Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09-04-2024 20:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a3a883deb0920aca2147e9bc790bd29e.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
a3a883deb0920aca2147e9bc790bd29e.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
a3a883deb0920aca2147e9bc790bd29e.exe
-
Size
156KB
-
MD5
a3a883deb0920aca2147e9bc790bd29e
-
SHA1
0b06feef7b46fbae18046fa10696641dcb7d2525
-
SHA256
8fca81f4bb1fd5c2657f10f1f3286be89a21fe7fec34298c967a8982f4357f50
-
SHA512
c8d37b803139c33a22ce16c89779a83236f60f1bbbb0be87dfb404fd51e323d5312a0fd5a7a19d2e509b69b0b21405cfb8686022b2074b33d1704c8846dda0d3
-
SSDEEP
3072:tKzhSpGbGb6JUBGnvZHpXtNLdZkkVYaZvLStH/h7yc2dV4oQZiE3T:YljbGb6JaGnvZZtNLdZkRapLmH8c2dnc
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" gmkut.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" a3a883deb0920aca2147e9bc790bd29e.exe -
Executes dropped EXE 1 IoCs
pid Process 2988 gmkut.exe -
Loads dropped DLL 2 IoCs
pid Process 1456 a3a883deb0920aca2147e9bc790bd29e.exe 1456 a3a883deb0920aca2147e9bc790bd29e.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /B" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /R" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /A" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /H" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /T" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /B" a3a883deb0920aca2147e9bc790bd29e.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /q" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /p" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /s" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /y" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /X" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /L" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /F" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /Y" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /V" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /O" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /E" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /Z" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /a" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /n" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /U" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /M" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /v" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /P" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /W" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /N" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /c" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /Q" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /f" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /k" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /I" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /g" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /l" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /x" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /K" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /D" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /S" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /z" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /u" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /j" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /C" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /r" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /d" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /t" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /m" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /J" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /G" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /o" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /h" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /e" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /b" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /w" gmkut.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmkut = "C:\\Users\\Admin\\gmkut.exe /i" gmkut.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1456 a3a883deb0920aca2147e9bc790bd29e.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe 2988 gmkut.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1456 a3a883deb0920aca2147e9bc790bd29e.exe 2988 gmkut.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1456 wrote to memory of 2988 1456 a3a883deb0920aca2147e9bc790bd29e.exe 28 PID 1456 wrote to memory of 2988 1456 a3a883deb0920aca2147e9bc790bd29e.exe 28 PID 1456 wrote to memory of 2988 1456 a3a883deb0920aca2147e9bc790bd29e.exe 28 PID 1456 wrote to memory of 2988 1456 a3a883deb0920aca2147e9bc790bd29e.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3a883deb0920aca2147e9bc790bd29e.exe"C:\Users\Admin\AppData\Local\Temp\a3a883deb0920aca2147e9bc790bd29e.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\gmkut.exe"C:\Users\Admin\gmkut.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
MD5b75dafa0df3b73e350ebbc2ebf289e88
SHA1ed86ad1f4461015f9a43b8606a15190de39c8c93
SHA2566130b404c1472cbd06345a78758ddb9356577fcb2bca9f223544d56fa6dd316e
SHA5120388b734b9ffe4fca2d2d0cabb5bcdd0d2d7ac2dfd541ce00055713d873bd9a18857e66d1b5096b6ad426610e6ac7b66c5397bea79e06bf165e3157029b9d15d