Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/09/2024, 00:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe
-
Size
2.4MB
-
MD5
52c10c34c1e47e862ae7be4e0700881e
-
SHA1
382a5d38e1b877f4a755d2773ec82381be5cf258
-
SHA256
0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8
-
SHA512
61482832a81b723c1b26d227368d6011b0ad969aa6aa7453f26132e706c6990ba12045e99d1ffe6d453acaf3558990ea9715b5563cc6ffd83a60d3f80c7226d8
-
SSDEEP
24576:x2Jyxd4VR7of2SI8LUlFl5FpW2Jyxt4VR7of2SI8LUlFl5FpA:Akny5smcY/pk3y5smcY/A
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 3028 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.tmp 2808 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.mm 4412 GOG.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe" 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.mm Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe" 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.mm Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe" GOG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe" GOG.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened (read-only) \??\A: 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\7-Zip\7z.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\GOG.exe GOG.exe File created C:\Windows\GOG.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.mm File opened for modification C:\Windows\GOG.exe 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.mm -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.mm -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2 GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\WinX = "1" GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\NowCount = "0" GOG.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 904 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe 904 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe 4412 GOG.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 904 wrote to memory of 3028 904 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe 82 PID 904 wrote to memory of 3028 904 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe 82 PID 904 wrote to memory of 2808 904 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe 85 PID 904 wrote to memory of 2808 904 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe 85 PID 904 wrote to memory of 2808 904 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe 85 PID 2808 wrote to memory of 4412 2808 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.mm 86 PID 2808 wrote to memory of 4412 2808 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.mm 86 PID 2808 wrote to memory of 4412 2808 0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.mm 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe"C:\Users\Admin\AppData\Local\Temp\0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.tmpC:\Users\Admin\AppData\Local\Temp\0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.tmp2⤵
- Executes dropped EXE
PID:3028
-
-
C:\Users\Admin\AppData\Local\Temp\0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.mmC:\Users\Admin\AppData\Local\Temp\0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.mm /zhj2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\GOG.exeC:\Windows\GOG.exe /zhj3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4412
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.mm
Filesize2.3MB
MD5fa1c2f29469a12ae4a87ab9014a21059
SHA1ba597b5af90106a5794378a67df35b5c829d5ae8
SHA256db0ee4f4aaee1feb8bbe7bf27fda8660b0ef818da47440ef85e930ec58326f66
SHA5120a51b779495d81c877d43e535da5f46f38f08bb2425ec02a30ac49da8d62d0ecfde10225cf2bc794a350218ee5263ab2f5d9f28c913c919504f0260429cb69b7
-
C:\Users\Admin\AppData\Local\Temp\0dddc378582f23131f7b46485cd61dcffd4feea4e2004507abd46bc69717fae8.tmp
Filesize44KB
MD5c98a9c4113cdddaa18af53186927bd6f
SHA197d220e4f533772e0a94e908f290f69225bd546c
SHA256ececb5ae6f8abe3ded7ba20aed25490e9cbb4fccc6a08b26bfdd27fffc9c8a64
SHA5126fc9e33392285c7858d58bb5bce67e9b95f5e84bc97b4e3521d77bd51b7efeaa48de884cd055de1574b68c077dbb54a3c442d790158b3a5a9c7b550294953510