-0x0000000005740000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2396-156-0x0000000006270000-0x000000000644C000-memory.dmp

        Filesize

        1.9MB

        Download

      • memory/2396-168-0x0000000005730000-0x0000000005740000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2396-152-0x0000000000B80000-0x0000000000B9E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/2396-179-0x0000000005730000-0x0000000005740000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2396-180-0x00000000710E0000-0x0000000071117000-memory.dmp

        Filesize

        220KB

        Download

      • memory/2396-181-0x0000000005730000-0x0000000005740000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2396-182-0x000000000BF60000-0x000000000C07E000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2396-183-0x0000000005730000-0x0000000005740000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2396-184-0x0000000005730000-0x0000000005740000-memory.dmp

        Filesize

        64KB

        Download