Analysis
-
max time kernel
159s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2023, 21:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fa2a56d211a5b3301f228d961951915e.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
fa2a56d211a5b3301f228d961951915e.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
fa2a56d211a5b3301f228d961951915e.exe
-
Size
132KB
-
MD5
fa2a56d211a5b3301f228d961951915e
-
SHA1
43e6d36430dde39c7e06707f1d0b038f9dde32be
-
SHA256
5ced815fda8b10ba7013dfed882ac13c6e29fdbe920556c3e7481f1057d4d887
-
SHA512
4a7c31bb4e060fb14f08da208d1af67890a3eedc0f25b2b99375714ad87c7c4ca9685e4b05c0b957fbdadf6fa10d272716411c786f39c198954617f53dc21977
-
SSDEEP
3072:43k/MPrdVfWM8RM/8KmwBErXXFefQmD8ampjMi0vC:n/IX8/KmwBEjXFeos8aCAi0q
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fa2a56d211a5b3301f228d961951915e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" gdtaw.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation fa2a56d211a5b3301f228d961951915e.exe -
Executes dropped EXE 1 IoCs
pid Process 2020 gdtaw.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /e" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /s" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /H" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /j" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /R" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /G" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /g" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /v" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /U" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /E" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /I" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /C" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /y" fa2a56d211a5b3301f228d961951915e.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /m" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /K" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /N" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /T" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /M" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /h" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /r" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /i" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /D" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /q" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /W" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /t" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /l" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /y" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /A" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /V" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /O" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /F" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /Y" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /x" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /u" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /n" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /d" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /o" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /k" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /Z" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /Q" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /S" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /b" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /w" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /P" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /a" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /B" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /p" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /J" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /L" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /z" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /X" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /c" gdtaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdtaw = "C:\\Users\\Admin\\gdtaw.exe /f" gdtaw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 976 fa2a56d211a5b3301f228d961951915e.exe 976 fa2a56d211a5b3301f228d961951915e.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe 2020 gdtaw.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 976 fa2a56d211a5b3301f228d961951915e.exe 2020 gdtaw.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 976 wrote to memory of 2020 976 fa2a56d211a5b3301f228d961951915e.exe 90 PID 976 wrote to memory of 2020 976 fa2a56d211a5b3301f228d961951915e.exe 90 PID 976 wrote to memory of 2020 976 fa2a56d211a5b3301f228d961951915e.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa2a56d211a5b3301f228d961951915e.exe"C:\Users\Admin\AppData\Local\Temp\fa2a56d211a5b3301f228d961951915e.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\gdtaw.exe"C:\Users\Admin\gdtaw.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2020
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD59c423678b4f6fc57b5c9226fbb97a79a
SHA1f3632233d018f7c6850b688765cf0e54e5db0995
SHA2569309dca006b5cbf7078cc44143961ea1b3b90904218c3a7847359fa1acb5e666
SHA512cc948ad4e82e01afc3f2359775ceeaeba3bd41065cfac3ed252964bb5614f46f60680b1af5f99d956b16646d06a37bb1988575b028361729fbc9ad296f992d19