Analysis
-
max time kernel
142s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
02-04-2023 19:08
Static task
static1
Behavioral task
behavioral1
Sample
6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe
Resource
win10v2004-20230220-en
General
-
Target
6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe
-
Size
6.8MB
-
MD5
8286e5426d7fb79fd9a3e896d1e74351
-
SHA1
c88d3c7fca6c0f162677e01e367f6321074b9dc8
-
SHA256
6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946
-
SHA512
d4143baf1a4a0496ce33aacbe486d3b168c20eeba94471b55fd8c3fbab2aa688983e5338bff49352c21f1f364d036f36f11e772d11bb731a2b98d19baab3cbfb
-
SSDEEP
196608:bANEZb+3LHEI9GJyN0hs2g+V9VvRJlxwXb+I63TYS:b5abkI9GlRzvTX
Malware Config
Signatures
-
Processes:
resource yara_rule C:\Windows\SysWOW64\apimsw9w.dll aspack_v212_v242 C:\Windows\SysWOW64\apimsw9w.dll aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe -
Executes dropped EXE 1 IoCs
Processes:
setgshi.exepid process 3308 setgshi.exe -
Loads dropped DLL 1 IoCs
Processes:
setgshi.exepid process 3308 setgshi.exe -
Drops file in System32 directory 28 IoCs
Processes:
6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exedescription ioc process File opened for modification C:\Windows\SysWOW64\$GONGSI\T0002 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe File created C:\Windows\SysWOW64\$GONGSI\T0002\dlls\tdxdll58.dll 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe File created C:\Windows\SysWOW64\$GONGSI\运行本程序 添加自己的指标.exe 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe File opened for modification C:\Windows\SysWOW64\$GONGSI\运行本程序 添加自己的指标.exe 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe File opened for modification C:\Windows\SysWOW64\apimsw9w.dll 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe File opened for modification C:\Windows\SysWOW64\$GONGSI\T0002\dlls 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe File created C:\Windows\SysWOW64\tdxwjm0.dll 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe File created C:\Windows\SysWOW64\zjintd31.exe 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe File opened for modification C:\Windows\SysWOW64\$GONGSI\T0002\dlls\tdxdll58.dll 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe File opened for modification C:\Windows\SysWOW64\$GONGSI\T0002\dlls\tdxdll68.dll 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe File created C:\Windows\SysWOW64\$GONGSI\TPoolRun.dll 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe File created C:\Windows\SysWOW64\apimsw9w.dll 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe File opened for modification C:\Windows\SysWOW64\zjintd31.exe 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe File opened for modification C:\Windows\SysWOW64\SetGshi.exe 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe File created C:\Windows\SysWOW64\$GONGSI\T0002\dlls\tdxdll68.dll 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe File created C:\Windows\SysWOW64\$GONGSI\tdxwjm.dat 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe File created C:\Windows\SysWOW64\SetGshi.exe 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe File created C:\Windows\SysWOW64\zjintd31.dll 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe File opened for modification C:\Windows\SysWOW64\$GONGSI\T0002\dlls\Jmi8.ini 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe File opened for modification C:\Windows\SysWOW64\$GONGSI 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe File opened for modification C:\Windows\SysWOW64\$GONGSI\tdxwjm.dat 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe File opened for modification C:\Windows\SysWOW64\tdxwjm0.dll 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe File opened for modification C:\Windows\SysWOW64\Win73c31.exe 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe