Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
19-03-2024 07:59
General
-
Target
GrammarlyAddInSetup.exe
-
Size
14.1MB
-
MD5
6e7521d5ed304ee64a9eea0233b1331a
-
SHA1
4d6f4f35defc0385c2b375e7e63c8fc347bc5faa
-
SHA256
df9a7d7a30cb6d60d0c5efc1ac052d664983f04c137a1be43a477cd08660686c
-
SHA512
91f8dbc82c07573bc77e6752dd54a5da93e44b416e4eaac5be841e0f1c2eb11f4d2de76d5209ed308a8d5d136e26070eb63a9da3f0c3837dfc1f92d8c09f81d8
-
SSDEEP
393216:znc60u4ShklUsF0aNhRp138y4CZy0TZgQ9b/6NzrFKSlioSnpwZVkDw:zc696Z77b4MySjd6hNipqzZ
Malware Config
Signatures
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 47 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\GrammarlyAddInSetup.exe"C:\Users\Admin\AppData\Local\Temp\GrammarlyAddInSetup.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{60647770-25B7-4B90-9086-3390853C6B90}\.cr\GrammarlyAddInSetup.exe"C:\Windows\Temp\{60647770-25B7-4B90-9086-3390853C6B90}\.cr\GrammarlyAddInSetup.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\GrammarlyAddInSetup.exe" -burn.filehandle.attached=544 -burn.filehandle.self=5522⤵
- Checks whether UAC is enabled
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD5131fdb68cf6c0997573bf58bc64f49ee
SHA1fac72e2ba8b0f1fcb3f1908abeb37a6b64daa933
SHA2565450d25aa4773fd43dca5c2df860daf480c44f65da032246cb21791721a9b67b
SHA5122f08d4f0327b8d3e06f2364f569b741731dfd993033f11b216130ae78f7a49c17c145e908a2fee45b8353ddb045af6f6fe6be11d80ebef4cbb3998f28e8221b9
-
Filesize
1.8MB
MD5a283689cbbdcdeb1bbaa3b4ec9a9d86a
SHA1766fd38e78351528ccdc0628f0ecba9fe9ac0b07
SHA25676b4698b2ccad0a34de5f84ea37e85df3c5cf6d924fbad987605932b1b74fb36
SHA512a16769969b73de71419cb3a1491ba4bc93cc90a9e3fbea142a8281f781d66eae6bfb231161b139be77ea6e4470cf0f481a7685d5ca8284139503dd358962ffe9
-
Filesize
256KB
MD535c0f1429264d00c2a580ad9a54345c3
SHA1584ff34bd656a770992366ed80d5b742ccef169c
SHA2565dcf6e1043ec22c1cf95650027eb3d860dde1da349696a2a45afcea182a991e4
SHA5123f4cf387e7b69ba6d552d9412cc5a840d9a87dc107ca0b4c4861b1d34941ecbb46e0ec4ac6f26079d0eca03ef396fa81ff999254916ba38f90d6180ad3ff9a35
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
3KB
MD5a2fd50b2a9eaef9a3d404e96fea6fa26
SHA1fa0d612f3af69e74669fe3d149b28dd722eaa292
SHA256ea33dc00e6fda038cdd2f73c3684beb05c3dd1e9b2f2ad7f7f6d7ef6305d2661
SHA5124d2b5a6e2365131a8580e5c3d49450532688ef63c5fc95d61b9341c665b2066d783f6c0d2d264b8d8d696a4c44b7f2896d9e7c1ac7ea29f495d42fdeea6985ff
-
Filesize
80KB
MD5c4f7146ddc56763ccdb1cb3c09478708
SHA1bca088ab33cfb69adeae11a272e9c8a83f39a8c9
SHA256886cb2a994461f091752fc7b21e3143c212efd8841c757909e74ac32761880da
SHA512df2ca029e95f80fc5870e541db8b1d5a03266307bb5f7680ad630868a9a3c584b3a702fbec09c26fef7287c99f5d9d1f59cd59b74dcf740c9a8e7508e07d18b5
-
Filesize
