Analysis
-
max time kernel
150s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12-09-2024 22:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe
-
Size
2.8MB
-
MD5
955886fbb39070b38ebcd57ac633bac6
-
SHA1
905df3aae3c7c074d24b4b0f50c6d59edfd16e0c
-
SHA256
cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef
-
SHA512
270f155928f14ae65ad00289757abd849ebf8501b432562080627fb3d38b9f2151674d0b3baa8ecfdc20f6902b727255a59df9945681a7d1aa1ceaa0629a78a2
-
SSDEEP
24576:x2JyxY4VR7of2SI8LUlFl5FpW2Jyxt4VR7of2SI8LUlFl5FpV3Td9CHKy7GZj:Ak+y5smcY/pk3y5smcY/1Td9CHKyaJ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 764 cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.tmp 1868 cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.mm 5080 GOG.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe" cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.mm Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe" cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.mm Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe" GOG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe" GOG.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened (read-only) \??\A: cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zG.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\dotnet\dotnet.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\7-Zip\7z.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\GOG.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.mm File opened for modification C:\Windows\GOG.exe cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.mm File created C:\Windows\GOG.exe GOG.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.mm Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOG.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2 GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\WinX = "1" GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\NowCount = "0" GOG.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3432 cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe 3432 cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe 2184 javaws.exe 2184 javaws.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe 5080 GOG.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3432 wrote to memory of 764 3432 cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe 83 PID 3432 wrote to memory of 764 3432 cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe 83 PID 764 wrote to memory of 2184 764 cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.tmp 84 PID 764 wrote to memory of 2184 764 cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.tmp 84 PID 3432 wrote to memory of 1868 3432 cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe 85 PID 3432 wrote to memory of 1868 3432 cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe 85 PID 3432 wrote to memory of 1868 3432 cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe 85 PID 1868 wrote to memory of 5080 1868 cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.mm 86 PID 1868 wrote to memory of 5080 1868 cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.mm 86 PID 1868 wrote to memory of 5080 1868 cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.mm 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe"C:\Users\Admin\AppData\Local\Temp\cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.tmpC:\Users\Admin\AppData\Local\Temp\cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.tmp2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Program Files\Java\jre-1.8\bin\javaws.exeC:\Users\Admin\AppData\Local\Temp\cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.tmp3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2184
-
-
-
C:\Users\Admin\AppData\Local\Temp\cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.mmC:\Users\Admin\AppData\Local\Temp\cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.mm /zhj2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\GOG.exeC:\Windows\GOG.exe /zhj3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5080
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.mm
Filesize2.3MB
MD577fc9c405debbb2580bef92d47178f0b
SHA19b01ebceb3a18c046d757b4d5e3bdafcfcf8528a
SHA256740286034979dce5f11affcd22e0fd6e9921961347972c3b4e5882c888b24322
SHA512536b5ce69e58af3029d0bcf56c35b1bbd290a6935b2108c6c1b81694569cad75de04bb502f70a02f333127f90b61982c5a6904db0f683da679d1d45c50a50788
-
C:\Users\Admin\AppData\Local\Temp\cadae5e93987206be803ef00e058c94484419c192eaeda9227bf49331d42a7ef.tmp
Filesize465KB
MD5fd59bee8a0c37d8c92ab8f66c31d4532
SHA1485d2515f381098266bacaca1a2ca69ec5c10db3
SHA2567b8f726ea8d677a8f3cccf6fb162460b0074e0c05c353222a49960388d66eb7f
SHA5129fa870b308b1ec355e1a1ccbd10a1c7e2fb58028e198dd195388d7c8266805632fb622829142bc36696a829f7c59ec700ce1223ffce1d979743a2b5891bae644