30626cb5e8527ec08a3afeffde0648acfc51f7d9c677fd47f01656c77c6abec0

Analysis

max time kernel
122s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03-01-2024 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f63fac6f4372aff8ee31e8e9e2779c95.exe
Size

948KB
MD5

f63fac6f4372aff8ee31e8e9e2779c95
SHA1

f77cbf87e49b9a327167eee6005d2350a26ddd09
SHA256

30626cb5e8527ec08a3afeffde0648acfc51f7d9c677fd47f01656c77c6abec0
SHA512

4fa92b79c5f054fd600eee2a5bf087020b95ea9abf041276d4c497c2a15d9c63112810adf0bae1acafd18df21f385f1388f161d08d7102a5e7b5bc8b0e8bf3c1
SSDEEP

3072:MGjhaq5iL0beJQZt32wLji5DlsODxRPNDkjJHzW9hUd56JsuBSjwA2i1vP2i1a1W:Hha8iAx+1zwjJHd6vB/ANMfwwfm

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\GGAAAG_LOADER = "C:\\Windows\\system32\\GAAG.exe"	f63fac6f4372aff8ee31e8e9e2779c95.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FifefoxUpdater = "C:\\Windows\\system32\\FifefoxUpdater.scr"	f63fac6f4372aff8ee31e8e9e2779c95.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinSevenUpdater = "C:\\Windows\\system32\\AVSCANNER.EXE"	f63fac6f4372aff8ee31e8e9e2779c95.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\FifefoxUpdater.scr	f63fac6f4372aff8ee31e8e9e2779c95.exe
File created	C:\Windows\SysWOW64\AVSCANNER.EXE	f63fac6f4372aff8ee31e8e9e2779c95.exe
File opened for modification	C:\Windows\SysWOW64\AVSCANNER.EXE	f63fac6f4372aff8ee31e8e9e2779c95.exe
File created	C:\Windows\SysWOW64\GAAG.exe	f63fac6f4372aff8ee31e8e9e2779c95.exe
File opened for modification	C:\Windows\SysWOW64\GAAG.exe	f63fac6f4372aff8ee31e8e9e2779c95.exe
File created	C:\Windows\SysWOW64\FifefoxUpdater.scr	f63fac6f4372aff8ee31e8e9e2779c95.exe

C:\Users\Admin\AppData\Local\Temp\f63fac6f4372aff8ee31e8e9e2779c95.exe
"C:\Users\Admin\AppData\Local\Temp\f63fac6f4372aff8ee31e8e9e2779c95.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\AVSCANNER.EXE

Filesize
361KB

MD5
495b0e8a59fdd4774d7a8d46a7976041

SHA1
d4382337b1d9c17b6ed5bf5679f16c255c948074

SHA256
e61e7e367f006b597f572b778c798f40401144f7c90c3e58591667d27a46892b

SHA512
2fbe89136cc19399e8b5d157311162d95203ae8ad27fe91ecc7a106080405e7906cf13b2661eeb14369345f7b433324c188f2f7659a5142e734a79548b35b5b6

Download Submit
memory/2072-0-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2072-7-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads