Overview
overview
4Static
static
3Graillon-F...de.pdf
windows10-1703-x64
1Graillon-F...de.pdf
windows11-21h2-x64
1Graillon-F...et.pdf
windows10-1703-x64
1Graillon-F...et.pdf
windows11-21h2-x64
1Graillon-F...on2.so
windows10-1703-x64
3Graillon-F...on2.so
windows11-21h2-x64
3Graillon-F...n 2.so
windows10-1703-x64
3Graillon-F...n 2.so
windows11-21h2-x64
3Graillon-F...n 2.so
windows10-1703-x64
3Graillon-F...n 2.so
windows11-21h2-x64
3Graillon-F....0.pkg
windows10-1703-x64
3Graillon-F....0.pkg
windows11-21h2-x64
3Graillon-F....0.exe
windows10-1703-x64
4Graillon-F....0.exe
windows11-21h2-x64
4$PLUGINSDI...em.dll
windows10-1703-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PROGRAMFI... 2.dll
windows10-1703-x64
1$PROGRAMFI... 2.dll
windows11-21h2-x64
1$PROGRAMFI... 2.dll
windows10-1703-x64
1$PROGRAMFI... 2.dll
windows11-21h2-x64
1$PROGRAMFI...64.dll
windows10-1703-x64
1$PROGRAMFI...64.dll
windows11-21h2-x64
1$_26_/Aubu...64.dll
windows10-1703-x64
1$_26_/Aubu...64.dll
windows11-21h2-x64
1$_27_/Aubu... 2.dll
windows10-1703-x64
3$_27_/Aubu... 2.dll
windows11-21h2-x64
3$_28_/Grai...64.dll
windows10-1703-x64
1$_28_/Grai...64.dll
windows11-21h2-x64
1Graillon-F...e.html
windows10-1703-x64
1Graillon-F...e.html
windows11-21h2-x64
1Resubmissions
07-07-2024 20:29
240707-y91taaxgjk 407-07-2024 20:21
240707-y48lyaxflq 420-04-2024 11:56
240420-n355bagg7x 4Analysis
-
max time kernel
147s -
max time network
162s -
platform
windows11-21h2_x64 -
resource
win11-20240704-en -
resource tags
arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system -
submitted
07-07-2024 20:21
Static task
static1
Behavioral task
behavioral1
Sample
Graillon-FREE-2.8/Graillon 2 User's Guide.pdf
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Graillon-FREE-2.8/Graillon 2 User's Guide.pdf
Resource
win11-20240704-en
Behavioral task
behavioral3
Sample
Graillon-FREE-2.8/Graillon Datasheet.pdf
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
Graillon-FREE-2.8/Graillon Datasheet.pdf
Resource
win11-20240704-en
Behavioral task
behavioral5
Sample
Graillon-FREE-2.8/Linux/Linux-64b-LV2-FREE/Auburn Sounds Graillon 2.lv2/AuburnSoundsGraillon2.so
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
Graillon-FREE-2.8/Linux/Linux-64b-LV2-FREE/Auburn Sounds Graillon 2.lv2/AuburnSoundsGraillon2.so
Resource
win11-20240704-en
Behavioral task
behavioral7
Sample
Graillon-FREE-2.8/Linux/Linux-64b-VST2-FREE/Auburn Sounds Graillon 2.so
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
Graillon-FREE-2.8/Linux/Linux-64b-VST2-FREE/Auburn Sounds Graillon 2.so
Resource
win11-20240704-en
Behavioral task
behavioral9
Sample
Graillon-FREE-2.8/Linux/Linux-64b-VST3-FREE/Auburn Sounds Graillon 2.vst3/Contents/x86_64-linux/Auburn Sounds Graillon 2.so
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
Graillon-FREE-2.8/Linux/Linux-64b-VST3-FREE/Auburn Sounds Graillon 2.vst3/Contents/x86_64-linux/Auburn Sounds Graillon 2.so
Resource
win11-20240704-en
Behavioral task
behavioral11
Sample
