Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
10/06/2024, 00:55
General
-
Target
CyberGhostVPNSetup.exe
-
Size
127KB
-
MD5
fd093f3100a56b710c50d41667da7e2b
-
SHA1
5ec9063e4380f642d2a551da76fd4d3f00fd4c96
-
SHA256
f6dfae75fd23c0446ec1721994cf2530c66bd76366423176414747b39153bf58
-
SHA512
d3daebf6e3669a4b2a944e60d97c86fd31878cea66e252f05ea8d23f92c1f02ef8e6f4dda250b979a9b9df3fa71dc43c4ab98e2cae52e7687861d1e9a3dd09c0
-
SSDEEP
3072:ACNd5JY06+ywjDnJShh8N7JNzFrxO/DLxPO4GV:TNVPtVQ7LtOz
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies system certificate store 2 TTPs 7 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CyberGhostVPNSetup.exe"C:\Users\Admin\AppData\Local\Temp\CyberGhostVPNSetup.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7a5b54fd-f883-46fe-a3b2-8455044557fd\81d3716f-204f-45bd-8e3e-26110982dad7.exe"C:\Program Files\7a5b54fd-f883-46fe-a3b2-8455044557fd\81d3716f-204f-45bd-8e3e-26110982dad7.exe" "C:\Users\Admin\AppData\Local\Temp\CyberGhostVPNSetup.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.0MB
MD572540194bd451dac050609406eb50a56
SHA157c33ec10f90f81f6abc612b4d251510c36ebd6b
SHA2563a18d5fd76abcfe537d78457dab4797231af313028b5594231f019245c5f7a74
SHA512ec9b24c877e82269aba78701a9828879e8b91580c4d3002227ee18868b8db76b6c0fba08e687aba1ea3127eea05e37124e2b615c224b33e4dac2512dbefb3444
-
Filesize
2KB
MD5647f843626b023aaaa748f924f95ac25
SHA1652cacf99409e3dcd39b6eb8839c16d22b1800e8
SHA256732dee732e0261afbfba21eca43008a5009cfc9e4c405ece8826a9746564cceb
SHA51261093dcbe07efa5bdffec4933243168bf40b8159bc5a9840552bc3ea8e7c129156276a8548c658e5267bf0b8c4448dcb5c8ab10140c72ed48eb8910c075022fa
-
Filesize
8KB
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
592KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
640KB
-
Filesize
104KB
-
Filesize
280KB
-
Filesize
56KB
-
Filesize
168KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
10.8MB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
88KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
224KB
-
Filesize
56KB
-
Filesize
224KB
-
Filesize
232KB
-
Filesize
600KB
-
Filesize
136KB
-
Filesize
40KB
-
Filesize
232KB
-
Filesize
712KB
-
Filesize
72KB
-
Filesize
5.1MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB