Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 03:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe
Resource
win7-20240729-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe
Resource
win10v2004-20240910-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe
-
Size
3.4MB
-
MD5
71dabc564af3f0481b304503f9528849
-
SHA1
aa12d4ba841bf5be52610b1426f8b5de8dcb211e
-
SHA256
1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7
-
SHA512
81d4b872be04283c46ea055eb2cd23ba30a7d7e077f9c945135b34f4a43846675cfe9e6bf28ac9bfc7488d2493ff9d0a9eca40434a257a0f1577a62501a10e14
-
SSDEEP
49152:Akny5smcY/pk3y5smcY/q4qiw3PASW9mMtN:Akny5sPWk3y5sP4gPALN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 3576 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.tmp 4184 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.mm 2112 GOG.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe" GOG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe" GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe" 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.mm Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe" 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.mm -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened (read-only) \??\B: 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\7-Zip\7z.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\GOG.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.mm File opened for modification C:\Windows\GOG.exe 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.mm File created C:\Windows\GOG.exe GOG.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.mm Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOG.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2 GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\WinX = "1" GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\NowCount = "0" GOG.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1328 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe 1328 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe 2112 GOG.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1328 wrote to memory of 4184 1328 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe 85 PID 1328 wrote to memory of 4184 1328 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe 85 PID 1328 wrote to memory of 4184 1328 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe 85 PID 4184 wrote to memory of 2112 4184 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.mm 87 PID 4184 wrote to memory of 2112 4184 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.mm 87 PID 4184 wrote to memory of 2112 4184 1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.mm 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe"C:\Users\Admin\AppData\Local\Temp\1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.tmpC:\Users\Admin\AppData\Local\Temp\1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.tmp2⤵
- Executes dropped EXE
PID:3576
-
-
C:\Users\Admin\AppData\Local\Temp\1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.mmC:\Users\Admin\AppData\Local\Temp\1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.mm /zhj2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\GOG.exeC:\Windows\GOG.exe /zhj3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2112
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.mm
Filesize2.3MB
MD5fa1c2f29469a12ae4a87ab9014a21059
SHA1ba597b5af90106a5794378a67df35b5c829d5ae8
SHA256db0ee4f4aaee1feb8bbe7bf27fda8660b0ef818da47440ef85e930ec58326f66
SHA5120a51b779495d81c877d43e535da5f46f38f08bb2425ec02a30ac49da8d62d0ecfde10225cf2bc794a350218ee5263ab2f5d9f28c913c919504f0260429cb69b7
-
C:\Users\Admin\AppData\Local\Temp\1d3286674d36491cf5acf083ff1edb16927309df54a3cb392db50049ce1985f7.tmp
Filesize1.0MB
MD52597aa6ae97e33320dfcb968c18128b3
SHA19366e7a9c66809a7480119ef241b95fd82cb55ba
SHA25609812edc4f8ab46b6d3535542b35c578bfc3da81ff56ff7148e539fcf90ef7da
SHA5124999d490f3a95ba3d5a08b93dd1555969cc15b2295c8294304b19b6b55b0957bb7ef4c3a632c19998835bd8f1637b22298b897733cd910d25d13855dedf36bce