5ec01eb4511185582f3d34af1edd093a86d3f920602df198127dc826745bb4ec

Analysis

max time kernel
122s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 16:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GearUP-2.3.0-win.exe
Size

58.1MB
MD5

6087e8a5f12e1a6ab612a9f07565ffaf
SHA1

e8cea6b3efa2713d0b3c04d1b9c00d5e43b6db89
SHA256

5ec01eb4511185582f3d34af1edd093a86d3f920602df198127dc826745bb4ec
SHA512

8624d17a90d9e0a0ec29e54a8cd9bcc3f874704b888a55bf25b7167a9b30d6dfe2ebbabcd4551eb0b9ae78de78358082e79bb39a4c2a49d2dc76df3f59585b45
SSDEEP

1572864:eEKNLIzoQe7J5zmeCungo+kfhURMcklGtSoC:SK0QgGTF9SF

Score

8^/10

bootkit discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

Processes:

GearUP-2.3.0-win.exe

description	ioc	process
File created	C:\Windows\System32\drivers\hostpacket.sys	GearUP-2.3.0-win.exe
File opened for modification	C:\Windows\System32\drivers\hostpacket.sys	GearUP-2.3.0-win.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

gearup_booster.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\AF_uuid_gearupboosterpc = "d65850cd-7469-4091-aaf0-64631e3c04f8"	gearup_booster.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\AF_counter_gearupboosterpc = "0"	gearup_booster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\GearUPBooster = "\"C:\\Program Files (x86)\\GearUPBooster\\launcher.exe\" /silent"	gearup_booster.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

gearup_booster.exe

description ioc process

File opened for modification \??\PhysicalDrive0 gearup_booster.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

description	ioc	process
File opened for modification	\??\PhysicalDrive0	gearup_booster.exe

Drops file in Program Files directory 64 IoCs

Processes:

7za.exegearup_booster_render.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\GearUPBooster\9151\lspinst_x64.exe	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\zh-CN.pak	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9151\gearup_booster.exe	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9151\tap_driver\i386\NW_TAP_0909.inf	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9151\gearup_booster_render.exe	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9151\wfp\win7\x64\nwwfp.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\tr.pak	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9151\tap_driver\x64\nw_tap_0921.cat	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9151\uninstall.exe	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\libGLESv2.dll	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\uk.pak	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9151\tap_driver\i386\nw_tap_0909.cat	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\lt.pak	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\it.pak	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\sl.pak	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9151\sentry.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9151\wfp\win\x64\gunfwfp.sys	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\gu.pak	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\id.pak	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\snapshot_blob.bin	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9151\drvinst_x64.exe	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9151\api-ms-win-crt-runtime-l1-1-0.dll	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9151\browser_d.dll	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\libEGL.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9151\debug.log	gearup_booster_render.exe
File created	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\ar.pak	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\nb.pak	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9151\tap_driver\x64\NW_TAP_0921.inf	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9151\api-ms-win-core-timezone-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9151\api-ms-win-crt-math-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9151\hostfp\64\hostpacket.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9151\tap_driver\x64	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\ca.pak	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\he.pak	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\tr.pak	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9151\tap_driver\i386\tap0901.cat	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9151\api-ms-win-core-localization-l1-2-0.dll	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9151\api-ms-win-core-synch-l1-2-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\d3dcompiler_47.dll	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\da.pak	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\es-419.pak	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9151\UETSdk.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9151\ui.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9151\msvcp100.dll	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9151\udp_connect_lsp64.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\vi.pak	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9151\tap_driver\arm64\OemVista.inf	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9151\api-ms-win-crt-runtime-l1-1-0.dll	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9151\wfp\win7\x32\nwwfp.sys	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\cef_100_percent.pak	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\da.pak	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9151\ws2detour_x64.dll	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9151\tap_driver\x64\NW_TAP_0909.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9151\wfp\win\x64	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\th.pak	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\ms.pak	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\sr.pak	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9151\api-ms-win-crt-stdio-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\cef_200_percent.pak	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\fil.pak	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9151\gearup_booster_render.exe	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9151\ngpush.dll	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9151\wfp\win7\x64\gunfwfp.sys	7za.exe