Graillon-FREE-2.8/Mac/Graillon-2-FREE-2.8.0.pkg
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
Graillon-FREE-2.8/Mac/Graillon-2-FREE-2.8.0.pkg
Resource
win11-20240704-en
Behavioral task
behavioral13
Sample
Graillon-FREE-2.8/Windows/Graillon-2-FREE-2.8.0.exe
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
Graillon-FREE-2.8/Windows/Graillon-2-FREE-2.8.0.exe
Resource
win11-20240508-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240508-en
Behavioral task
behavioral17
Sample
$PROGRAMFILES/Common Files/VST3/Auburn Sounds Graillon 2.dll
Resource
win10-20240404-en
Behavioral task
behavioral18
Sample
$PROGRAMFILES/Common Files/VST3/Auburn Sounds Graillon 2.dll
Resource
win11-20240704-en
Behavioral task
behavioral19
Sample
$PROGRAMFILES64/Common Files/Avid/Audio/Plug-Ins/Auburn Sounds Graillon 2.aaxplugin/Contents/x64/Auburn Sounds Graillon 2.dll
Resource
win10-20240404-en
Behavioral task
behavioral20
Sample
$PROGRAMFILES64/Common Files/Avid/Audio/Plug-Ins/Auburn Sounds Graillon 2.aaxplugin/Contents/x64/Auburn Sounds Graillon 2.dll
Resource
win11-20240704-en
Behavioral task
behavioral21
Sample
$PROGRAMFILES64/Common Files/VST3/Auburn Sounds Graillon 2-64.dll
Resource
win10-20240404-en
Behavioral task
behavioral22
Sample
$PROGRAMFILES64/Common Files/VST3/Auburn Sounds Graillon 2-64.dll
Resource
win11-20240704-en
Behavioral task
behavioral23
Sample
$_26_/Auburn Sounds Graillon 2-64.dll
Resource
win10-20240404-en
Behavioral task
behavioral24
Sample
$_26_/Auburn Sounds Graillon 2-64.dll
Resource
win11-20240704-en
Behavioral task
behavioral25
Sample
$_27_/Auburn Sounds Graillon 2.dll
Resource
win10-20240404-en
Behavioral task
behavioral26
Sample
$_27_/Auburn Sounds Graillon 2.dll
Resource
win11-20240704-en
Behavioral task
behavioral27
Sample
$_28_/Graillon 2/Graillon 2_x64.dll
Resource
win10-20240404-en
Behavioral task
behavioral28
Sample
$_28_/Graillon 2/Graillon 2_x64.dll
Resource
win11-20240704-en
Behavioral task
behavioral29
Sample
Graillon-FREE-2.8/license.html
Resource
win10-20240404-en
Behavioral task
behavioral30
Sample
Graillon-FREE-2.8/license.html
Resource
win11-20240704-en
General
-
Target
Graillon-FREE-2.8/Mac/Graillon-2-FREE-2.8.0.pkg
-
Size
12.7MB
-
MD5
35e28833d89c33c03ca54bffde68f0c5
-
SHA1
504c2b44bd7f275eba21e38436b33fa00523a809
-
SHA256
13b38d812daf62bb83c51104d79a3af63722b01a3828a949b23e1d72d6da6934
-
SHA512
117c0c5d01d570d948411d90d8ffadab273259520cb697c6ce9925dbd271cdd82f42637e90597e5d2707ff883c5070003cc5c4fe23d53b8b87d0a497a0108018
-
SSDEEP
393216:EgpL3mSU/XqWitXzCs4X+kIliCYjd1q3C4Ay9yv:DLltDK2l4jdKC4/u
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2133704870-72480668-1360283475-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2133704870-72480668-1360283475-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4300 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Graillon-FREE-2.8\Mac\Graillon-2-FREE-2.8.0.pkg1⤵
- Modifies registry class
PID:1720
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4300