gink | 7ae1959c0b1ca54cd7e79ffe6cb0fa62204711c7f9255bab69f8e8574172b33d

Analysis

max time kernel
14s
max time network
18s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2023, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
95fc0e1f3789aab9540731d8c9e1bd7533dc4795.exe
Size 37KB
Sample230502-cfgyeshd48
SHA256 7ae1959c0b1ca54cd7e79ffe6cb0fa62204711c7f9255bab69f8e8574172b33d
MD5 cf25c08d7ad94ffb0e37f894e8b46fc2
SHA1 95fc0e1f3789aab9540731d8c9e1bd7533dc4795
SHA512 b07d352927188fe56325320f5e857b965f9e8607c74f0503ef5d577d1eee951b30b4277544b58c1248bcefe9e16989257aaab424d83c6497e02cebff822ae2b6
SSDEEP 384:F5m90NlBpLeFH5/xSEOReuEEXVYnhl8/odXgreebEnI8YJ:FXdiP7OR/V0M/odY2I8A
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gink persistence worm

Malware Config

Signatures

Gink
worm gink

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\I-Worm.GiGu = "uGiG.eXe"	95fc0e1f3789aab9540731d8c9e1bd7533dc4795.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\GiGu.eml	95fc0e1f3789aab9540731d8c9e1bd7533dc4795.exe
File created	C:\Windows\SysWOW64\GiGu.eXe	95fc0e1f3789aab9540731d8c9e1bd7533dc4795.exe
File opened for modification	C:\Windows\SysWOW64\GiGu.eXe	95fc0e1f3789aab9540731d8c9e1bd7533dc4795.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\uGiG.eXe	95fc0e1f3789aab9540731d8c9e1bd7533dc4795.exe
File opened for modification	C:\Windows\uGiG.eXe	95fc0e1f3789aab9540731d8c9e1bd7533dc4795.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2296	1504	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1504	95fc0e1f3789aab9540731d8c9e1bd7533dc4795.exe
1504	95fc0e1f3789aab9540731d8c9e1bd7533dc4795.exe

C:\Users\Admin\AppData\Local\Temp\95fc0e1f3789aab9540731d8c9e1bd7533dc4795.exe
"C:\Users\Admin\AppData\Local\Temp\95fc0e1f3789aab9540731d8c9e1bd7533dc4795.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 516
  2⤵
  - Program crash
  PID:2296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1504 -ip 1504
1⤵
PID:1540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1504-133-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/1504-140-0x0000000000400000-0x0000000000409000-memory.dmp

Download