Executes dropped EXE 6 IoCs

Processes:

7za.exelauncher.exegearup_booster.execrashpad_handler.exegearup_booster_ball.exegearup_booster_render.exe

pid process

2900 7za.exe
2776 launcher.exe
2836 gearup_booster.exe
1580 crashpad_handler.exe
1632 gearup_booster_ball.exe
2744 gearup_booster_render.exe

pid	process
2900	7za.exe
2776	launcher.exe
2836	gearup_booster.exe
1580	crashpad_handler.exe
1632	gearup_booster_ball.exe
2744	gearup_booster_render.exe

Loads dropped DLL 64 IoCs

Processes:

GearUP-2.3.0-win.exelauncher.exegearup_booster.execrashpad_handler.exe

pid	process
3008	GearUP-2.3.0-win.exe
3008	GearUP-2.3.0-win.exe
3008	GearUP-2.3.0-win.exe
3008	GearUP-2.3.0-win.exe
3008	GearUP-2.3.0-win.exe
3008	GearUP-2.3.0-win.exe
3008	GearUP-2.3.0-win.exe
3008	GearUP-2.3.0-win.exe
3008	GearUP-2.3.0-win.exe
3008	GearUP-2.3.0-win.exe
3008	GearUP-2.3.0-win.exe
3008	GearUP-2.3.0-win.exe
3008	GearUP-2.3.0-win.exe
3008	GearUP-2.3.0-win.exe
3008	GearUP-2.3.0-win.exe
3008	GearUP-2.3.0-win.exe
3008	GearUP-2.3.0-win.exe
3008	GearUP-2.3.0-win.exe
3008	GearUP-2.3.0-win.exe
3008	GearUP-2.3.0-win.exe
3008	GearUP-2.3.0-win.exe
2776	launcher.exe
2836	gearup_booster.exe
2836	gearup_booster.exe
2836	gearup_booster.exe
2836	gearup_booster.exe
2836	gearup_booster.exe
2836	gearup_booster.exe
2836	gearup_booster.exe
2836	gearup_booster.exe
2836	gearup_booster.exe
2836	gearup_booster.exe
2836	gearup_booster.exe
2836	gearup_booster.exe
2836	gearup_booster.exe
2836	gearup_booster.exe
2836	gearup_booster.exe
2836	gearup_booster.exe
2836	gearup_booster.exe
2836	gearup_booster.exe
2836	gearup_booster.exe
2836	gearup_booster.exe
2836	gearup_booster.exe
2836	gearup_booster.exe
2836	gearup_booster.exe
2836	gearup_booster.exe
2836	gearup_booster.exe
2836	gearup_booster.exe
2836	gearup_booster.exe
1580	crashpad_handler.exe
1580	crashpad_handler.exe
1580	crashpad_handler.exe
1580	crashpad_handler.exe
1580	crashpad_handler.exe
1580	crashpad_handler.exe
1580	crashpad_handler.exe
1580	crashpad_handler.exe
1580	crashpad_handler.exe
1580	crashpad_handler.exe
1580	crashpad_handler.exe
1580	crashpad_handler.exe
1580	crashpad_handler.exe
1580	crashpad_handler.exe
1580	crashpad_handler.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

gearup_booster.exeGearUP-2.3.0-win.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\gearup_booster.exe = "11000"	gearup_booster.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\gearup_booster.exe = "11000"	GearUP-2.3.0-win.exe

Modifies registry class 6 IoCs

Processes:

gearup_booster.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\shell\open\command	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\shell	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\shell\open	gearup_booster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\shell\open\command\ = "C:\\Program Files (x86)\\GearUPBooster\\9151\\gearup_booster.exe \"%1\""	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gu	gearup_booster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\URL Protocol	gearup_booster.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

gearup_booster.exe

pid process

2836 gearup_booster.exe

pid	process
2836	gearup_booster.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

7za.exe

description	pid	process
Token: SeRestorePrivilege	2900	7za.exe
Token: 35	2900	7za.exe
Token: SeSecurityPrivilege	2900	7za.exe
Token: SeSecurityPrivilege	2900	7za.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

gearup_booster_ball.exegearup_booster.exe

pid process

1632 gearup_booster_ball.exe
2836 gearup_booster.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

gearup_booster_ball.exegearup_booster.exe

pid process

1632 gearup_booster_ball.exe
2836 gearup_booster.exe

pid	process
1632	gearup_booster_ball.exe
2836	gearup_booster.exe

pid	process
1632	gearup_booster_ball.exe
2836	gearup_booster.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

GearUP-2.3.0-win.exelauncher.exegearup_booster.exe

description	pid	process	target process
PID 3008 wrote to memory of 2900	3008	GearUP-2.3.0-win.exe	7za.exe
PID 3008 wrote to memory of 2900	3008	GearUP-2.3.0-win.exe	7za.exe
PID 3008 wrote to memory of 2900	3008	GearUP-2.3.0-win.exe	7za.exe
PID 3008 wrote to memory of 2900	3008	GearUP-2.3.0-win.exe	7za.exe
PID 3008 wrote to memory of 2672	3008	GearUP-2.3.0-win.exe	cmd.exe
PID 3008 wrote to memory of 2672	3008	GearUP-2.3.0-win.exe	cmd.exe
PID 3008 wrote to memory of 2672	3008	GearUP-2.3.0-win.exe	cmd.exe
PID 3008 wrote to memory of 2672	3008	GearUP-2.3.0-win.exe	cmd.exe
PID 3008 wrote to memory of 2776	3008	GearUP-2.3.0-win.exe	launcher.exe
PID 3008 wrote to memory of 2776	3008	GearUP-2.3.0-win.exe	launcher.exe
PID 3008 wrote to memory of 2776	3008	GearUP-2.3.0-win.exe	launcher.exe
PID 3008 wrote to memory of 2776	3008	GearUP-2.3.0-win.exe	launcher.exe
PID 3008 wrote to memory of 2776	3008	GearUP-2.3.0-win.exe	launcher.exe
PID 3008 wrote to memory of 2776	3008	GearUP-2.3.0-win.exe	launcher.exe
PID 3008 wrote to memory of 2776	3008	GearUP-2.3.0-win.exe	launcher.exe
PID 2776 wrote to memory of 2836	2776	launcher.exe	gearup_booster.exe
PID 2776 wrote to memory of 2836	2776	launcher.exe	gearup_booster.exe
PID 2776 wrote to memory of 2836	2776	launcher.exe	gearup_booster.exe
PID 2776 wrote to memory of 2836	2776	launcher.exe	gearup_booster.exe
PID 2776 wrote to memory of 2836	2776	launcher.exe	gearup_booster.exe
PID 2776 wrote to memory of 2836	2776	launcher.exe	gearup_booster.exe
PID 2776 wrote to memory of 2836	2776	launcher.exe	gearup_booster.exe
PID 2836 wrote to memory of 1580	2836	gearup_booster.exe	crashpad_handler.exe
PID 2836 wrote to memory of 1580	2836	gearup_booster.exe	crashpad_handler.exe
PID 2836 wrote to memory of 1580	2836	gearup_booster.exe	crashpad_handler.exe
PID 2836 wrote to memory of 1580	2836	gearup_booster.exe	crashpad_handler.exe
PID 2836 wrote to memory of 1580	2836	gearup_booster.exe	crashpad_handler.exe
PID 2836 wrote to memory of 1580	2836	gearup_booster.exe	crashpad_handler.exe
PID 2836 wrote to memory of 1580	2836	gearup_booster.exe	crashpad_handler.exe
PID 2836 wrote to memory of 1632	2836	gearup_booster.exe	gearup_booster_ball.exe
PID 2836 wrote to memory of 1632	2836	gearup_booster.exe	gearup_booster_ball.exe
PID 2836 wrote to memory of 1632	2836	gearup_booster.exe	gearup_booster_ball.exe
PID 2836 wrote to memory of 1632	2836	gearup_booster.exe	gearup_booster_ball.exe
PID 2836 wrote to memory of 1632	2836	gearup_booster.exe	gearup_booster_ball.exe
PID 2836 wrote to memory of 1632	2836	gearup_booster.exe	gearup_booster_ball.exe
PID 2836 wrote to memory of 1632	2836	gearup_booster.exe	gearup_booster_ball.exe
PID 2836 wrote to memory of 2744	2836	gearup_booster.exe	gearup_booster_render.exe
PID 2836 wrote to memory of 2744	2836	gearup_booster.exe	gearup_booster_render.exe
PID 2836 wrote to memory of 2744	2836	gearup_booster.exe	gearup_booster_render.exe
PID 2836 wrote to memory of 2744	2836	gearup_booster.exe	gearup_booster_render.exe
PID 2836 wrote to memory of 2744	2836	gearup_booster.exe	gearup_booster_render.exe
PID 2836 wrote to memory of 2744	2836	gearup_booster.exe	gearup_booster_render.exe
PID 2836 wrote to memory of 2744	2836	gearup_booster.exe	gearup_booster_render.exe

C:\Users\Admin\AppData\Local\Temp\GearUP-2.3.0-win.exe
"C:\Users\Admin\AppData\Local\Temp\GearUP-2.3.0-win.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:3008

C:\Program Files (x86)\GearUPBooster\gearup_booster_temp\7za.exe
"C:\Program Files (x86)\GearUPBooster\gearup_booster_temp\7za.exe" x "C:\Program Files (x86)\GearUPBooster\gearup_booster_temp\gearup_booster.zip" -o"C:\Program Files (x86)\GearUPBooster\" -aoa
2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2900

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c rd /s /q "C:\Program Files (x86)\GearUPBooster\gearup_booster_temp\"
2⤵
PID:2672

C:\Program Files (x86)\GearUPBooster\launcher.exe
"C:\Program Files (x86)\GearUPBooster\launcher.exe" /install_shortcut 1 /install_autorun 1
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776

C:\Program Files (x86)\GearUPBooster\9151\gearup_booster.exe
"C:\Program Files (x86)\GearUPBooster\9151\gearup_booster.exe" /install_shortcut 1 /install_autorun 1
3⤵
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2836

C:\Program Files (x86)\GearUPBooster\9151\crashpad_handler.exe
"C:\Program Files (x86)\GearUPBooster\9151\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry --metrics-dir=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry --url=https://sentry.guinfra.com:443/api/30/minidump/?sentry_client=sentry.native/0.5.3&sentry_key=e59bef2d0cf245eaa0d97f08c5eab5fe --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_proxy.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_tun.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_lsp.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\ccbfbed4-3a11-4f33-0f64-750f9b93c709.run\__sentry-event --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\ccbfbed4-3a11-4f33-0f64-750f9b93c709.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\ccbfbed4-3a11-4f33-0f64-750f9b93c709.run\__sentry-breadcrumb2 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x73f45160,0x73f45174,0x73f45184
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580

C:\Program Files (x86)\GearUPBooster\9151\gearup_booster_ball.exe
C:\Program Files (x86)\GearUPBooster\9151\gearup_booster_ball.exe /main_form_wnd 721394 /show_flag 0 /pos_x -1 /pos_y -1 /version 9151 /client_id 664ccd745ef20409f025c7fd /gray 0
4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1632

C:\Program Files (x86)\GearUPBooster\cef\3.0.0\gearup_booster_render.exe
"C:\Program Files (x86)\GearUPBooster\9151\..\cef\3.0.0\gearup_booster_render.exe" --type=renderer --force-device-scale-factor=1 --no-sandbox --primordial-pipe-token=ECE4C0DC4741526093BFEFE3D529278F --lang=en-US --lang=en --log-file="C:\Program Files (x86)\GearUPBooster\9151\debug.log" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --mojo-application-channel-token=ECE4C0DC4741526093BFEFE3D529278F --channel="2836.0.497745622\584765070" --mojo-platform-channel-handle=2784 /prefetch:1
4⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GearUPBooster\9151\MSVCP140.dll

Filesize
432KB

MD5
a6b18a2772631cdd06f95b19d66d2d4f

SHA1
c342250efab725f643e598f49d1710c74f78d022

SHA256
76cc277b564e69e35a0d9c440f013a52b5d25f43ba42fd0099d6fc1f05a6ce16

SHA512
f98e07c1b92ecfc662021e33486b660942de390b8e947126f304adee911da0574d6cac416748f6f03e6cce981737eb694fb3d2bcd80e1e207eba91a44b5f23e5

Download Submit
C:\Program Files (x86)\GearUPBooster\9151\VCRUNTIME140.dll

Filesize
88KB

MD5
81b11024a8ed0c9adfd5fbf6916b133c

SHA1
c87f446d9655ba2f6fddd33014c75dc783941c33

SHA256
eb6a3a491efcc911f9dff457d42fed85c4c170139414470ea951b0dafe352829

SHA512
e4b1c694cb028fa960d750fa6a202bc3a477673b097b2a9e0991219b9891b5f879aa13aa741f73acd41eb23feee58e3dd6032821a23e9090ecd9cc2c3ec826a1

Download Submit
C:\Program Files (x86)\GearUPBooster\9151\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
24KB

MD5
32d7b95b1bce23db9fbd0578053ba87f

SHA1
7e14a34ac667a087f66d576c65cd6fe6c1dfdd34

SHA256
104a76b41cbd9a945dba43a6ffa8c6de99db2105d4ce93a717729a9bd020f728

SHA512
7dad74a0e3820a8237bab48f4962fe43e5b60b00f003a5de563b4cf61ee206353c9689a639566dc009f41585b54b915ff04f014230f0f38416020e08c8a44cb4

Download Submit
C:\Program Files (x86)\GearUPBooster\9151\hostfp\64\hostpacket.sys

Filesize
37KB

MD5
5ac815ad2f4386140fe4c7eef3b06233

SHA1
6dd0e26f3c447602109253a7eaad59064c4162ca

SHA256
08d86eae497df069ef9e6525e9513a019ff7a9971780c1987fde858d51f4ed66

SHA512
98cf60aceabadc078e00ad1e274028714f7bbf3c86f0522ab423d50231156a2513e8cc1946b242c64af7287648e6d4ba5e630824b4d83134c471689db42fbbf5

Download Submit
C:\Program Files (x86)\GearUPBooster\9151\ping.dll

Filesize
710KB

MD5
a7082e2b178cabfc67ae3a0d4bb0186c

SHA1
f92bad91cf85aa48a6d19c3f340533b8346ff841

SHA256
253a4199122a49a25b6bd297cfb6f61c81502403b530a5486aab162a47571be3

SHA512
f8eb758927217fc5ea30b7a22f1ab26b72337445c53d4c116fa7915fe22c65acd680bf9719158c412eadfd009973844b01c0d2f6f1bcdb6bcd52dfbc0cbecb41

Download Submit
C:\Program Files (x86)\GearUPBooster\9151\skin.dll

Filesize
12.1MB

MD5
b1d67fe7075fb592cd0ffcf8236727a5

SHA1
3d28fb794e5b3bf1c94685fd5c885b5744d46787

SHA256
9ab05713a376b6697e497731d342a72a4255a70b311af983f6f8c2abff9aa10d

SHA512
eeccd87be46f6f4e70951182496409d1e2fc2a67d6244b505b9aaf5c8fdbf42ae8fbe757d2d23a9231b22e33e9e1600d16657de9a5198c27554e54eea83324f5

Download Submit
C:\Program Files (x86)\GearUPBooster\9151\ucrtbase.DLL

Filesize
879KB

MD5
3e0303f978818e5c944f5485792696fd

SHA1
3b6e3ea9f5a6bbdeda20d68b84e4b51dc48deb1d

SHA256
7041885b2a8300bf12a46510228ce8d103d74e83b1baf696b84ff3e5ab785dd1

SHA512
c2874029bd269e6b9f7000c48d0710c52664c44e91c3086df366c3456b8bce0ed4d7e5bcfe4bdd3d03b11b8245c65f4b848b6dc58e6ea7b1de9b3ca2fb3348bc

Download Submit
C:\Program Files (x86)\GearUPBooster\9151\ui.dll

Filesize
1.1MB

MD5
1b9328e4d104c83c29d3c8431f78e82e

SHA1
dbe2c770566fff51a818a4344d382c1fbbf0b7fe

SHA256
fe12fb6810a55a782907d1210adfb616de86b901f2a6e55d2a5ee0c001a16a60

SHA512
188bab4fdad861ce0d470ae1ac9bfa4f60a856981372196d084cd858c857afce6b48240d26f384a01f3f6f63300a8f786052b3f39a2705e475b1dff9ea0ada0c

Download Submit
C:\Program Files (x86)\GearUPBooster\cef\3.0.0\gearup_booster_render.exe

Filesize
1009KB

MD5
561e2e81dc8a2abc5c648cdf5b407099

SHA1
1ac32fc3858032aa6d3c37b4ef8f2b92fe585e2d

SHA256
271dae8bcb2d3f40ab65c3feeed49b9ae2cdd91bfe16230971289e28570c9a7f

SHA512
2601e48ad443b98f8b207265eb8e46e6889c4d656e0f677b4f4d7cbc4fc1b1b031189e382f4d118eef6f4b54cb2d16a8179d2184cd8580d8b928b847a46315a8

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GearUP Booster.lnk

Filesize
1KB

MD5
94cdf8c4600fea06aa36d545e536192a

SHA1
b44bd59df90f94f079defd65b9ed625809e72784

SHA256
34365b7daed41dddc8e0aaf71ba1114a2cb8ba31f01c2424a297899cda06c56b

SHA512
e8d4aed167012f07e459d65a7b345649a323c376dd955eeddc69bc4d6783923b07c3c18a354e6993afb7c5e49bf68a40239eb099388b2d05b8c96555a013fccd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8E0F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8E21.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
\Program Files (x86)\GearUPBooster\9151\api-ms-win-core-file-l1-2-0.dll

Filesize
18KB

MD5
f6d1216e974fb76585fd350ebdc30648

SHA1
f8f73aa038e49d9fcf3bd05a30dc2e8cbbe54a7c

SHA256
348b70e57ae0329ac40ac3d866b8e896b0b8fef7e8809a09566f33af55d33271

SHA512
756ee21ba895179a5b6836b75aeefb75389b0fe4ae2aaff9ed84f33075094663117133c810ab2e697ec04eaffd54ff03efa3b9344e467a847acea9f732935843

Download Submit
\Program Files (x86)\GearUPBooster\9151\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
bfb08fb09e8d68673f2f0213c59e2b97

SHA1
e1e5ff4e7dd1c902afbe195d3e9fd2a7d4a539f2

SHA256
6d5881719e9599bf10a4193c8e2ded2a38c10de0ba8904f48c67f2da6e84ed3e

SHA512
e4f33306f3d06ea5c8e539ebdb6926d5f818234f481ff4605a9d5698ae8f2afdf79f194acd0e55ac963383b78bb4c9311ee97f3a188e12fbf2ee13b35d409900

Download Submit
\Program Files (x86)\GearUPBooster\9151\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
3b9d034ca8a0345bc8f248927a86bf22

SHA1
95faf5007daf8ba712a5d17f865f0e7938da662b

SHA256
a7ac7ece5e626c0b4e32c13299e9a44c8c380c8981ce4965cbe4c83759d2f52d

SHA512
04f0830878e0166ffd1220536592d0d7ec8aacd3f04340a8d91df24d728f34fbbd559432e5c35f256d231afe0ae926139d7503107cea09bfd720ad65e19d1cdc

Download Submit
\Program Files (x86)\GearUPBooster\9151\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
18KB

MD5
c2ead5fcce95a04d31810768a3d44d57

SHA1
96e791b4d217b3612b0263e8df2f00009d5af8d8

SHA256
42a9a3d8a4a7c82cb6ec42c62d3a522daa95beb01ecb776aac2bfd4aa1e58d62

SHA512
c90048481d8f0a5eda2eb6e7703b5a064f481bb7d8c78970408b374cb82e89febc2e36633f1f3e28323fb633d6a95aa1050a626cb0cb5ec62e9010491aae91f4

Download Submit
\Program Files (x86)\GearUPBooster\9151\api-ms-win-core-synch-l1-2-0.dll

Filesize
18KB

MD5
f6b4d8d403d22eb87a60bf6e4a3e7041

SHA1
b51a63f258b57527549d5331c405eacc77969433

SHA256
25687e95b65d0521f8c737df301bf90db8940e1c0758bb6ea5c217cf7d2f2270

SHA512
1acd8f7bc5d3ae1db46824b3a5548b33e56c9bac81dcd2e7d90fdbd1d3dd76f93cdf4d52a5f316728f92e623f73bc2ccd0bc505a259dff20c1a5a2eb2f12e41b

Download Submit
\Program Files (x86)\GearUPBooster\9151\api-ms-win-core-timezone-l1-1-0.dll

Filesize
18KB

MD5
a20084f41b3f1c549d6625c790b72268

SHA1
e3669b8d89402a047bfbf9775d18438b0d95437e

SHA256
0fa42237fd1140fd125c6edb728d4c70ad0276c72fa96c2faabf7f429fa7e8f1

SHA512
ddf294a47dd80b3abfb3a0d82bc5f2b510d3734439f5a25da609edbbd9241ed78045114d011925d61c3d80b1ccd0283471b1dad4cf16e2194e9bc22e8abf278f

Download Submit
\Program Files (x86)\GearUPBooster\9151\api-ms-win-crt-heap-l1-1-0.dll

Filesize
19KB

MD5
39d81596a7308e978d67ad6fdccdd331

SHA1
a0b2d43dd1c27d8244d11495e16d9f4f889e34c4

SHA256
3d109fd01f6684414d8a1d0d2f5e6c5b4e24de952a0695884744a6cbd44a8ec7

SHA512
0ef6578de4e6ba55eda64691892d114e154d288c419d05d6cff0ef4240118c20a4ce7f4174eec1a33397c6cd0135d13798dc91cc97416351775f9abf60fcae76

Download Submit
\Program Files (x86)\GearUPBooster\9151\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
22KB

MD5
ae3fa6bf777b0429b825fb6b028f8a48

SHA1
b53dbfdb7c8deaa9a05381f5ac2e596830039838

SHA256
66b86ed0867fe22e80b9b737f3ee428be71f5e98d36f774abbf92e3aaca71bfb

SHA512
1339e7ce01916573e7fdd71e331eeee5e27b1ddd968cadfa6cbc73d58070b9c9f8d9515384af004e5e015bd743c7a629eb0c62a6c0fa420d75b069096c5d1ece

Download Submit
\Program Files (x86)\GearUPBooster\9151\api-ms-win-crt-string-l1-1-0.dll

Filesize
24KB

MD5
5e72659b38a2977984bbc23ed274f007

SHA1
ea622d608cc942bdb0fad118c8060b60b2e985c9

SHA256
44a4db6080f6bdae6151f60ae5dc420faa3be50902e88f8f14ad457dec3fe4ea

SHA512
ed3cb656a5f5aee2cc04dd1f25b1390d52f3e85f0c7742ed0d473a117d2ac49e225a0cb324c31747d221617abcd6a9200c16dd840284bb29155726a3aa749bb1

Download Submit
\Program Files (x86)\GearUPBooster\9151\gearup_booster.exe

Filesize
7.6MB

MD5
8d7f18343f185b4146af6396e424a249

SHA1
9e3c963d321cff2f65d3ffcacdce36d7c5ebcfb4

SHA256
32fb170dd4d1683b30ca2f1cd5c35be3cd576542cc29c1b989c8d886e9b831e4

SHA512
b257b21e0cc584aebff3bb327e0d8a6ad36865e7ff883b2cb893f5504c3fb1f1c59aa81d0496748a7dc5fe14c2c8f37cc794cb6b737ee61ba8e98f9f1d612f58

Download Submit
\Program Files (x86)\GearUPBooster\9151\gearup_booster_ball.exe

Filesize
1.4MB

MD5
8dd4e1a559bad1de26925f39cd7e8e67

SHA1
d4746f499c69cd91200bbbd0c8d5bbf9b782259a

SHA256
b53b2b921e900e5ac5f3c9a6f58dbef252f2fafc0b7ecf56f3d859fdb2f26483

SHA512
5c66489587de433f8217b8ed58a5dca8907cac31d3cb58f527e69a1c9797cef8712269639231b56c6ecf963c18514901bdd3fa45e0a94e53076f83ddb424ccaa

Download Submit
\Program Files (x86)\GearUPBooster\9151\gearup_booster_vpn.dll

Filesize
33KB

MD5
a4055204b9211f1dad069c24982eb457

SHA1
4a84d314b44fe696ccb61c07eb610d4dba7e3c6b

SHA256
6bc2331433f7102c5df5fb62080f8b245a96792d4c0bd201740a6cd25fb17145

SHA512
35fac723830e3102aabe995fbb9503b5c3670d3c1aa84d8ed3c4739b3c4f482acb142a97ab07aef97216756f2dbfaa31381ad675a41777c248a4b2ffdb08eaa0

Download Submit
\Program Files (x86)\GearUPBooster\9151\sentry.dll

Filesize
426KB

MD5
bf9002bf5c878cdca749025a5f875d6b

SHA1
e916d3121706dbd1ada335b414e4601373b86ef8

SHA256
4d9af7c5442387ed91671d2f0360eb6cba3baa3c706b8f6b898d3018b8c7fb05

SHA512
34873e1bd9c077046469db3a2176581aea162933c39c51f1ded462030fb2238a93b3d7e20ff14a497be42e019f2f23add141d98b662b395618bf69ed74a90a20

Download Submit
\Program Files (x86)\GearUPBooster\9151\uninstall.exe

Filesize
2.1MB

MD5
14946a604db272db7834997c83ea1cef

SHA1
fe468e14e2a6ecac13f87818899642d03b8f9bb9

SHA256
965799236864dd98c6f33e9b7b9eac5178c5ada62b2f59d6497197c059010326

SHA512
5d4c39d48190a7a3cb558e60fe1202740869817f6a4e2585e8c2554a187d2e77fd049ef2e26089ecdb45f6f91df514acc0b42deb9073f7bc60daf06bdc81867d

Download Submit
\Program Files (x86)\GearUPBooster\9151\update.exe

Filesize
2.2MB

MD5
773dfc8417e8739748f9128d8c0dbaa6

SHA1
b6b488b3c352cac9f37988c1045d019716837b7d

SHA256
95c1763f76cd02e37dc8c41ce663728c651eee7e250df8234077b596ac481ea9

SHA512
b21f796cd4f01e64c626172e1e5b5813cf83662846db25eec290abf30246edb5a33532d9daf635d56fe95ccb96653f52b6749e93c8bf55b4511d1221b2b346de

Download Submit
\Program Files (x86)\GearUPBooster\gearup_booster_temp\7za.exe

Filesize
589KB

MD5
c6d72642721e84d227defc3ec4ab12e6

SHA1
3709a7c3cc795a0012adc6ccaf82a93628703518

SHA256
0cc0de83b51dae55a4fcae559defc87bea8448010d064c316abcfe9459ece035

SHA512
fa2c8b9fa34b190be45fc363f4760603cb6a389bc01fd617a1861ac709eef5e5dd42ea3d5524a1660ea8202dc17687265cd9bb87f5b4c9a9cf714744a8489389

Download Submit
\Program Files (x86)\GearUPBooster\launcher.exe

Filesize
921KB

MD5
d51e6dc64aef429325232e11ef69561d

SHA1
b3670e5cd5a13662dc91b912d1122c9095a7e468

SHA256
e50a1a27b2afa39049062a5f509c57617f03cf40ec07e31916b903806e3fd1a1

SHA512
89e03048248403073b4e31f79127903160ad3171828445d996e87de584d94081dac2ead90e39feaf3c75b6ed1e4ab0ddfc6d535aef9fdc5677cc7a1ea7de6344

Download Submit
memory/2744-438-0x000000000B600000-0x000000000B601000-memory.dmp

Filesize
4KB

Download