Overview

overview

6

Static

static

1

GShade.Lat....0.exe

windows10-1703-x64

6

GShade.Lat....0.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    54s
  • max time network
    71s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    10/03/2023, 01:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    GShade.Latest.Installer.4.2.0.exe

  • Size

    77.4MB

  • MD5

    c9ea433522ee7b9fa521695d28d3b4fd

  • SHA1

    24b7e4c70cfb2701f90a2d0571e0653dcbb41c25

  • SHA256

    1d4c67cf85449b00f9e3cb68f33815c44bc1608a245906abb0cdd80323e058ce

  • SHA512

    337247d2b953de4868dbf27d36f4d445a7539399d9ee0f8cf96cd0d0321844ed24241b3f4cd5ed4ea28f44bec32b927e32b52ac941a1ee816ee856e2e72fb223

  • SSDEEP

    1572864:MawxkUmf/ekbyeADRvjf6ZPreVttprMUFsmwez8gq08eHxzgUvPdh4r:Mawxkjf1byFpjf6xrAtQUFsLi8RyxUw2

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 34 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GShade.Latest.Installer.4.2.0.exe
    "C:\Users\Admin\AppData\Local\Temp\GShade.Latest.Installer.4.2.0.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3960

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
    Filesize

    14KB

    MD5

    4af5c29b31964d610a267e44e21a5d33

    SHA1

    b8d5c7e40510d311b99b8770aa95c8f2e1ce6232

    SHA256

    56328d644b18dcf72c96523efa04a7d250cc8f00750ab3096b8115c3d76fb4a3

    SHA512

    705ecee815ae3af8ace817725f5e738f2030d87777cf5c0d714e98c3eabd06a4d3d0627e6e5befc635259c2c41e7642d1eb8c661f84f71518c8f219a665c0da5

    Download Submit

  • memory/3960-126-0x000001FD6F280000-0x000001FD6F290000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3960-117-0x000001FD6F280000-0x000001FD6F290000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3960-119-0x000001FD6F360000-0x000001FD6F368000-memory.dmp

    Filesize

    32KB

    Download

  • memory/3960-116-0x000001FD6A1A0000-0x000001FD6EF14000-memory.dmp

    Filesize

    77.5MB

    Download

  • memory/3960-121-0x000001FD6F280000-0x000001FD6F290000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3960-122-0x000001FD6F280000-0x000001FD6F290000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3960-123-0x000001FD6F280000-0x000001FD6F290000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3960-124-0x000001FD6F280000-0x000001FD6F290000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3960-118-0x000001FD6F280000-0x000001FD6F290000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3960-125-0x000001FD6F280000-0x000001FD6F290000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3960-120-0x000001FD71510000-0x000001FD71548000-memory.dmp

    Filesize

    224KB

    Download

  • memory/3960-133-0x000001FD747F0000-0x000001FD747FE000-memory.dmp

    Filesize

    56KB

    Download

  • memory/3960-134-0x000001FD6F280000-0x000001FD6F290000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3960-135-0x000001FD6F280000-0x000001FD6F290000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3960-136-0x000001FD79730000-0x000001FD79857000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/3960-137-0x000001FD6F280000-0x000001FD6F290000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3960-139-0x000001FD6F280000-0x000001FD6F290000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3960-140-0x000001FD6F280000-0x000001FD6F290000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3960-142-0x000001FD79730000-0x000001FD79857000-memory.dmp

    Filesize

    1.2MB

    Download