2ceb025a3125915e904bc8861933f6d33960a5ad6c4c880c4ac89788253e6132

Analysis

max time kernel
143s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/09/2024, 22:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Repair.exe
Size

45KB
MD5

fb4d557b807fa75e0e4dc884654050be
SHA1

8322efdbf97194fa7608d09c793f87f792a49ad1
SHA256

c2d72aabe6421bd189ae22c1521d06e3c244e0e20062570d1fd7ff566b3264a3
SHA512

c0faa87d40cb9d34934b80e124d149487e6346de855f17a7923e60ecf16a82518cd0140d242fe7e10eeef5795880588258f16221f1628aa6b82cafa0689c37b4
SSDEEP

768:FlagqZbnDwyX/elk2yOBTB1dXsWi+AXNtKHxZfAHSdLl8+:FlWbDwy9OHvs75NtKffMip8+

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\UserName	GoKuai.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\PassWord	GoKuai.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\Time = 01000000	GoKuai.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\First = 01000000	GoKuai.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\CreateDriver = 01000000	GoKuai.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\RigthMenu = 01000000	GoKuai.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoKuai = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GoKuai.exe"	Repair.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoKuai = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GoKuai.exe mini"	GoKuai.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Repair.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regSvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoKuai.exe

Modifies registry class 17 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai\AgentPassword	GoKuai.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai\Recevies = 02000000	GoKuai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai\ = "{AEB6F97A-A60D-4B21-9D3C-687E490F227D}"	Repair.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai\Log = 00000000	GoKuai.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai\Message = 00000000	GoKuai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai\MessageContent	GoKuai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai\AgentUser	GoKuai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai\ = "{AEB6F97A-A60D-4B21-9D3C-687E490F227D}"	GoKuai.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai\NetType = 00000000	GoKuai.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai	Repair.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai\AgentIP	GoKuai.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai\AgentUseUser = 00000000	GoKuai.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai\Scandisk = 02000000	GoKuai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai\CurrentPath	GoKuai.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai	GoKuai.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai\Agent = 00000000	GoKuai.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai\AgentPort = 00000000	GoKuai.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2224	GoKuai.exe
2224	GoKuai.exe
2224	GoKuai.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2224	GoKuai.exe
2224	GoKuai.exe
2224	GoKuai.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
2448	Repair.exe
2448	Repair.exe
2224	GoKuai.exe
2224	GoKuai.exe
2224	GoKuai.exe
2224	GoKuai.exe
2224	GoKuai.exe
2224	GoKuai.exe
2224	GoKuai.exe
2224	GoKuai.exe
2224	GoKuai.exe
2224	GoKuai.exe
2224	GoKuai.exe
2224	GoKuai.exe
2224	GoKuai.exe
2224	GoKuai.exe
2224	GoKuai.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2828	2448	Repair.exe	30
PID 2448 wrote to memory of 2828	2448	Repair.exe	30
PID 2448 wrote to memory of 2828	2448	Repair.exe	30
PID 2448 wrote to memory of 2828	2448	Repair.exe	30
PID 2448 wrote to memory of 2828	2448	Repair.exe	30
PID 2448 wrote to memory of 2828	2448	Repair.exe	30
PID 2448 wrote to memory of 2828	2448	Repair.exe	30
PID 2448 wrote to memory of 2224	2448	Repair.exe	31
PID 2448 wrote to memory of 2224	2448	Repair.exe	31
PID 2448 wrote to memory of 2224	2448	Repair.exe	31
PID 2448 wrote to memory of 2224	2448	Repair.exe	31
PID 2448 wrote to memory of 2224	2448	Repair.exe	31
PID 2448 wrote to memory of 2224	2448	Repair.exe	31

C:\Users\Admin\AppData\Local\Temp\Repair.exe
"C:\Users\Admin\AppData\Local\Temp\Repair.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\regSvr32.exe
  regSvr32 /s /u "C:\Program Files\GoKuai\GokuaiOverlay.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2828
- C:\Users\Admin\AppData\Local\Temp\GoKuai.exe
  "C:\Users\Admin\AppData\Local\Temp\GoKuai.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2224