2.9MB
MD5ea2e28f4946912f2352dcbcdf2f67d77
SHA17392ecd9e3f54590c76860946adc541806d3ced2
SHA256c6780923994cc96dc2bc8fc4f44b6f6c5d56290790723cf98b7114cd18c1143d
SHA512f9fcaddb6fbb68c151d97f2fb4a98f2a730e6761e71e349f2615d96a6a345dade9eb1eeb80d29bf9b96c988f14e31cc4e06a821ca925a6a3d959c14c64a60ef2
-
Filesize
88KB
MD532034d5a06ca33c0368e2b61fc444ffc
SHA1e4b0cc795c5a4cdcbc29590e88419acfb008a4bd
SHA25617431929891c871eb7ceeb21746061c459f8904ce95c7b665e4c308a6266a877
SHA512c769a1d77674ef01aeb22755daa782b13080eff088b5d72a7e1d84aeaec61cf0515e7187beee356b9c36a355f42926c359709d6ce11900e8c0678b6de2966f33
-
Filesize
27KB
MD54cf98c5fab3294e6108867308cc3c708
SHA1476c74f7a3829f19e51a241dbc968cf310896205
SHA256bd20305fd4082275dd483133f6cb239fdaf6dc3154cbb98d0707fbf74bd82a74
SHA51265c531116be6384326453e05a8e410f9dc67865a8ca50c945746c3c8c528b0a1d8b5049e7d6de42d4a8fb54a85eb600092cc1ed63fa1b8c9d38665ea74a8712d
-
Filesize
112KB
MD5d904ab16b1b93f2bccd8af0b81f40344
SHA12f5c6cc15e9dc4217314acb547ca50a648948c31
SHA2562f8bfcd8d7051ef4b84f0bbab45ac01fbef41f21287444ccf4490a00a5bcdb06
SHA512ad4bb84ef114c7ee4216fc8ec26361faf965e3213961a0a2b0d2eb432fcb3b1af6d3f4ac2a89c94575f713c2373564d14ad2ac786d8d834a9048148dd42612fe
-
Filesize
670KB
MD5037ffae2a024a32ffb792d3193f11ef2
SHA10119a6ee960710a1e113825ab1ca951d0a3922c1
SHA256dda24b9e89ec500d205d975f970c16f2fe13bc147094afacf97a578619b49319
SHA51214e848f914cd3c978f7cccf5b5b3330408c465a2d718a6b8c9daec06f4c37f13eb6073ae2f0a9e9164f3095185225d50311880562a1712b1ccaf036d13e338f5
-
Filesize
287KB
MD5ecfb009a1da449f9b0c7bcbdcf1b0ecb
SHA1d9cef96a90aed34af541fa679a37c8f5f45f0825
SHA2567b304771b27f496e5f52c30ae32b0217588df61b61ad119722e49364eca15f71
SHA512c8c25fe4c9cc03088b16f423694053ff0145c8fb74e2a224544f579af1561257591ae9ff67afa0b8d517d37da964d00d22e42309e31f7743a1bf1c91ccb03a4f
-
Filesize
30KB
MD544a675c3bad40eb602050829fa79a286
SHA1428fd43f9bda0b3019278df6ea3c841d5c5c3c84
SHA256b082d70ae26a15955711efcf11e4b315b1ced1d076eb1c102042dcc4c1c4a709
SHA512f75f847b8de3f026bcbc13aacf4950b8d75bb263a9519168b9e898d0117ad6d22eefaa5986a341ac62e768738a6a0faec597a0e2fc146b4d0c9a008b184aa3a8
-
Filesize
2.6MB
MD5048bcad1b8eb39c2cfb88d1eb755b6d4
SHA16b153cbd6dc6ba9706344c650b67dd7623ee4b4d
SHA25632d09fd2b66eed94112a273f14581ce1c16f24392a8fd0b31ccc958d7a4fb70c
SHA512d7c945f99e27f0c6aca1450d9c37f9639810ae757ae058815e42635910ec3c0bd3bc31ecbed04fc90dc32752ea026f8c9bbfc942ec33f8d544eaa486c51a4ebe
-
Filesize
89KB
MD51da12442491caebc2c77c37b74b8386a
SHA1839f55b57c1491d6c396ca739c6dcd03eafc78e6
SHA25638b2fb044dec114c2ad90ea3c8efb085bdbcfb38dd5a1c29668cb9b41a8489c5
SHA512b915887f9b45568e57a49463905b5294bc43c83f00f00002cfc4bfe94b90a25d0f3f376fe097b35d3d2bb202605fd32e37b9e4ac823b8a816a6095bc2a9e06de
-
Filesize
133KB
MD564afca32d62af1f42d3b90d24cb3acc1
SHA1980e3dab8c1d1f5f8da543ab338d4d8c9cab27b6
SHA25671ac8260df684faba7dd0e67cc5d15bbc2fd82c5c01f69357e2c6f4a193a851b
SHA5125627518f91611683f5be4dbce62613a26cafa48a12c95a0637507e5dd32d4921d1365db6f8b6aae0d9389e1b659725428aad13192659c000d128a53697d22a7f
-
Filesize
36KB
MD59babfd37d038596b7ed8d3c53b8ef819
SHA1203441ca67f6999a0cce59f10b19a04d39cc7f97
SHA2561b3b06e908ec25d28ca5beea3035a670d5eb4ecd8a4951c4bb10208aed9a3f62
SHA51252434040ee44936e15c3ddef8effbd28b799f3a7dfcccb10c5a1aff483e993658137f569e580c44515d076b47b9c667a0d640d79d56a439c51bdf973601e9c87
-
Filesize
221KB
MD57a9b8391936ea5b48c873fa20b111293
SHA1cf683bf2f31197d5da107fe4c6fe438f00e0b79f
SHA256bd951b380c270ae4d8ce4066f0d0ac1865cee225db43719d8263f26b107615cb
SHA512ea2e4737bd593c082e766c9072638c0b716b4582618e2f7c189902c6c32d5388c65ca6ab4ebc95769a5e692f8f791e836631032291fce6c3b8a4667f5b4a0942
-
Filesize
78KB
MD520d48d1cf0665d0455584b7b65d7604c
SHA17458f9ad1e6aa852c9ca87288cd40563332c374d
SHA256d665a88d650346680d5ff9a00e6fe78e5a9123b7a5f0b903d43f37968a9048c7
SHA51270179d67c9bfc9e2c5a5e850b93eabd7827a74a3f204425a6cad23986b4b7d37bebe713dbfc5f7cc2d02aa84b3509583b2784c7b4492eb596d2fe97ce97ddb0d
-
Filesize
41KB
MD51a8d3f310c4ecabef86ff4d5a84ceddd
SHA1a2295df8f21f58d934c8d8bbf21713e61ef64cd8
SHA256b5f159c4798b6c8d270d37f071f484d58227e04aa432b500d4edcf604d8aff2e
SHA512e9c1c3e3b8befdc358fcaf2a700ef9838d3e47c9243e18a2ed48e5de8797c989917c4415aeb167997cae28aaa9b43e7dcb5560854fa38f4909a37f856d42eb9b
-
Filesize
3.3MB
MD5109494b64443173f0de9d753002fc180
SHA191a763817d6e3e9124fe096c2629a9a0a5d2b7db
SHA2564e4ca3ce9b8fabe17c5197ac4b801b8fcf37a89e49447a6c711775e18ebc78e4
SHA512a0a5e39a21a9fbe308ed12778e46b087f16a499d16efaabae19348884c7c96b0ed9b904c575e44b98e220edbac1854b9fb207fb7222db705764f0cca647c3d3e
-
Filesize
3.7MB
MD5bd8686d1ed44180cb005c001d5b9a122
SHA1b0e1a98fd80eb82efaf6ffb4692ff2cc963ac771
SHA2566a69f556539215d34047b407ae16b0c3cd7145610591cc1af7a4322170e3c2fa
SHA5129d3bf1193134be1f72f9fd9eb1f7fbf4707bdc7daa3cdc8bca2bce5981d7026ebf2af2b3e495d446b10d6f51ba486d371ec15f1519659a4ba651bcd62d55c295
-
Filesize
274KB
MD53674d451e7bdbcc085cbeaecae28cb82
SHA16ebfc8b6fc173138dd3a93a23983a905b204693f
SHA2569b05af797a1847662afbebce97293cbb7d11d30a853084dc4ddc03fa323ac1d7
SHA512f643b253d0cd8bd947984d998c78f9279d198f3e5ccad4cd6a00cf3462f71edec5ce5d48768a9964bda9e2950ae59d0b6a9ac8aaaf2f020628feb9ba6cd83eb7
-
Filesize
51KB
MD59d567a6047ea34f421c52e11c90574d8
SHA1ec93d183f53bf894fa22a1d331dd60134909a2c8
SHA25659f64453ced6e4bcaa2dccaf0d68abfab593c044cf9a3dc413b3167e35a06587
SHA512ae9e0e675463cfb4ed82678d111c3eb6e77925f0dc1646338985a99468c4402eeea1d3a0c0be754133d4d5a7c6db74a94b50065c79a9a07115ac088eb5805297
-
Filesize
103KB
MD5f30b8c15a72dc8e9df72a79d0f6edef7
SHA1904c72eb5f43683b4c2e9de10e62bc21b2720933
SHA2568d60c49052587404da8de3b5075f03379f926a24064926add03d428a919579f0
SHA5124f27fe838b151fccaedcda0af494b34457ba2b8f849cf8dcdbe6ed1141af97cb8526ce41f207382e6d13b1cc645e68e6df63071381be306418ab8895009d818b
-
Filesize
14KB
MD58456496526d4ae39976c01fb66dec3b4
SHA148692a3202892031a8d6082ff12d86e577b817e3
SHA256ce49e5c5d339477285c2a4b8363dd1bdab53c4de085560f0831e8c86ef63a195
SHA51256d866f6dabe4178fc0137313d6a9497ac57a5667ca550a83a5a3e0f201d3b4796a2b3e1c63871f84ff2056155f2a1518928423d1c8ac430ac04dd7347e2203f
-
Filesize
683KB
MD5d8d6b991baee2043fc59868e30a694eb
SHA15245617144772d5318186580ec60ed1cfd40fd04
SHA25638e486e6dce12416936550e5cda476e6ced49cd60671e7672cd19607e2d7e09f
SHA51254a060eca5d134b69ec0bbfd19131e5b10eab0e6914a2a115622d38a5a28dd651b960e964360d41f335d05de5a44366209f298e8d26236db7c4e1be0b2e73239
-
Filesize
28KB
MD538594076e1d4747e0486bc6fcba5c710
SHA1427aec497ac466a92cd0e7766150f8978296ad1e
SHA256e9db79e6fa6df07e866916c540f580e59fdeeb5e145d825870b473992fcd3deb
SHA5127b3041eb762b0e8dfed346d70e144e0d57570e1d69dff2c3b244ac5fcf3bd5e9e6aa0fff75d42947213a9a38d8e6657aa5151eebc642731ee21d2b73d55de66e
-
Filesize
20KB
MD56c8bc73c381974f5f5cb7659edb0aa3c
SHA1800c2d42becf50292c47f373188995e26262a6a8
SHA2567909c50b7fb24efc13bb9c16b1af01da5d9769892655c5dd9669fa6ba4dd9274
SHA512a0a103de5ebe051d95858fa157689eb3e05ca867e73a7fff5c7d3496952aa1752643a2e5ae282cb8bf6e2376e6283fc0b03aa8a1c9ad8db88050c36df62ab546
-
Filesize
111KB
MD5d7c697ceb6f40ce91dabfcbe8df08e22
SHA149cd0213a1655dcdb493668083ab2d7f55135381
SHA256b925d9d3e1e2c49bf05a1b0713e2750ee6e0c43c7adc9d3c3a1b9fb8c557c3df
SHA51222ca87979ca68f10b5fda64c27913d0f2a12c359b04e4a6caa3645303fbd47cd598c805fd9a43c8f3e0934e9d2db85f7a4e1eff26cb33d233efc05ee2613cfc1
-
Filesize
5.3MB
MD57d2efae26413e6b3cf2ce0b7c8c52585
SHA1a201311949a5c6033de4d5ce05f0ad44c114702b
SHA25641b5f4747f349e5068bc2761cd617ac157f90e8b689bd16752f1418fc413d777
SHA512c0afe78c0794f27f4d6e534070023f5825a51a5fcbb013845b2b1df21844bc25688e1c9deff7ffb70cf4025322733d5bd2f7f2183bf50a11b98a1a30eac6a095
-
Filesize
152KB
-
Filesize
48KB
-
Filesize
56KB
-
Filesize
2.9MB
-
Filesize
56KB
-
Filesize
688KB
-
Filesize
104KB
-
Filesize
2.6MB
-
Filesize
296KB
-
Filesize
120KB
-
Filesize
72KB
-
Filesize
32KB
-
Filesize
240KB
-
Filesize
48KB
-
Filesize
96KB
-
Filesize
704KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
7.4MB
-
Filesize
128KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
304KB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
224KB
-
Filesize
56KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
96KB
-
Filesize
48KB
-
Filesize
7.7MB