Overview
overview
7Static
static
3gs10021w64.exe
windows7-x64
7gs10021w64.exe
windows10-2004-x64
7$PLUGINSDI...rd.bmp
windows7-x64
3$PLUGINSDI...rd.bmp
windows10-2004-x64
7doc/COPYING
windows7-x64
1doc/COPYING
windows10-2004-x64
1doc/HowToB...cs.txt
windows7-x64
1doc/HowToB...cs.txt
windows10-2004-x64
1doc/colorm...nt.tex
windows7-x64
3doc/colorm...nt.tex
windows10-2004-x64
3doc/langua...ar.png
windows7-x64
3doc/langua...ar.png
windows10-2004-x64
3doc/langua...le.png
windows7-x64
3doc/langua...le.png
windows10-2004-x64
3doc/langua...er.png
windows7-x64
3doc/langua...er.png
windows10-2004-x64
3doc/langua...ar.png
windows7-x64
3doc/langua...ar.png
windows10-2004-x64
3doc/pclxps/Makefile
windows7-x64
1doc/pclxps/Makefile
windows10-2004-x64
1doc/pclxps/README
windows7-x64
1doc/pclxps/README
windows10-2004-x64
1doc/pclxps...dl.tex
windows7-x64
3doc/pclxps...dl.tex
windows10-2004-x64
3doc/pclxps...dl.txt
windows7-x64
1doc/pclxps...dl.txt
windows10-2004-x64
1doc/src/API.rst
windows7-x64
3doc/src/API.rst
windows10-2004-x64
3doc/src/C-style.rst
windows7-x64
3doc/src/C-style.rst
windows10-2004-x64
3doc/src/Develop.rst
windows7-x64
3doc/src/Develop.rst
windows10-2004-x64
3Analysis
-
max time kernel
440s -
max time network
1167s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
23/02/2024, 12:36
Behavioral task
behavioral1
Sample
gs10021w64.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
gs10021w64.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
doc/COPYING
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
doc/COPYING
Resource
win10v2004-20240221-en
Behavioral task
behavioral7
Sample
doc/HowToBuildTheDocs.txt
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
doc/HowToBuildTheDocs.txt
Resource
win10v2004-20240221-en
Behavioral task
behavioral9
Sample
doc/colormanage/GS9_Color_Management.tex
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
doc/colormanage/GS9_Color_Management.tex
Resource
win10v2004-20240221-en
Behavioral task
behavioral11
Sample
doc/language-bindings/images/export-jar.png
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
doc/language-bindings/images/export-jar.png
Resource
win10v2004-20240221-en
Behavioral task
behavioral13
Sample
doc/language-bindings/images/ghostnet-wpf-example.png
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
doc/language-bindings/images/ghostnet-wpf-example.png
Resource
win10v2004-20240221-en
Behavioral task
behavioral15
Sample
doc/language-bindings/images/gsviewer.png
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
doc/language-bindings/images/gsviewer.png
Resource
win10v2004-20240221-en
Behavioral task
behavioral17
Sample
doc/language-bindings/images/linking-jar.png
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
doc/language-bindings/images/linking-jar.png
Resource
win10v2004-20240221-en
Behavioral task
behavioral19
Sample
doc/pclxps/Makefile
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
doc/pclxps/Makefile
Resource
win10v2004-20240221-en
Behavioral task
behavioral21
Sample
doc/pclxps/README
Resource
win7-20240215-en
Behavioral task
behavioral22
Sample
doc/pclxps/README
Resource
win10v2004-20240221-en
Behavioral task
behavioral23
Sample
doc/pclxps/ghostpdl.tex
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
doc/pclxps/ghostpdl.tex
Resource
win10v2004-20240221-en
Behavioral task
behavioral25
Sample
doc/pclxps/ghostpdl.txt
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
doc/pclxps/ghostpdl.txt
Resource
win10v2004-20240221-en
Behavioral task
behavioral27
Sample
doc/src/API.rst
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
doc/src/API.rst
Resource
win10v2004-20240221-en
Behavioral task
behavioral29
Sample
doc/src/C-style.rst
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
doc/src/C-style.rst
Resource
win10v2004-20240221-en
Behavioral task
behavioral31
Sample
doc/src/Develop.rst
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
doc/src/Develop.rst
Resource
win10v2004-20240221-en
General
-
Target
doc/src/Develop.rst
-
Size
105KB
-
MD5
e56d2562c2a861888c93647adc3c868e
-
SHA1
7a1568cc9b3121283cfd122efb281d1ce5855aa9
-
SHA256
9a926548948c7aadd6cf723b757eaabbf0a9e43039d548b2b25cf3d3535e03f5
-
SHA512
64a7e06826d7abc71a101b98a74f44533a9ed509789ecc8a9776276c4ae98bdee95e4191b1911b40a7ea174746a869d2c8392c6c132700029ac43742d923118b
-
SSDEEP
3072:zdIJ44afjeTuqD0bJ8OZjB36Mc9wYAQWLqHw:z+J44afjeTuqD0x36gQWx
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4080 OpenWith.exe