0ae3643f0b7b9c28b6578c1eea340c3e237025f8e0340fd750aa2cf1f70200e4

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0ae3643f0b7b9c28b6578c1eea340c3e237025f8e0340fd750aa2cf1f70200e4.exe
Size 694KB
Sample240613-xp6clayapf
SHA256 0ae3643f0b7b9c28b6578c1eea340c3e237025f8e0340fd750aa2cf1f70200e4
MD5 3d21d8a5b4e8b4da98428899d842a679
SHA1 89d6ff3364bf8bf137900fb425950428f6cb859e
SHA512 a7cd4cb6859d2523cbd477314e7bb1447690993aacfe9d91bb0b82d7d9544e9df41d23356ef93be7e4ff5e40383afb3de58c718dc1f90a27db52544cd5eac87f
SSDEEP 3072:MGjhaq5iL0beJQZt32wLji5DlsODxRPNDkjJHzW9hUd56JsuBSjwA2i1vP2i1a1O:Hha8iAx+1zwjJHd6vB/ANMfBEcY
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GGAAAG_LOADER = "C:\\Windows\\system32\\GAAG.exe"	0ae3643f0b7b9c28b6578c1eea340c3e237025f8e0340fd750aa2cf1f70200e4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FifefoxUpdater = "C:\\Windows\\system32\\FifefoxUpdater.scr"	0ae3643f0b7b9c28b6578c1eea340c3e237025f8e0340fd750aa2cf1f70200e4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinSevenUpdater = "C:\\Windows\\system32\\AVSCANNER.EXE"	0ae3643f0b7b9c28b6578c1eea340c3e237025f8e0340fd750aa2cf1f70200e4.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\GAAG.exe	0ae3643f0b7b9c28b6578c1eea340c3e237025f8e0340fd750aa2cf1f70200e4.exe
File opened for modification	C:\Windows\SysWOW64\GAAG.exe	0ae3643f0b7b9c28b6578c1eea340c3e237025f8e0340fd750aa2cf1f70200e4.exe
File created	C:\Windows\SysWOW64\FifefoxUpdater.scr	0ae3643f0b7b9c28b6578c1eea340c3e237025f8e0340fd750aa2cf1f70200e4.exe
File opened for modification	C:\Windows\SysWOW64\FifefoxUpdater.scr	0ae3643f0b7b9c28b6578c1eea340c3e237025f8e0340fd750aa2cf1f70200e4.exe
File created	C:\Windows\SysWOW64\AVSCANNER.EXE	0ae3643f0b7b9c28b6578c1eea340c3e237025f8e0340fd750aa2cf1f70200e4.exe
File opened for modification	C:\Windows\SysWOW64\AVSCANNER.EXE	0ae3643f0b7b9c28b6578c1eea340c3e237025f8e0340fd750aa2cf1f70200e4.exe

C:\Users\Admin\AppData\Local\Temp\0ae3643f0b7b9c28b6578c1eea340c3e237025f8e0340fd750aa2cf1f70200e4.exe
"C:\Users\Admin\AppData\Local\Temp\0ae3643f0b7b9c28b6578c1eea340c3e237025f8e0340fd750aa2cf1f70200e4.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AVSCANNER.EXE

Path C:\Windows\SysWOW64\AVSCANNER.EXE
Size 704KB
SHA256 77483bde039d5ed325cec546514a45d62ff8172772e93ee6fab9da630207869a
MD5 1041112ac5e5dad0a2b029358adc5d74
SHA1 cbf1d71535d3f947b45338471191516fde3418d2
SHA512 b1c53121f6f29c0f64e27820d8d7025211880e83befc0d8ef739aecd2357c8b398434987e62b9f6ce2e2294fc3e79c9bced0a8c71a8011ec20d7ae9dcb8decc9
SSDEEP 3072:MGjhaq5iL0beJQZt32wLji5DlsODxRPNDkjJHzW9hUd56JsuBSjwA2i1vP2i1a1r:Hha8iAx+1zwjJHd6vB/ANMfBEcp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2236-0-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/2236-7-0x0000000000400000-0x000000000044C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads