Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12-09-2024 17:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe
Resource
win7-20240708-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe
-
Size
759KB
-
MD5
8a4c8f6a264659e548701da869c55996
-
SHA1
cda9ae8ddcab792b4ec84fe1468e2a0c0b60a1dc
-
SHA256
8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15
-
SHA512
dcc32ec7bbe951a2871a9ff23b20efb2d882345019bda0e36814cbb31f65b0a1b8b1fbb2c0728ecbda65cb89b7cd871405c14472ff7636913557b65554a61af7
-
SSDEEP
12288:x2JylsKTFW4VyPGDSBQkoZnkDfRgnqTzUjD5FZ9oU5DO69x:x2Jyxo4VR7ofGqTK7px
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 4232 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.tmp 4956 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.mm 1332 GOG.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe" 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.mm Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe" 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.mm Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe" GOG.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe" GOG.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened (read-only) \??\B: 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\7-Zip\7z.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\GOG.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.mm File opened for modification C:\Windows\GOG.exe 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.mm File created C:\Windows\GOG.exe GOG.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.mm -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2 GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\WinX = "1" GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\NowCount = "0" GOG.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2440 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe 2440 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe 1332 GOG.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2440 wrote to memory of 4232 2440 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe 83 PID 2440 wrote to memory of 4232 2440 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe 83 PID 2440 wrote to memory of 4232 2440 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe 83 PID 2440 wrote to memory of 4956 2440 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe 84 PID 2440 wrote to memory of 4956 2440 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe 84 PID 2440 wrote to memory of 4956 2440 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe 84 PID 4956 wrote to memory of 1332 4956 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.mm 85 PID 4956 wrote to memory of 1332 4956 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.mm 85 PID 4956 wrote to memory of 1332 4956 8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.mm 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe"C:\Users\Admin\AppData\Local\Temp\8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.tmpC:\Users\Admin\AppData\Local\Temp\8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.tmp2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4232
-
-
C:\Users\Admin\AppData\Local\Temp\8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.mmC:\Users\Admin\AppData\Local\Temp\8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.mm /zhj2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\GOG.exeC:\Windows\GOG.exe /zhj3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1332
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.mm
Filesize576KB
MD50e021f4daa3ad0bbd4da7caed4403334
SHA1dfb561632c35b9d282357a408ad80957f593a495
SHA2565fc2adfb3823227f257d2ca22d8f605e1c897e803ca5ea7ac9090530d98de858
SHA5129be3bcbb4d52f35fc5bc8c19e2e8df43f2a13675cbad2d3af02dc5c66805f3862bf4294a86c4dd8d0cf141e79b3047e6c579655b922c99374375efa3056950c9
-
C:\Users\Admin\AppData\Local\Temp\8504956e6eb66d157d8a492273ee15912f5b577c09d192a4bd4b816331d7aa15.tmp
Filesize183KB
MD5993834b83f59db2a8789d167c617f996
SHA191aaca70455f68c01a854fd446c918c0edbd21d2
SHA2560a567046bbc4e3b7997d2c57b933afc0ae4e8d7c3101a0b2d43c7c50b406e5ac
SHA51258deaf6eff84082fd2adf1dc1fdb0c5d5fb4e83cc1ab01fed607bd5a7e9601f804657f89fd794ee0efc0adaa240b78b461d2b6d45c0ebb8cad097fe1346ab01c