Analysis
-
max time kernel
149s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/09/2024, 22:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe
Resource
win7-20240708-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe
-
Size
2.4MB
-
MD5
19ed63fd4ad42c31550f0c8a62945c86
-
SHA1
09dacf77ecbe2ec3035fbf726bdb41b55173e93c
-
SHA256
c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce
-
SHA512
bd8ed9f637e30f80756dd180e863ad97278bcb1f864803321e7d2eb79dfede1e65153dde8e442ac13ab56249692ca3ac2d1c054e05d234a143f349e4d02fba1e
-
SSDEEP
24576:x2Jyxd4VR7of2SI8LUlFl5FpW2Jyxt4VR7of2SI8LUlFl5FpQt:Akny5smcY/pk3y5smcY/6
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 3664 c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.tmp 4284 c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.mm 2244 GOG.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe" c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.mm Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe" c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.mm Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe" GOG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe" GOG.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened (read-only) \??\B: c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\7-Zip\7zG.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\dotnet\dotnet.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\7-Zip\7z.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\GOG.exe GOG.exe File created C:\Windows\GOG.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.mm File opened for modification C:\Windows\GOG.exe c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.mm -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.mm Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOG.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2 GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\WinX = "1" GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\NowCount = "0" GOG.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 928 c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe 928 c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe 2244 GOG.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 928 wrote to memory of 3664 928 c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe 90 PID 928 wrote to memory of 3664 928 c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe 90 PID 928 wrote to memory of 4284 928 c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe 92 PID 928 wrote to memory of 4284 928 c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe 92 PID 928 wrote to memory of 4284 928 c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe 92 PID 4284 wrote to memory of 2244 4284 c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.mm 93 PID 4284 wrote to memory of 2244 4284 c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.mm 93 PID 4284 wrote to memory of 2244 4284 c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.mm 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe"C:\Users\Admin\AppData\Local\Temp\c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.tmpC:\Users\Admin\AppData\Local\Temp\c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.tmp2⤵
- Executes dropped EXE
PID:3664
-
-
C:\Users\Admin\AppData\Local\Temp\c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.mmC:\Users\Admin\AppData\Local\Temp\c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.mm /zhj2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\GOG.exeC:\Windows\GOG.exe /zhj3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2244
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3724,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:81⤵PID:3944
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.mm
Filesize2.3MB
MD5fa1c2f29469a12ae4a87ab9014a21059
SHA1ba597b5af90106a5794378a67df35b5c829d5ae8
SHA256db0ee4f4aaee1feb8bbe7bf27fda8660b0ef818da47440ef85e930ec58326f66
SHA5120a51b779495d81c877d43e535da5f46f38f08bb2425ec02a30ac49da8d62d0ecfde10225cf2bc794a350218ee5263ab2f5d9f28c913c919504f0260429cb69b7
-
C:\Users\Admin\AppData\Local\Temp\c0d2748c32c4160171dd31014d688dfa8ce325df72b6b12f58b14bf8f8416fce.tmp
Filesize23KB
MD58e9ab961e3f490a0f8e4eb4a7a53ac7c
SHA1a751fe3b595d7c8e0fd5d7203c02274a471a89bd
SHA256d10da3a4b904c690a70f5e6184d6c935b9ae781f81762cb8028dc71580cb9bee
SHA512c0787718f3cc09aec220ef7a94cc0a3e78d8e90f892d74108989ccc648edfbf9b6df7ca5a56805508e6555161458e86d6284691fc77074c12cb81f31212d66f6