Overview
overview
10Static
static
3ggpermV3.rar
windows10-2004-x64
1ggpermV3/A...64.exe
windows10-2004-x64
1ggpermV3/F...er.bat
windows10-2004-x64
1ggpermV3/N...on.dll
windows10-2004-x64
1ggpermV3/S...UI.dll
windows10-2004-x64
1ggpermV3/T...er.exe
windows10-2004-x64
10ggpermV3/a...64.sys
windows10-2004-x64
1ggpermV3/ggpermV3.exe
windows10-2004-x64
3ggpermV3/m...er.bat
windows10-2004-x64
3ggpermV3/s...er.exe
windows10-2004-x64
1ggpermV3/s...er.exe
windows10-2004-x64
1ggpermV3/s...er.pdb
windows10-2004-x64
3ggpermV3/s...g.json
windows10-2004-x64
3ggpermV3/woof.bat
windows10-2004-x64
8Resubmissions
09/11/2024, 22:49
241109-2r2veatfrl 1009/11/2024, 22:47
241109-2qkjqssrdz 1009/11/2024, 22:46
241109-2p2fvstfqj 1009/11/2024, 22:44
241109-2nsgkasrbt 1007/11/2024, 16:00
241107-tfl1taxpgl 1010/02/2024, 17:17
240210-vtnl8sge36 10Analysis
-
max time kernel
120s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 22:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ggpermV3.rar
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ggpermV3/AMIDEWINx64.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
ggpermV3/Final_Cleaner.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
ggpermV3/Newtonsoft.Json.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
ggpermV3/Siticone.UI.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
ggpermV3/Trinity Cleaner.exe
Resource
win10v2004-20241007-en
defense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealer
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral7
Sample
ggpermV3/amifldrv64.sys
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
ggpermV3/ggpermV3.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
ggpermV3/macchanger.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
ggpermV3/sxghr-driver.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
ggpermV3/sxghr-driver.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
ggpermV3/sxghr-driver.pdb
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
ggpermV3/sxghr-driver.runtimeconfig.json
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
ggpermV3/woof.bat
-
Size
1KB
-
MD5
9dfe4e730dcc5e0d3951038ad2a095a1
-
SHA1
e033d9a40234b9544606ec4d603add264cb38841
-
SHA256
bfffd2faf6710e02912de0eec63b593f35a8bebef114932b4a4bc9c67fad59b8
-
SHA512
297e9950fd207687af957a94c5fb7d073bb89dcebdd6ee047fa0465f55bb95b42563c7310980bf1e41ca671a1f8c824e86dfe515b844f99f307965d199d8dbfd
Malware Config
Signatures
-
Drops file in System32 directory 14 IoCs
description ioc Process File opened for modification C:\Windows\system32\wbem\repository\INDEX.BTR svchost.exe File opened for modification C:\Windows\system32\wbem\repository svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING1.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING2.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\WRITABLE.TST svchost.exe File opened for modification C:\Windows\system32\wbem\repository\OBJECTS.DATA svchost.exe File opened for modification C:\Windows\system32\wbem\repository\OBJECTS.DATA svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING3.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\INDEX.BTR svchost.exe File opened for modification C:\Windows\system32\wbem\repository\WRITABLE.TST svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING3.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING2.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING1.MAP svchost.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 320 sc.exe 4076 sc.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 1688 ipconfig.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe -
Suspicious behavior: LoadsDriver 26 IoCs
pid Process 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 3664 svchost.exe Token: SeIncreaseQuotaPrivilege 3664 svchost.exe Token: SeSecurityPrivilege 3664 svchost.exe Token: SeTakeOwnershipPrivilege 3664 svchost.exe Token: SeLoadDriverPrivilege 3664 svchost.exe Token: SeBackupPrivilege 3664 svchost.exe Token: SeRestorePrivilege 3664 svchost.exe Token: SeShutdownPrivilege 3664 svchost.exe Token: SeSystemEnvironmentPrivilege 3664 svchost.exe Token: SeManageVolumePrivilege 3664 svchost.exe Token: SeAssignPrimaryTokenPrivilege 3664 svchost.exe Token: SeIncreaseQuotaPrivilege 3664 svchost.exe Token: SeSecurityPrivilege 3664 svchost.exe Token: SeTakeOwnershipPrivilege 3664 svchost.exe Token: SeLoadDriverPrivilege 3664 svchost.exe Token: SeSystemtimePrivilege 3664 svchost.exe Token: SeBackupPrivilege 3664 svchost.exe Token: SeRestorePrivilege 3664 svchost.exe Token: SeShutdownPrivilege 3664 svchost.exe Token: SeSystemEnvironmentPrivilege 3664 svchost.exe Token: SeUndockPrivilege 3664 svchost.exe Token: SeManageVolumePrivilege 3664 svchost.exe Token: SeAssignPrimaryTokenPrivilege 3664 svchost.exe Token: SeIncreaseQuotaPrivilege 3664 svchost.exe Token: SeSecurityPrivilege 3664 svchost.exe Token: SeTakeOwnershipPrivilege 3664 svchost.exe Token: SeLoadDriverPrivilege 3664 svchost.exe Token: SeSystemtimePrivilege 3664 svchost.exe Token: SeBackupPrivilege 3664 svchost.exe Token: SeRestorePrivilege 3664 svchost.exe Token: SeShutdownPrivilege 3664 svchost.exe Token: SeSystemEnvironmentPrivilege 3664 svchost.exe Token: SeUndockPrivilege 3664 svchost.exe Token: SeManageVolumePrivilege 3664 svchost.exe Token: SeAssignPrimaryTokenPrivilege 3664 svchost.exe Token: SeIncreaseQuotaPrivilege 3664 svchost.exe Token: SeSecurityPrivilege 3664 svchost.exe Token: SeTakeOwnershipPrivilege 3664 svchost.exe Token: SeLoadDriverPrivilege 3664 svchost.exe Token: SeSystemtimePrivilege 3664 svchost.exe Token: SeBackupPrivilege 3664 svchost.exe Token: SeRestorePrivilege 3664 svchost.exe Token: SeShutdownPrivilege 3664 svchost.exe Token: SeSystemEnvironmentPrivilege 3664 svchost.exe Token: SeUndockPrivilege 3664 svchost.exe Token: SeManageVolumePrivilege 3664 svchost.exe Token: SeAssignPrimaryTokenPrivilege 3664 svchost.exe Token: SeIncreaseQuotaPrivilege 3664 svchost.exe Token: SeSecurityPrivilege 3664 svchost.exe Token: SeTakeOwnershipPrivilege 3664 svchost.exe Token: SeLoadDriverPrivilege 3664 svchost.exe Token: SeSystemtimePrivilege 3664 svchost.exe Token: SeBackupPrivilege 3664 svchost.exe Token: SeRestorePrivilege 3664 svchost.exe Token: SeShutdownPrivilege 3664 svchost.exe Token: SeSystemEnvironmentPrivilege 3664 svchost.exe Token: SeUndockPrivilege 3664 svchost.exe Token: SeManageVolumePrivilege 3664 svchost.exe Token: SeAssignPrimaryTokenPrivilege 3664 svchost.exe Token: SeIncreaseQuotaPrivilege 3664 svchost.exe Token: SeSecurityPrivilege 3664 svchost.exe Token: SeTakeOwnershipPrivilege 3664 svchost.exe Token: SeLoadDriverPrivilege 3664 svchost.exe Token: SeSystemtimePrivilege 3664 svchost.exe -
Suspicious use of FindShellTrayWindow 48 IoCs
pid Process 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe 1916 taskmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3928 wrote to memory of 4864 3928 cmd.exe 84 PID 3928 wrote to memory of 4864 3928 cmd.exe 84 PID 3928 wrote to memory of 3552 3928 cmd.exe 85 PID 3928 wrote to memory of 3552 3928 cmd.exe 85 PID 3928 wrote to memory of 4284 3928 cmd.exe 87 PID 3928 wrote to memory of 4284 3928 cmd.exe 87 PID 3928 wrote to memory of 2472 3928 cmd.exe 88 PID 3928 wrote to memory of 2472 3928 cmd.exe 88 PID 3928 wrote to memory of 1496 3928 cmd.exe 89 PID 3928 wrote to memory of 1496 3928 cmd.exe 89 PID 3928 wrote to memory of 2840 3928 cmd.exe 90 PID 3928 wrote to memory of 2840 3928 cmd.exe 90 PID 3928 wrote to memory of 2268 3928 cmd.exe 91 PID 3928 wrote to memory of 2268 3928 cmd.exe 91 PID 3928 wrote to memory of 4636 3928 cmd.exe 92 PID 3928 wrote to memory of 4636 3928 cmd.exe 92 PID 3928 wrote to memory of 1732 3928 cmd.exe 93 PID 3928 wrote to memory of 1732 3928 cmd.exe 93 PID 3928 wrote to memory of 2248 3928 cmd.exe 94 PID 3928 wrote to memory of 2248 3928 cmd.exe 94 PID 3928 wrote to memory of 4872 3928 cmd.exe 95 PID 3928 wrote to memory of 4872 3928 cmd.exe 95 PID 3928 wrote to memory of 3880 3928 cmd.exe 96 PID 3928 wrote to memory of 3880 3928 cmd.exe 96 PID 3928 wrote to memory of 2020 3928 cmd.exe 97 PID 3928 wrote to memory of 2020 3928 cmd.exe 97 PID 3928 wrote to memory of 4704 3928 cmd.exe 98 PID 3928 wrote to memory of 4704 3928 cmd.exe 98 PID 3928 wrote to memory of 3960 3928 cmd.exe 99 PID 3928 wrote to memory of 3960 3928 cmd.exe 99 PID 3928 wrote to memory of 4360 3928 cmd.exe 100 PID 3928 wrote to memory of 4360 3928 cmd.exe 100 PID 3928 wrote to memory of 4808 3928 cmd.exe 101 PID 3928 wrote to memory of 4808 3928 cmd.exe 101 PID 3928 wrote to memory of 1500 3928 cmd.exe 102 PID 3928 wrote to memory of 1500 3928 cmd.exe 102 PID 3928 wrote to memory of 1832 3928 cmd.exe 104 PID 3928 wrote to memory of 1832 3928 cmd.exe 104 PID 3928 wrote to memory of 2996 3928 cmd.exe 105 PID 3928 wrote to memory of 2996 3928 cmd.exe 105 PID 3928 wrote to memory of 2836 3928 cmd.exe 106 PID 3928 wrote to memory of 2836 3928 cmd.exe 106 PID 3928 wrote to memory of 