Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 15:05
Behavioral task
behavioral1
Sample
g2ax_customer_combined_dll_core_win32_x86_1702.exe/g2ax_customer_combined_dll_core_win32_x86_1702.exe
Resource
win7-20230831-en
General
-
Target
g2ax_customer_combined_dll_core_win32_x86_1702.exe/g2ax_customer_combined_dll_core_win32_x86_1702.exe
-
Size
3.4MB
-
MD5
47dd7fd5a31e542a33370735ee773b70
-
SHA1
69f7ea69774d8d092f9c99f477ce413c7d012c69
-
SHA256
a5c4f0f95a4c39b8be185a9c92c4496a9aaf95dfa4742626089fac050cb260ab
-
SHA512
db8582323aded3ae442f2c113c0d8a8f367f670e7b546ea0de64b90fb75fb0ec94586bb1362d03fa093baffb6f753398b43ec4421fd51c48f0c1162f48f76e22
-
SSDEEP
98304:9F+gOav+DsMSsP/j48tpg+iESjTaGe4OW:9F+gpv+DPP/k+k/aho
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/3800-0-0x0000000000400000-0x00000000021EA000-memory.dmp upx behavioral2/memory/3800-45-0x0000000000400000-0x00000000021EA000-memory.dmp upx -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA g2ax_customer_combined_dll_core_win32_x86_1702.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA g2ax_installer_customer.exe -
Executes dropped EXE 5 IoCs
pid Process 396 g2ax_installer_customer.exe 5052 g2ax_service.exe 1500 g2ax_comm_customer.exe 724 g2ax_system_customer.exe 2260 g2ax_user_customer.exe -
Loads dropped DLL 5 IoCs
pid Process 396 g2ax_installer_customer.exe 5052 g2ax_service.exe 1500 g2ax_comm_customer.exe 724 g2ax_system_customer.exe 2260 g2ax_user_customer.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1500 g2ax_comm_customer.exe 1500 g2ax_comm_customer.exe 724 g2ax_system_customer.exe 724 g2ax_system_customer.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeBackupPrivilege 2260 g2ax_user_customer.exe Token: SeBackupPrivilege 2260 g2ax_user_customer.exe Token: SeBackupPrivilege 2260 g2ax_user_customer.exe Token: SeBackupPrivilege 2260 g2ax_user_customer.exe Token: SeBackupPrivilege 2260 g2ax_user_customer.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe -
Suspicious use of SendNotifyMessage 34 IoCs
pid Process 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe 2260 g2ax_user_customer.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3800 wrote to memory of 396 3800 g2ax_customer_combined_dll_core_win32_x86_1702.exe 82 PID 3800 wrote to memory of 396 3800 g2ax_customer_combined_dll_core_win32_x86_1702.exe 82 PID 3800 wrote to memory of 396 3800 g2ax_customer_combined_dll_core_win32_x86_1702.exe 82 PID 396 wrote to memory of 5052 396 g2ax_installer_customer.exe 83 PID 396 wrote to memory of 5052 396 g2ax_installer_customer.exe 83 PID 396 wrote to memory of 5052 396 g2ax_installer_customer.exe 83 PID 5052 wrote to memory of 1500 5052 g2ax_service.exe 85 PID 5052 wrote to memory of 1500 5052 g2ax_service.exe 85 PID 5052 wrote to memory of 1500 5052 g2ax_service.exe 85 PID 1500 wrote to memory of 724 1500 g2ax_comm_customer.exe 89 PID 1500 wrote to memory of 724 1500 g2ax_comm_customer.exe 89 PID 1500 wrote to memory of 724 1500 g2ax_comm_customer.exe 89 PID 1500 wrote to memory of 2260 1500 g2ax_comm_customer.exe 90 PID 1500 wrote to memory of 2260 1500 g2ax_comm_customer.exe 90 PID 1500 wrote to memory of 2260 1500 g2ax_comm_customer.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\g2ax_customer_combined_dll_core_win32_x86_1702.exe\g2ax_customer_combined_dll_core_win32_x86_1702.exe"C:\Users\Admin\AppData\Local\Temp\g2ax_customer_combined_dll_core_win32_x86_1702.exe\g2ax_customer_combined_dll_core_win32_x86_1702.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_installer_customer.exe"C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_installer_customer.exe " "/LoaderPath C:\Users\Admin\AppData\Local\Temp\g2ax_customer_combined_dll_core_win32_x86_1702.exe\g2ax_customer_combined_dll_core_win32_x86_1702.exe" "/LogPath C:\Users\Admin\AppData\Local\Temp\LogMeInLogs\GoToAssist Remote Support Customer\1702\20231016_092019\" "/RestartReason Start"2⤵
- Checks whether UAC is enabled
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_service.exe"C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_service.exe" "Start=start_session&LoaderPath=C:\Users\Admin\AppData\Local\Temp\g2ax_customer_combined_dll_core_win32_x86_1702.exe\g2ax_customer_combined_dll_core_win32_x86_1702.exe&LogPath=C:\Users\Admin\AppData\Local\Temp\LogMeInLogs\GoToAssist Remote Support Customer\1702\20231016_092019\&ResourceDll=g2ax_customer_resource_win32_x86_en_US.dll&RestartReason=Start"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_comm_customer.exe"C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_comm_customer.exe" "LoaderPath=C:\Users\Admin\AppData\Local\Temp\g2ax_customer_combined_dll_core_win32_x86_1702.exe\g2ax_customer_combined_dll_core_win32_x86_1702.exe&LogName=C:\Users\Admin\AppData\Local\Temp\LogMeInLogs\GoToAssist Remote Support Customer\1702\20231016_092019\GoToAssist Remote Support Customer.LOG&LogPath=C:\Users\Admin\AppData\Local\Temp\LogMeInLogs\GoToAssist Remote Support Customer\1702\20231016_092019\&ResourceDll=g2ax_customer_resource_win32_x86_en_US.dll&RestartReason=Start&Start=start_session&StartID={A0C8A51A-656E-4752-A7A1-51E0A4B9C872}&UniqueId=5052"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_system_customer.exe"C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_system_customer.exe" "StartID={6F67A8FB-734D-4D5A-969D-23256C524F2C}&ResourceDll=g2ax_customer_resource_win32_x86_en_US.dll&Debug=Off&Stat=On&StatDb=On&Index=0"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:724
-
-
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_user_customer.exe"C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_user_customer.exe" "StartID={3968F4AF-486D-4109-937D-DE909EE62224}&ResourceDll=g2ax_customer_resource_win32_x86_en_US.dll&Debug=Off&Stat=Off&StatDb=Off&Index=0"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2260
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_combined_customer.dll
Filesize9.0MB
MD5964be191e1c43fc58c4ac16c52813d1e
SHA1c2d3989d189e69aa5fa5d58d8987440b8a1250a6
SHA2564132e3cb933b77687e959b2dc793072508c72e3b30e0cb9269d898be3a5d1cf9
SHA512dfce2387ce74549a82422c98f07582417b7d9c7cc6d0014740c9602b37b5411cb9f0025bd92d762aa1c80b3f38620f959bc97dedf12cf0d6c0c1d7fcc22171ba
-
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_combined_customer.dll
Filesize9.0MB
MD5964be191e1c43fc58c4ac16c52813d1e
SHA1c2d3989d189e69aa5fa5d58d8987440b8a1250a6
SHA2564132e3cb933b77687e959b2dc793072508c72e3b30e0cb9269d898be3a5d1cf9
SHA512dfce2387ce74549a82422c98f07582417b7d9c7cc6d0014740c9602b37b5411cb9f0025bd92d762aa1c80b3f38620f959bc97dedf12cf0d6c0c1d7fcc22171ba
-
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_combined_customer.dll
Filesize9.0MB
MD5964be191e1c43fc58c4ac16c52813d1e
SHA1c2d3989d189e69aa5fa5d58d8987440b8a1250a6
SHA2564132e3cb933b77687e959b2dc793072508c72e3b30e0cb9269d898be3a5d1cf9
SHA512dfce2387ce74549a82422c98f07582417b7d9c7cc6d0014740c9602b37b5411cb9f0025bd92d762aa1c80b3f38620f959bc97dedf12cf0d6c0c1d7fcc22171ba
-
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_combined_customer.dll
Filesize9.0MB
MD5964be191e1c43fc58c4ac16c52813d1e
SHA1c2d3989d189e69aa5fa5d58d8987440b8a1250a6
SHA2564132e3cb933b77687e959b2dc793072508c72e3b30e0cb9269d898be3a5d1cf9
SHA512dfce2387ce74549a82422c98f07582417b7d9c7cc6d0014740c9602b37b5411cb9f0025bd92d762aa1c80b3f38620f959bc97dedf12cf0d6c0c1d7fcc22171ba
-
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_combined_customer.dll
Filesize9.0MB
MD5964be191e1c43fc58c4ac16c52813d1e
SHA1c2d3989d189e69aa5fa5d58d8987440b8a1250a6
SHA2564132e3cb933b77687e959b2dc793072508c72e3b30e0cb9269d898be3a5d1cf9
SHA512dfce2387ce74549a82422c98f07582417b7d9c7cc6d0014740c9602b37b5411cb9f0025bd92d762aa1c80b3f38620f959bc97dedf12cf0d6c0c1d7fcc22171ba
