gink | 5bdefc69ef69bf2ee1f01e57f1c6f6a8d50b3bd7af69bc75ebd302320f0d045b

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/12/2023, 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22b7d0a1007c21e4950728d00c4b2e42.exe
Size

37KB
MD5

22b7d0a1007c21e4950728d00c4b2e42
SHA1

4f6e27c4b459002cdd3546e1fbed2131318fa754
SHA256

5bdefc69ef69bf2ee1f01e57f1c6f6a8d50b3bd7af69bc75ebd302320f0d045b
SHA512

940d07d05eba8593a0eff84ff1887f6daa86b7de480ae6986fd2f251a290d67b55ad66aac000b732a19814f5b0af172c72bd4e0ca5727e159a6e846475a5c326
SSDEEP

384:lorhaQoJZudfOqCMO/t9MMHEOduDiANbnY8knC4EyinI8o2ux4U:loNo7Af3hOjMTOduDiAjPkn6jI8H64

Score

10^/10

gink persistence worm

Malware Config

Signatures

Gink
worm gink

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\I-Worm.GiGu = "uGiG.eXe"	22b7d0a1007c21e4950728d00c4b2e42.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\GiGu.eXe	22b7d0a1007c21e4950728d00c4b2e42.exe
File opened for modification	C:\Windows\SysWOW64\GiGu.eXe	22b7d0a1007c21e4950728d00c4b2e42.exe
File created	C:\Windows\SysWOW64\GiGu.eml	22b7d0a1007c21e4950728d00c4b2e42.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\uGiG.eXe	22b7d0a1007c21e4950728d00c4b2e42.exe
File opened for modification	C:\Windows\uGiG.eXe	22b7d0a1007c21e4950728d00c4b2e42.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2156	1220	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 2156	1220	22b7d0a1007c21e4950728d00c4b2e42.exe	28
PID 1220 wrote to memory of 2156	1220	22b7d0a1007c21e4950728d00c4b2e42.exe	28
PID 1220 wrote to memory of 2156	1220	22b7d0a1007c21e4950728d00c4b2e42.exe	28
PID 1220 wrote to memory of 2156	1220	22b7d0a1007c21e4950728d00c4b2e42.exe	28

C:\Users\Admin\AppData\Local\Temp\22b7d0a1007c21e4950728d00c4b2e42.exe
"C:\Users\Admin\AppData\Local\Temp\22b7d0a1007c21e4950728d00c4b2e42.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 176
  2⤵
  - Program crash
  PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1220-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1220-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1220-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads