gink | 33d0e46d6c97c08714ed50827be56818c8982552bf44caf73a6d38e77ced81d7

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e8579577031de7f4925a87584aa1030.exe
Size

37KB
MD5

1e8579577031de7f4925a87584aa1030
SHA1

e5d1299af95d5c586027329770c748b86f6d7011
SHA256

33d0e46d6c97c08714ed50827be56818c8982552bf44caf73a6d38e77ced81d7
SHA512

83b75cdd37fb89cef9bcee4a8f25c46358097a568c6500f9f43803dd1a1aa8497c20dac133885f7f836425216f2e84b93b67b034bed707afcebb51f7fb59b6f4
SSDEEP

384:tBG2VowjQ4vmWHsbyDYiMXJhjgjsVV9vwnI8K9ICUo:rLSwjQ4+W6yDoXzjgjsII8uICD

Score

10^/10

gink persistence worm

Malware Config

Signatures

Gink
worm gink

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

1e8579577031de7f4925a87584aa1030.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\I-Worm.GiGu = "uGiG.eXe"	1e8579577031de7f4925a87584aa1030.exe

Drops file in System32 directory 3 IoCs

Processes:

1e8579577031de7f4925a87584aa1030.exe

description	ioc	process
File created	C:\Windows\SysWOW64\GiGu.eXe	1e8579577031de7f4925a87584aa1030.exe
File opened for modification	C:\Windows\SysWOW64\GiGu.eXe	1e8579577031de7f4925a87584aa1030.exe
File created	C:\Windows\SysWOW64\GiGu.eml	1e8579577031de7f4925a87584aa1030.exe

Drops file in Windows directory 2 IoCs

Processes:

1e8579577031de7f4925a87584aa1030.exe

description	ioc	process
File created	C:\Windows\uGiG.eXe	1e8579577031de7f4925a87584aa1030.exe
File opened for modification	C:\Windows\uGiG.eXe	1e8579577031de7f4925a87584aa1030.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2252 2208 WerFault.exe 1e8579577031de7f4925a87584aa1030.exe

pid	pid_target	process	target process
2252	2208	WerFault.exe	1e8579577031de7f4925a87584aa1030.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1e8579577031de7f4925a87584aa1030.exe

description	pid	process	target process
PID 2208 wrote to memory of 2252	2208	1e8579577031de7f4925a87584aa1030.exe	WerFault.exe
PID 2208 wrote to memory of 2252	2208	1e8579577031de7f4925a87584aa1030.exe	WerFault.exe
PID 2208 wrote to memory of 2252	2208	1e8579577031de7f4925a87584aa1030.exe	WerFault.exe
PID 2208 wrote to memory of 2252	2208	1e8579577031de7f4925a87584aa1030.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1e8579577031de7f4925a87584aa1030.exe
"C:\Users\Admin\AppData\Local\Temp\1e8579577031de7f4925a87584aa1030.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 176
  2⤵
  - Program crash
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2208-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2208-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2208-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download