-
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_combined_customer.dll
Filesize9.0MB
MD5964be191e1c43fc58c4ac16c52813d1e
SHA1c2d3989d189e69aa5fa5d58d8987440b8a1250a6
SHA2564132e3cb933b77687e959b2dc793072508c72e3b30e0cb9269d898be3a5d1cf9
SHA512dfce2387ce74549a82422c98f07582417b7d9c7cc6d0014740c9602b37b5411cb9f0025bd92d762aa1c80b3f38620f959bc97dedf12cf0d6c0c1d7fcc22171ba
-
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_comm_customer.exe
Filesize600KB
MD515c57e910e06ea93d4e656caf03572f6
SHA14e9a3d244ce5e49bfb3edfd6ef46a705e70620ca
SHA256ffba9b24bf1a767cb93e825f610848b66e5f5b4c03c1a519acb63cc5db4d0f06
SHA512e18fe7323def774af969dd197c42e5c97432a0ec67f530187162d5dbc2bb45844cafc70fba8f62ad3b85a27ac0c6f19d1d614504f2f277eb32fe3367c3af46b5
-
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_customer_resource_win32_x86_en_US.dll
Filesize2.7MB
MD527762d80c021793b1d3713fdb88614c8
SHA1043876b9f63a3c17dff9ff7515500e35794b8513
SHA256996dfbc2e8ea4391218a4cb27900ebfdc5801b5ee200e499b687a5903b7f7d5b
SHA512dfd3a727a7ee9ebd79cfbf6018836d1b77edc58ca394c13767cf56cda3758f315ae8592ff02714f271c0e8dbdb2cb9e5c3146231274dcaa5872da3e133cf52e8
-
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_installer_customer.exe
Filesize600KB
MD515c57e910e06ea93d4e656caf03572f6
SHA14e9a3d244ce5e49bfb3edfd6ef46a705e70620ca
SHA256ffba9b24bf1a767cb93e825f610848b66e5f5b4c03c1a519acb63cc5db4d0f06
SHA512e18fe7323def774af969dd197c42e5c97432a0ec67f530187162d5dbc2bb45844cafc70fba8f62ad3b85a27ac0c6f19d1d614504f2f277eb32fe3367c3af46b5
-
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_installer_customer.exe
Filesize600KB
MD515c57e910e06ea93d4e656caf03572f6
SHA14e9a3d244ce5e49bfb3edfd6ef46a705e70620ca
SHA256ffba9b24bf1a767cb93e825f610848b66e5f5b4c03c1a519acb63cc5db4d0f06
SHA512e18fe7323def774af969dd197c42e5c97432a0ec67f530187162d5dbc2bb45844cafc70fba8f62ad3b85a27ac0c6f19d1d614504f2f277eb32fe3367c3af46b5
-
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_installer_customer_admin.exe
Filesize600KB
MD5a0a484d638133fbd4a93dea4ec110162
SHA1df3ca26da53addd894f0bf5dfac8f505ba1807af
SHA256558a9e31b8c8269afe4a20e52367fc70f2487412a8a28bf5959c1bd10b53891d
SHA51269b35ab8a860514ab520f1783a822be0be63bd940802c3649790c4ecc0599a404420d0efed204127df2a98eefee9ec3498f5c8d7bc9ce9102d4996de51d0f3f4
-
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_service.exe
Filesize600KB
MD515c57e910e06ea93d4e656caf03572f6
SHA14e9a3d244ce5e49bfb3edfd6ef46a705e70620ca
SHA256ffba9b24bf1a767cb93e825f610848b66e5f5b4c03c1a519acb63cc5db4d0f06
SHA512e18fe7323def774af969dd197c42e5c97432a0ec67f530187162d5dbc2bb45844cafc70fba8f62ad3b85a27ac0c6f19d1d614504f2f277eb32fe3367c3af46b5
-
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_system_customer.exe
Filesize600KB
MD515c57e910e06ea93d4e656caf03572f6
SHA14e9a3d244ce5e49bfb3edfd6ef46a705e70620ca
SHA256ffba9b24bf1a767cb93e825f610848b66e5f5b4c03c1a519acb63cc5db4d0f06
SHA512e18fe7323def774af969dd197c42e5c97432a0ec67f530187162d5dbc2bb45844cafc70fba8f62ad3b85a27ac0c6f19d1d614504f2f277eb32fe3367c3af46b5
-
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_user_customer.exe
Filesize600KB
MD515c57e910e06ea93d4e656caf03572f6
SHA14e9a3d244ce5e49bfb3edfd6ef46a705e70620ca
SHA256ffba9b24bf1a767cb93e825f610848b66e5f5b4c03c1a519acb63cc5db4d0f06
SHA512e18fe7323def774af969dd197c42e5c97432a0ec67f530187162d5dbc2bb45844cafc70fba8f62ad3b85a27ac0c6f19d1d614504f2f277eb32fe3367c3af46b5
-
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_user_customer.exe
Filesize600KB
MD515c57e910e06ea93d4e656caf03572f6
SHA14e9a3d244ce5e49bfb3edfd6ef46a705e70620ca
SHA256ffba9b24bf1a767cb93e825f610848b66e5f5b4c03c1a519acb63cc5db4d0f06
SHA512e18fe7323def774af969dd197c42e5c97432a0ec67f530187162d5dbc2bb45844cafc70fba8f62ad3b85a27ac0c6f19d1d614504f2f277eb32fe3367c3af46b5