728a6af9630da0a14b6210e238650289a02e7fadb5a4666ba9def833e4b997d8

Analysis

max time kernel
134s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 06:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1181c11e3d6737a59878f5e6bca0bf34.exe
Size

268KB
MD5

1181c11e3d6737a59878f5e6bca0bf34
SHA1

3ccf72d0e5361764b486d7351eaab3bd51a822ea
SHA256

728a6af9630da0a14b6210e238650289a02e7fadb5a4666ba9def833e4b997d8
SHA512

08fcb5c7dc9f5e1675290dcb80e683174769ccd7dd342e2afcd1139a5a434a616161fb5badba7cd3b36605fd8cd10adf0f96d428a8508a39f54063c3698aeb65
SSDEEP

6144:D7S93mJAUWDr7Z4cMNYLUeeDkH2RTZheZ0Ay7WhWSsKQ:DW9KAfxKYLUeeDkH2vIj7Q

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2800	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2136	gprs.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	gprs.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system\gprs.exe	1181c11e3d6737a59878f5e6bca0bf34.exe
File opened for modification	C:\Windows\system\gprs.exe	1181c11e3d6737a59878f5e6bca0bf34.exe
File created	C:\Windows\Delete.bat	1181c11e3d6737a59878f5e6bca0bf34.exe

Modifies data under HKEY_USERS 33 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{22C731F0-6F67-4E82-B667-8EE6064243F2}\WpadNetworkName = "Network 3"	gprs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	gprs.exe
Key created	\REGISTRY\USER\.DEFAULT\System	gprs.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties	gprs.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{22C731F0-6F67-4E82-B667-8EE6064243F2}\WpadDecisionTime = 805764c87e3cda01	gprs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	gprs.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick	gprs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm\wheel = "1"	gprs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	gprs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{22C731F0-6F67-4E82-B667-8EE6064243F2}	gprs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{22C731F0-6F67-4E82-B667-8EE6064243F2}\WpadDecision = "0"	gprs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-68-6a-60-57-88	gprs.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-68-6a-60-57-88\WpadDecisionTime = 805764c87e3cda01	gprs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	gprs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	gprs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	gprs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	gprs.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	gprs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	gprs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	gprs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{22C731F0-6F67-4E82-B667-8EE6064243F2}\62-68-6a-60-57-88	gprs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	gprs.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet	gprs.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control	gprs.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties	gprs.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	gprs.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	gprs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	gprs.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f010d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	gprs.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	gprs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{22C731F0-6F67-4E82-B667-8EE6064243F2}\WpadDecisionReason = "1"	gprs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-68-6a-60-57-88\WpadDecisionReason = "1"	gprs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-68-6a-60-57-88\WpadDecision = "0"	gprs.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2136	gprs.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2800	2672	1181c11e3d6737a59878f5e6bca0bf34.exe	31
PID 2672 wrote to memory of 2800	2672	1181c11e3d6737a59878f5e6bca0bf34.exe	31
PID 2672 wrote to memory of 2800	2672	1181c11e3d6737a59878f5e6bca0bf34.exe	31
PID 2672 wrote to memory of 2800	2672	1181c11e3d6737a59878f5e6bca0bf34.exe	31
PID 2136 wrote to memory of 2748	2136	gprs.exe	30
PID 2136 wrote to memory of 2748	2136	gprs.exe	30
PID 2136 wrote to memory of 2748	2136	gprs.exe	30
PID 2136 wrote to memory of 2748	2136	gprs.exe	30

C:\Users\Admin\AppData\Local\Temp\1181c11e3d6737a59878f5e6bca0bf34.exe
"C:\Users\Admin\AppData\Local\Temp\1181c11e3d6737a59878f5e6bca0bf34.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\Delete.bat
  2⤵
  - Deletes itself
  PID:2800

C:\Windows\system\gprs.exe
C:\Windows\system\gprs.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Delete.bat

Filesize
186B

MD5
03504f88021fc999079c0f26bba6c203

SHA1
519083e50cfdbed66527aaca75c8efff75b37afc

SHA256
ffd5f347cbe9c7c3285dae8c7839c109666a4bf2f1974a63e69286c78e8aab96

SHA512
c0a73bd8d1d4d1cb1be33a5aa0805af108bb60bb34f1d4a340cda75e23286a7bf46425bef0232335127a1e8e666611674192f4cb3705593c0cd3a9053d031941

Download Submit
C:\Windows\system\gprs.exe

Filesize
268KB

MD5
1181c11e3d6737a59878f5e6bca0bf34

SHA1
3ccf72d0e5361764b486d7351eaab3bd51a822ea

SHA256
728a6af9630da0a14b6210e238650289a02e7fadb5a4666ba9def833e4b997d8

SHA512
08fcb5c7dc9f5e1675290dcb80e683174769ccd7dd342e2afcd1139a5a434a616161fb5badba7cd3b36605fd8cd10adf0f96d428a8508a39f54063c3698aeb65

Download Submit
memory/2136-7-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/2136-9-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2136-20-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/2136-21-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2672-0-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/2672-1-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2672-2-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/2672-3-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2672-18-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download