764 3928 cmd.exe 107 PID 3928 wrote to memory of 764 3928 cmd.exe 107 PID 3928 wrote to memory of 3616 3928 cmd.exe 108 PID 3928 wrote to memory of 3616 3928 cmd.exe 108 PID 3928 wrote to memory of 1696 3928 cmd.exe 110 PID 3928 wrote to memory of 1696 3928 cmd.exe 110 PID 3928 wrote to memory of 2540 3928 cmd.exe 111 PID 3928 wrote to memory of 2540 3928 cmd.exe 111 PID 3928 wrote to memory of 3540 3928 cmd.exe 112 PID 3928 wrote to memory of 3540 3928 cmd.exe 112 PID 3928 wrote to memory of 2904 3928 cmd.exe 113 PID 3928 wrote to memory of 2904 3928 cmd.exe 113 PID 2904 wrote to memory of 4920 2904 net.exe 114 PID 2904 wrote to memory of 4920 2904 net.exe 114 PID 3928 wrote to memory of 2220 3928 cmd.exe 121 PID 3928 wrote to memory of 2220 3928 cmd.exe 121 PID 2220 wrote to memory of 216 2220 net.exe 122 PID 2220 wrote to memory of 216 2220 net.exe 122 PID 3928 wrote to memory of 320 3928 cmd.exe 123 PID 3928 wrote to memory of 320 3928 cmd.exe 123 PID 3928 wrote to memory of 4076 3928 cmd.exe 124 PID 3928 wrote to memory of 4076 3928 cmd.exe 124
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ggpermV3\woof.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SS 13595150806209152752⤵PID:4864
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SS 1842811646855253462⤵PID:3552
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BS 23932227181494084482⤵PID:4284
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SV 311123219828153295182⤵PID:2472
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BV 15221326017698232732⤵PID:1496
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CS 2089298866324229942⤵PID:2840
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /PSN 205523267214557309842⤵PID:2268
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SU AUTO2⤵PID:4636
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /PAT 286271350715468273152⤵PID:1732
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /PPN 3021981052183573302⤵PID:2248
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /IV 20186733620041202152⤵PID:4872
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SM 61833049356618012⤵PID:3880
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SP 94632867531656222832⤵PID:2020
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BS 1532048043263583392⤵PID:4704
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SF 52471953424217238702⤵PID:3960
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BM 227043082614974189862⤵PID:4360
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BP 1135822857608144042⤵PID:4808
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BT 27611616436288582⤵PID:1500
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BLC 144832239114324157962⤵PID:1832
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CM 232291970823968274552⤵PID:2996
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CT 252651602814979216412⤵PID:2836
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CV 264241205312599208202⤵PID:764
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CA 880027717919560532⤵PID:3616
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CO 727078155732260442⤵PID:1696
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CSK 32217251521261021212⤵PID:2540
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SK 197098117269343172⤵PID:3540
-
-
C:\Windows\system32\net.exenet stop winmgmt /y2⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop winmgmt /y3⤵PID:4920
-
-
-
C:\Windows\system32\net.exenet start winmgmt /y2⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start winmgmt /y3⤵PID:216
-
-
-
C:\Windows\system32\sc.exesc stop winmgmt2⤵
- Launches sc.exe
PID:320
-
-
C:\Windows\system32\sc.exesc start winmgmt2⤵
- Launches sc.exe
PID:4076
-
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns2⤵
- Gathers network information
PID:1688
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3664
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4284
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Drops file in System32 directory
PID:4236
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1916
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
207KB
MD5ccef225b2c0c8fbb37b24de18e87a320
SHA14d3ca45da62bde453bee76cd2ba44c0797285a30
SHA2560cf3af3e88a585b9107d624e13f703e0d01b3ff30f1010c54dd0855a8ea95375
SHA512da0951e0bc29273cebd032f071e290d7ede2f6e1ef478e694624468139e9883ed18b253227ebe7673c5aeb152aa15a6468d7760c18bdbf2246c311f6753ac625