Analysis
-
max time kernel
142s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
02/01/2024, 15:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
09a5c7f4012b95e712d2c6ec05b3c575.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
09a5c7f4012b95e712d2c6ec05b3c575.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
09a5c7f4012b95e712d2c6ec05b3c575.exe
-
Size
192KB
-
MD5
09a5c7f4012b95e712d2c6ec05b3c575
-
SHA1
ec78d353bfab977d0cbd9a1a594f188174ad3f7d
-
SHA256
1f822212f3fd6c1c9cae1a78bfe5109adce74e235894070fd564153b8cb5acf7
-
SHA512
64d2f5028b662361c6bf6061f6a56d55e63e03c1c6299bcf73f7c4d3de542da51d73fad6f85206e28c6dbd1625468b8b7b1c047eba11ce404f2dc990eb05724c
-
SSDEEP
3072:3wBJ2Iish+RH5UL1iUG3KgKLKRKoVqR5VxerayK/fObT/bGicFgvXb6jGJLX:3wBJXcRZSgKgKLKRKoVqRTxEpK/fObTD
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vghas.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 09a5c7f4012b95e712d2c6ec05b3c575.exe -
Executes dropped EXE 1 IoCs
pid Process 2992 vghas.exe -
Loads dropped DLL 2 IoCs
pid Process 2928 09a5c7f4012b95e712d2c6ec05b3c575.exe 2928 09a5c7f4012b95e712d2c6ec05b3c575.exe -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /j" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /Y" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /w" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /z" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /G" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /i" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /q" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /I" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /o" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /W" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /l" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /F" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /r" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /k" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /N" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /f" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /m" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /W" 09a5c7f4012b95e712d2c6ec05b3c575.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /s" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /Z" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /O" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /n" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /M" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /S" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /U" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /v" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /e" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /y" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /J" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /P" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /E" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /t" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /C" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /b" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /X" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /Q" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /d" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /H" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /K" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /p" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /a" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /D" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /u" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /h" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /R" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /V" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /B" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /c" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /g" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /L" vghas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\vghas = "C:\\Users\\Admin\\vghas.exe /x" vghas.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2928 09a5c7f4012b95e712d2c6ec05b3c575.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe 2992 vghas.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2928 09a5c7f4012b95e712d2c6ec05b3c575.exe 2992 vghas.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2928 wrote to memory of 2992 2928 09a5c7f4012b95e712d2c6ec05b3c575.exe 28 PID 2928 wrote to memory of 2992 2928 09a5c7f4012b95e712d2c6ec05b3c575.exe 28 PID 2928 wrote to memory of 2992 2928 09a5c7f4012b95e712d2c6ec05b3c575.exe 28 PID 2928 wrote to memory of 2992 2928 09a5c7f4012b95e712d2c6ec05b3c575.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\09a5c7f4012b95e712d2c6ec05b3c575.exe"C:\Users\Admin\AppData\Local\Temp\09a5c7f4012b95e712d2c6ec05b3c575.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\vghas.exe"C:\Users\Admin\vghas.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2992
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD5ebb62e3947edaaac08af57cdbc8e7345
SHA10a52f92ed7032087e6f70612d710f98c60c1e4a7
SHA2568697c6b98ef30bd4941858ef9351a45b47c18babcd6ca4f6c7582dd457f53114
SHA51229b4d9f315f9f4481debd1f6f0f3d03117fabe6a0619faa6821ff691fe3ce2cfbd3e0eba2577447a50d7a424cfb71f865d62afc6a3783e9e014a7a3d36db6817
-
Filesize
192KB
MD5e55692273e5b2e5ad2ca4e9bf7a58b50
SHA14f9fa2a634f813bd2d1eb2108eef795a0786fc7c
SHA2563fcdbea90bb8db81cb35eba9b5d12a7872e80c02ae03e7babe56ac904c3ebc53
SHA512233278b64f70379b121fca16b470133c5f4994e0822e3b517266959b4c41d97b43c6e5312cbcbd8083ec47a68d350b1e9a45dc3e033ad63704bbebd254926875
-
Filesize
92KB
MD51c5d4633ebc353d64f7c8c7d7c026964
SHA10ed3d3d0e969c8006090ce7044f5c55b2a601b03
SHA256778a4301fcef04f1489a4178089d54fe1d38f76b033dcbb12bb6088a4b01a909
SHA512d09ce57ebe4c8380cedb3e939cb34649c1d6e4ca44d9be9c2fff12acd6cc184fc2e0672dc36102351099628d3cf587afac36502459767d6f163e7b20275e9e6a