Analysis
-
max time kernel
150s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
11/06/2023, 17:43
General
-
Target
Ghostexp.exe
-
Size
3.5MB
-
MD5
e4363df308bd8b81c687412e2314e872
-
SHA1
4d83035b60bc224724e0c5a5192113ae5cd56b99
-
SHA256
843ca5a3bb763223ea854cd0f748081510cab7c4538cd93d0d1d24f0b5aebdc6
-
SHA512
6f7a11dc6d8462899c8071cfe028810d7f1e1b7d8d7fa03d76eb11d4a921fc51d189074c6a20d2ffbb45f2cc9584f19c0345364e6cfd5ae0215c8ed2133e844e
-
SSDEEP
98304:H9Sr7B6eEtduW/bC+1TzAoEZUI4A0AFKiNkTPAQ:dS/keEtduW/REZU8nF6TPH
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ghostexp.exe"C:\Users\Admin\AppData\Local\Temp\Ghostexp.exe"1⤵
- Enumerates connected drives
- Maps connected drives based on registry
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx