Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/09/2024, 13:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe
Resource
win7-20240704-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe
-
Size
713KB
-
MD5
a65f39014391ca9618a3797b7db107b6
-
SHA1
1c026203d4491fa9e32dea9446dceb897e9678c0
-
SHA256
be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6
-
SHA512
af3b71dccef99596e1a7aa7d73e65217d9905b2b7cb5b2e783ea379f41af001f8f198a0e74484ec747afd2eb10b3596af58191d8fa511ec39380cdaf52ce51d8
-
SSDEEP
12288:x2JylsKTLW4VyPGDSBQkoZnkDfRgn9gkinRNh4uHF:x2Jyxu4VR7ofGRYhHl
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 4060 be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.tmp 3556 be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.mm 2860 GOG.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe" GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe" be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.mm Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe" be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.mm Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe" GOG.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened (read-only) \??\B: be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\7-Zip\7zG.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\7-Zip\7z.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\dotnet\dotnet.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\GOG.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.mm File created C:\Windows\GOG.exe GOG.exe File created C:\Windows\GOG.exe be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.mm -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.mm Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOG.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2 GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\WinX = "1" GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\NowCount = "0" GOG.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1912 be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe 1912 be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe 2860 GOG.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1912 wrote to memory of 4060 1912 be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe 86 PID 1912 wrote to memory of 4060 1912 be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe 86 PID 1912 wrote to memory of 4060 1912 be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe 86 PID 1912 wrote to memory of 3556 1912 be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe 87 PID 1912 wrote to memory of 3556 1912 be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe 87 PID 1912 wrote to memory of 3556 1912 be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe 87 PID 3556 wrote to memory of 2860 3556 be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.mm 88 PID 3556 wrote to memory of 2860 3556 be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.mm 88 PID 3556 wrote to memory of 2860 3556 be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.mm 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe"C:\Users\Admin\AppData\Local\Temp\be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.tmpC:\Users\Admin\AppData\Local\Temp\be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.tmp2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4060
-
-
C:\Users\Admin\AppData\Local\Temp\be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.mmC:\Users\Admin\AppData\Local\Temp\be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.mm /zhj2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\GOG.exeC:\Windows\GOG.exe /zhj3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2860
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.mm
Filesize576KB
MD51873c525fd470b3be7d4675e21fc1381
SHA116cdb3cac70ccfb1e368585ea86fd535f19fc503
SHA256132338c108d9ca4d2ca11259d47dca4b77bd75a9c07a35d00ab3d4d3b6468566
SHA512664e118ea3a2d664692a7fef252144a1e27c837744ed7f53b42013b10f79f158637a2ec12692b0e37432cde293903aa592bf06ccbaa594de036767ff3ab1aecc
-
C:\Users\Admin\AppData\Local\Temp\be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6.tmp
Filesize137KB
MD532b8ad6eca9094891e792631baea9717
SHA15536b7532400baf27beb2bfd425159264ad71136
SHA2569efdf94d2ec05d3dad9b39c06f98038d1d407385eff5629ba8d7a920be18da8e
SHA512a175012b243f118eab0f571beea874503403cec1d080def788a45d36c2cb94515f8c1e278da410d07040c89d8a344e4fba98c40a9bdef7480c7ab33354fbfeba