Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 23:02
Static task
static1
Behavioral task
behavioral1
Sample
70fe3bc78ea9f2efcb3ba2992a730006248eed1223840cc1d15aac17dfe4a9d1.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
70fe3bc78ea9f2efcb3ba2992a730006248eed1223840cc1d15aac17dfe4a9d1.exe
Resource
win10v2004-20240426-en
General
-
Target
70fe3bc78ea9f2efcb3ba2992a730006248eed1223840cc1d15aac17dfe4a9d1.exe
-
Size
775KB
-
MD5
3df65bf289e8aeb95472790365a26590
-
SHA1
c0311332ebb11f2459efb222edda5824480bd534
-
SHA256
70fe3bc78ea9f2efcb3ba2992a730006248eed1223840cc1d15aac17dfe4a9d1
-
SHA512
8df764e41c852e5c3fffe8457f32b3bff203a71b1e58b7ca28086aa5ed1bc106f9deef0697b686d443fd1413de6fc36d8034b6c12d886abe159dd862f269ec5d
-
SSDEEP
3072:MGjhaq5iL0beJQZt32wLji5DlsODxRPNDkjmHzW9hUd56JsuBSjwGPmO12i1DTBL:Hha8iAx+1zwjmHd6vB/jO11T9eYQYm
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
70fe3bc78ea9f2efcb3ba2992a730006248eed1223840cc1d15aac17dfe4a9d1.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FifefoxUpdater = "C:\\Windows\\system32\\FifefoxUpdater.scr" 70fe3bc78ea9f2efcb3ba2992a730006248eed1223840cc1d15aac17dfe4a9d1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinSevenUpdater = "C:\\Windows\\system32\\AVSCANNER.EXE" 70fe3bc78ea9f2efcb3ba2992a730006248eed1223840cc1d15aac17dfe4a9d1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\GGAAAG_LOADER = "C:\\Windows\\system32\\GAAG.exe" 70fe3bc78ea9f2efcb3ba2992a730006248eed1223840cc1d15aac17dfe4a9d1.exe -
Drops file in System32 directory 6 IoCs
Processes:
70fe3bc78ea9f2efcb3ba2992a730006248eed1223840cc1d15aac17dfe4a9d1.exedescription ioc process File opened for modification C:\Windows\SysWOW64\GAAG.exe 70fe3bc78ea9f2efcb3ba2992a730006248eed1223840cc1d15aac17dfe4a9d1.exe File created C:\Windows\SysWOW64\FifefoxUpdater.scr 70fe3bc78ea9f2efcb3ba2992a730006248eed1223840cc1d15aac17dfe4a9d1.exe File opened for modification C:\Windows\SysWOW64\FifefoxUpdater.scr 70fe3bc78ea9f2efcb3ba2992a730006248eed1223840cc1d15aac17dfe4a9d1.exe File created C:\Windows\SysWOW64\AVSCANNER.EXE 70fe3bc78ea9f2efcb3ba2992a730006248eed1223840cc1d15aac17dfe4a9d1.exe File opened for modification C:\Windows\SysWOW64\AVSCANNER.EXE 70fe3bc78ea9f2efcb3ba2992a730006248eed1223840cc1d15aac17dfe4a9d1.exe File created C:\Windows\SysWOW64\GAAG.exe 70fe3bc78ea9f2efcb3ba2992a730006248eed1223840cc1d15aac17dfe4a9d1.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\AVSCANNER.EXEFilesize
784KB
MD5583e3845428bbd5e331500d14fc3904c
SHA1737740034e4890b777df83a69f7a771f91a89f91
SHA256e1b4f7c07903ca51436c4aae4e91435d7bd57ab7541d8c80bb7b8c232563fd8f
SHA51246a1942696460fad4c16953f1b821aa1a1bdf86cffd489b80453478c23f9a237b1fcb4eb60b846fe9dcd38272039bf4ea8d8db996e441831738b4bee7c380d6d
-
memory/1148-0-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1148-7-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB