Overview
overview
5Static
static
5GenP 3.4.1...ix.zip
windows7-x64
3GenP 3.4.1...ix.zip
windows10-2004-x64
1GenP-3.4.14.0.exe
windows7-x64
1GenP-3.4.14.0.exe
windows10-2004-x64
1NSudoLG.exe
windows7-x64
1NSudoLG.exe
windows10-2004-x64
1README.txt
windows7-x64
1README.txt
windows10-2004-x64
1SOURCE/Gen....0.ps1
windows7-x64
3SOURCE/Gen....0.ps1
windows10-2004-x64
3SOURCE/ICONS/Logo.ico
windows7-x64
3SOURCE/ICONS/Logo.ico
windows10-2004-x64
3config.ini
windows7-x64
1config.ini
windows10-2004-x64
1Analysis
-
max time kernel
109s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
05/08/2024, 08:30
Static task
static1
Behavioral task
behavioral1
Sample
GenP 3.4.14.0 - Release Edition - Hotfix.zip
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral2
Sample
GenP 3.4.14.0 - Release Edition - Hotfix.zip
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
GenP-3.4.14.0.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral4
Sample
GenP-3.4.14.0.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
NSudoLG.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral6
Sample
NSudoLG.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
README.txt
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral8
Sample
README.txt
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
SOURCE/GenP-3.4.14.0.ps1
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral10
Sample
SOURCE/GenP-3.4.14.0.ps1
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
SOURCE/ICONS/Logo.ico
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral12
Sample
SOURCE/ICONS/Logo.ico
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
config.ini
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral14
Sample
config.ini
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
GenP 3.4.14.0 - Release Edition - Hotfix.zip
-
Size
801KB
-
MD5
95a6799e1740f4ae3aaa7790297dfd1f
-
SHA1
81d8a0b8a3ccb0c93df2f086643fdaa1a9f40c93
-
SHA256
5d79a45ff16d4f1dd622512bbd3b15bdb2586f1d496e108c3b75d84329195f9b
-
SHA512
d8eca710648f5212ff2f33016642e83b597c59f3bfc9df122a45f39bc79f83b275834013c81e59fbfaa5770bfdee1ce04bdef6e579f657843a9bd82646dc1912
-
SSDEEP
12288:zMWAAZgaW6qSRkMWOwjLNWORMDPfAJ3kJXT3A7n1wFTBuCV4sXoGmT0xDO1vDndS:rZpW6UMaxWOi43kJXTQpwvJqFvDnd68u
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1872 chrome.exe 1872 chrome.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe Token: SeShutdownPrivilege 1872 chrome.exe -
Suspicious use of FindShellTrayWindow 50 IoCs
pid Process 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe 1872 chrome.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1876 AcroRd32.exe 1876 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1872 wrote to memory of 2276 1872 chrome.exe 39 PID 1872 wrote to memory of 2276 1872 chrome.exe 39 PID 1872 wrote to memory of 2276 1872 chrome.exe 39 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 2484 1872 chrome.exe 41 PID 1872 wrote to memory of 1752 1872 chrome.exe 42 PID 1872 wrote to memory of 1752 1872 chrome.exe 42 PID 1872 wrote to memory of 1752 1872 chrome.exe 42 PID 1872 wrote to memory of 1652 1872 chrome.exe 43 PID 1872 wrote to memory of 1652 1872 chrome.exe 43 PID 1872 wrote to memory of 1652 1872 chrome.exe 43 PID 1872 wrote to memory of 1652 1872 chrome.exe 43 PID 1872 wrote to memory of 1652 1872 chrome.exe 43 PID 1872 wrote to memory of 1652 1872 chrome.exe 43 PID 1872 wrote to memory of 1652 1872 chrome.exe 43 PID 1872 wrote to memory of 1652 1872 chrome.exe 43 PID 1872 wrote to memory of 1652 1872 chrome.exe 43 PID 1872 wrote to memory of 1652 1872 chrome.exe 43 PID 1872 wrote to memory of 1652 1872 chrome.exe 43 PID 1872 wrote to memory of 1652 1872 chrome.exe 43 PID 1872 wrote to memory of 1652 1872 chrome.exe 43 PID 1872 wrote to memory of 1652 1872 chrome.exe 43 PID 1872 wrote to memory of 1652 1872 chrome.exe 43 PID 1872 wrote to memory of 1652 1872 chrome.exe 43 PID 1872 wrote to memory of 1652 1872 chrome.exe 43 PID 1872 wrote to memory of 1652 1872 chrome.exe 43 PID 1872 wrote to memory of 1652 1872 chrome.exe 43
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\GenP 3.4.14.0 - Release Edition - Hotfix.zip"1⤵PID:2232
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2812
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1876
-
C:\Program Files\windows defender\MSASCui.exe"C:\Program Files\windows defender\MSASCui.exe" -quickscan1⤵PID:2492
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5759758,0x7fef5759768,0x7fef57597782⤵PID:2276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1144 --field-trial-handle=1084,i,2746344298944152497,15767600473423171787,131072 /prefetch:22⤵PID:2484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 --field-trial-handle=1084,i,2746344298944152497,15767600473423171787,131072 /prefetch:82⤵PID:1752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1560 --field-trial-handle=1084,i,2746344298944152497,15767600473423171787,131072 /prefetch:82⤵PID:1652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2204 --field-trial-handle=1084,i,2746344298944152497,15767600473423171787,131072 /prefetch:12⤵PID:2688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2220 --field-trial-handle=1084,i,2746344298944152497,15767600473423171787,131072 /prefetch:12⤵PID:940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1472 --field-trial-handle=1084,i,2746344298944152497,15767600473423171787,131072 /prefetch:22⤵PID:2612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1396 --field-trial-handle=1084,i,2746344298944152497,15767600473423171787,131072 /prefetch:12⤵PID:564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3984 --field-trial-handle=1084,i,2746344298944152497,15767600473423171787,131072 /prefetch:12⤵PID:1932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3952 --field-trial-handle=1084,i,2746344298944152497,15767600473423171787,131072 /prefetch:82⤵PID:2540
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
209KB
MD53e552d017d45f8fd93b94cfc86f842f2
SHA1dbeebe83854328e2575ff67259e3fb6704b17a47
SHA25627d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
SHA512e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
363B
MD5ea6b87e5fea51a822c984ba24038594e
SHA14019b138c931297c5179d736bc3d6c10a3520f71
SHA25643b93c66d3037afb5018aaf674505744f493bb9f83b4302774881b4977ea4e27
SHA512202d9f401e835eb96f521fd8ec4aa54b45655ab5eaf54c8e1d87655234bd35ec84067fa1f18853d5f79ddf25c7741a90ae479511b07a2a127b127ef6b95710a8
-
Filesize
5KB
MD517d59599d73bbde543138172d2306313
SHA1dfc2f25b81f985d1d48d72d3a00378082f935928
SHA256bbfbf219b7226a94880c8fb6de33be00e517f3f3071db0259a76a499fade4ba9
SHA5126cc9d2f8a4986d2c30d70d3e13250be027c385b2ae1b236379a1ea8182afee749aae28c523a3e85a70ad22f2196cecdd0de455777adcea025d202651c4787a49
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Filesize16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
3KB
MD5f7900616e13476686ade2b5527a6f84b
SHA11a05a3341e9684d83b1d27ee06768dc51eb5f36b
SHA2567c6efd265c73a6a2519bd27256926b25e28198350b6680f32abf4333ce80a44c
SHA5125e2a4401f5dc5552fc40c9d0bbc761e43eb8eed1e064ebcf9b04cb5baca707393a8aafaad2daa515c435abe690e1380495ae6112be90a747246b4d70a388728e