File created C:\Windows\SysWOW64\__tmp_rar_sfx_access_check_240552500 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe File created C:\Windows\SysWOW64\$GONGSI\T0002\dlls\Jmi8.ini 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe File opened for modification C:\Windows\SysWOW64\$GONGSI\TPoolRun.dll 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe File created C:\Windows\SysWOW64\Win73c31.exe 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe File opened for modification C:\Windows\SysWOW64\zjintd31.dll 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 3 IoCs
Processes:
setgshi.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" setgshi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key setgshi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ setgshi.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
setgshi.exepid process 3308 setgshi.exe 3308 setgshi.exe 3308 setgshi.exe 3308 setgshi.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exedescription pid process target process PID 3644 wrote to memory of 3308 3644 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe setgshi.exe PID 3644 wrote to memory of 3308 3644 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe setgshi.exe PID 3644 wrote to memory of 3308 3644 6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe setgshi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe"C:\Users\Admin\AppData\Local\Temp\6c8f19c4db622e70dddace4fe95112275e8ebd42b5289938129f7e31a7011946.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\SysWOW64\setgshi.exe"C:\Windows\system32\setgshi.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3308
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\SetGshi.exeFilesize
486KB
MD5efa5b544e085e48a6bb3e3f7025f6e16
SHA13cb658c0f08c1f22869896f15e787723a6e542d5
SHA256578603fdb12edb4d89394a2a839065b26ff41b763e2ce86b65b85440871a6bc8
SHA512abdd5966721b68be11e7c58a6f668f266227b6325d93009f8c9ba7870ec0471fbb2008980a6155f72812958ed0c41a1cf2f28c0fc730119dd1de6f2be8e54c1c
-
C:\Windows\SysWOW64\SetGshi.exeFilesize
486KB
MD5efa5b544e085e48a6bb3e3f7025f6e16
SHA13cb658c0f08c1f22869896f15e787723a6e542d5
SHA256578603fdb12edb4d89394a2a839065b26ff41b763e2ce86b65b85440871a6bc8
SHA512abdd5966721b68be11e7c58a6f668f266227b6325d93009f8c9ba7870ec0471fbb2008980a6155f72812958ed0c41a1cf2f28c0fc730119dd1de6f2be8e54c1c
-
C:\Windows\SysWOW64\apimsw9w.dllFilesize
1.3MB
MD5ad1e75ce559f189ec7dcd915e831865d
SHA1ae976b1dd13f9b43f533cd9195d35f947f8f200a
SHA256d1ef226f9f603a3e486bd0d428e09178c482b907c647934da597771a7f4c2072
SHA512e6e631ea5d9e4d251bfc3f05acd7430bfdc870eea82a8f382a1a98b49def4f506ba5fe1575ed1a14984a1fcc12b1663b610c2c048d18134db6edc7c62df2d238
-
C:\Windows\SysWOW64\apimsw9w.dllFilesize
1.3MB
MD5ad1e75ce559f189ec7dcd915e831865d
SHA1ae976b1dd13f9b43f533cd9195d35f947f8f200a
SHA256d1ef226f9f603a3e486bd0d428e09178c482b907c647934da597771a7f4c2072
SHA512e6e631ea5d9e4d251bfc3f05acd7430bfdc870eea82a8f382a1a98b49def4f506ba5fe1575ed1a14984a1fcc12b1663b610c2c048d18134db6edc7c62df2d238
-
C:\Windows\SysWOW64\setgshi.exeFilesize
486KB
MD5efa5b544e085e48a6bb3e3f7025f6e16
SHA13cb658c0f08c1f22869896f15e787723a6e542d5
SHA256578603fdb12edb4d89394a2a839065b26ff41b763e2ce86b65b85440871a6bc8
SHA512abdd5966721b68be11e7c58a6f668f266227b6325d93009f8c9ba7870ec0471fbb2008980a6155f72812958ed0c41a1cf2f28c0fc730119dd1de6f2be8e54c1c
-
memory/3308-169-0x0000000074540000-0x0000000074795000-memory.dmpFilesize
2.3MB
-
memory/3308-170-0x00000000023D0000-0x00000000023D4000-memory.dmpFilesize
16KB
-
memory/3308-172-0x00000000022C0000-0x00000000022C1000-memory.dmpFilesize
4KB
-
memory/3308-171-0x00000000023C0000-0x00000000023C1000-memory.dmpFilesize
4KB
-
memory/3308-176-0x0000000074540000-0x0000000074795000-memory.dmpFilesize
2.3MB
-
memory/3308-186-0x0000000074540000-0x0000000074795000-memory.dmpFilesize
2.3MB