Analysis
-
max time kernel
149s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12-09-2024 22:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe
-
Size
2.4MB
-
MD5
4b2a2315c7e46a835378c300c9a41bc2
-
SHA1
81f0c37931f9e1716c15d93b45f2c7ff998625f3
-
SHA256
1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467
-
SHA512
aae1507c7049abf6e5f4c93e984065bb2ce8234223699b696c6c4c615d49752698284866634dd1efe90fdaf5aa2dbdd235cf0e99c93178767bfad8ec15b51ee2
-
SSDEEP
24576:x2Jyxs4VR7of2SI8LUlFl5FpW2Jyxt4VR7of2SI8LUlFl5Fp5t:Akuy5smcY/pk3y5smcY/L
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 4476 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.tmp 4488 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.mm 3056 GOG.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe" GOG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe" GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe" 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.mm Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe" 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.mm -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened (read-only) \??\B: 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\7-Zip\7z.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\GOG.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.mm File opened for modification C:\Windows\GOG.exe 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.mm File created C:\Windows\GOG.exe GOG.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.mm Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOG.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2 GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\WinX = "1" GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\NowCount = "0" GOG.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1744 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe 1744 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe 3056 GOG.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1744 wrote to memory of 4476 1744 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe 92 PID 1744 wrote to memory of 4476 1744 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe 92 PID 1744 wrote to memory of 4488 1744 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe 94 PID 1744 wrote to memory of 4488 1744 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe 94 PID 1744 wrote to memory of 4488 1744 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe 94 PID 4488 wrote to memory of 3056 4488 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.mm 95 PID 4488 wrote to memory of 3056 4488 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.mm 95 PID 4488 wrote to memory of 3056 4488 1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.mm 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe"C:\Users\Admin\AppData\Local\Temp\1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.tmpC:\Users\Admin\AppData\Local\Temp\1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.tmp2⤵
- Executes dropped EXE
PID:4476
-
-
C:\Users\Admin\AppData\Local\Temp\1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.mmC:\Users\Admin\AppData\Local\Temp\1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.mm /zhj2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\GOG.exeC:\Windows\GOG.exe /zhj3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3056
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3928,i,4356837537417149674,16553092232944545509,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:81⤵PID:4228
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.mm
Filesize2.3MB
MD5d147cf092d7f25b9157e5ca44c37bc0b
SHA16b3863d0914d8f85bec721e6e36ecc3478be2316
SHA256076a28b738e112c758474175b2d8fc40523110797099bcb1a729a81587bd5b61
SHA5121769e77b008e51a36d97392b30148e8e2ad7371ffe1523625006ad231aec272895e865ba71a2d265281c5f1a81407618e13e461ca69f5ad650d720f8ed5d0f97
-
C:\Users\Admin\AppData\Local\Temp\1f519daf1e46561042c1e7769460ccc562e3aef4603389d2f7c21c384cb8c467.tmp
Filesize23KB
MD51d4355b8760a718ddf49f2a3d7563088
SHA1c964410d1090d0474ec4fbaf13a42acd319427a0
SHA256e269a601af99f141496be19a20e2581481a95ca3000ee1a7694e100bf8bb4e66
SHA5123c3d2937123084bb43d2f57aee99eb315cd8df848500878f627bd91967566c160104f54454603f8d540c806a25b556a4af5a6e1fd050de032a018019d9ca2211