Overview
overview
10Static
static
3ggpermV3/A...64.exe
windows7-x64
1ggpermV3/A...64.exe
windows10-2004-x64
1ggpermV3/F...er.bat
windows7-x64
1ggpermV3/F...er.bat
windows10-2004-x64
1ggpermV3/N...on.dll
windows7-x64
1ggpermV3/N...on.dll
windows10-2004-x64
1ggpermV3/S...UI.dll
windows7-x64
1ggpermV3/S...UI.dll
windows10-2004-x64
1ggpermV3/T...er.exe
windows7-x64
ggpermV3/T...er.exe
windows10-2004-x64
ggpermV3/a...64.sys
windows7-x64
1ggpermV3/a...64.sys
windows10-2004-x64
1ggpermV3/ggpermV3.exe
windows7-x64
3ggpermV3/ggpermV3.exe
windows10-2004-x64
3ggpermV3/m...er.bat
windows7-x64
3ggpermV3/m...er.bat
windows10-2004-x64
3ggpermV3/s...er.exe
windows7-x64
1ggpermV3/s...er.exe
windows10-2004-x64
1ggpermV3/s...er.exe
windows7-x64
1ggpermV3/s...er.exe
windows10-2004-x64
1ggpermV3/woof.bat
windows7-x64
8ggpermV3/woof.bat
windows10-2004-x64
8Resubmissions
09-11-2024 22:49
241109-2r2veatfrl 1009-11-2024 22:47
241109-2qkjqssrdz 1009-11-2024 22:46
241109-2p2fvstfqj 1009-11-2024 22:44
241109-2nsgkasrbt 1007-11-2024 16:00
241107-tfl1taxpgl 1010-02-2024 17:17
240210-vtnl8sge36 10Analysis
-
max time kernel
120s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09-11-2024 22:47
Static task
static1
Behavioral task
behavioral1
Sample
ggpermV3/AMIDEWINx64.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
ggpermV3/AMIDEWINx64.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
ggpermV3/Final_Cleaner.bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
ggpermV3/Final_Cleaner.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
ggpermV3/Newtonsoft.Json.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
ggpermV3/Newtonsoft.Json.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
ggpermV3/Siticone.UI.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
ggpermV3/Siticone.UI.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
ggpermV3/Trinity Cleaner.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral10
Sample
ggpermV3/Trinity Cleaner.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
ggpermV3/amifldrv64.sys
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
ggpermV3/amifldrv64.sys
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
ggpermV3/ggpermV3.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
ggpermV3/ggpermV3.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
ggpermV3/macchanger.bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
ggpermV3/macchanger.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
ggpermV3/sxghr-driver.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral18
Sample
ggpermV3/sxghr-driver.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
ggpermV3/sxghr-driver.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral20
Sample
ggpermV3/sxghr-driver.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
ggpermV3/woof.bat
Resource
win7-20240903-en
windows7-x64
General
-
Target
ggpermV3/woof.bat
-
Size
1KB
-
MD5
9dfe4e730dcc5e0d3951038ad2a095a1
-
SHA1
e033d9a40234b9544606ec4d603add264cb38841
-
SHA256
bfffd2faf6710e02912de0eec63b593f35a8bebef114932b4a4bc9c67fad59b8
-
SHA512
297e9950fd207687af957a94c5fb7d073bb89dcebdd6ee047fa0465f55bb95b42563c7310980bf1e41ca671a1f8c824e86dfe515b844f99f307965d199d8dbfd
Malware Config
Signatures
-
Drops file in System32 directory 14 IoCs
description ioc Process File opened for modification C:\Windows\system32\wbem\repository\MAPPING2.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository svchost.exe File opened for modification C:\Windows\system32\wbem\repository\WRITABLE.TST svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING1.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\INDEX.BTR svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING2.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING3.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING3.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\WRITABLE.TST svchost.exe File opened for modification C:\Windows\system32\wbem\repository\OBJECTS.DATA svchost.exe File opened for modification C:\Windows\system32\wbem\repository\OBJECTS.DATA svchost.exe File opened for modification C:\Windows\system32\wbem\repository svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING1.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\INDEX.BTR svchost.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4904 sc.exe 3512 sc.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 2024 ipconfig.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 3808 NOTEPAD.EXE -
Runs net.exe
-
Suspicious behavior: LoadsDriver 25 IoCs
pid Process 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 1108 svchost.exe Token: SeIncreaseQuotaPrivilege 1108 svchost.exe Token: SeSecurityPrivilege 1108 svchost.exe Token: SeTakeOwnershipPrivilege 1108 svchost.exe Token: SeLoadDriverPrivilege 1108 svchost.exe Token: SeSystemtimePrivilege 1108 svchost.exe Token: SeBackupPrivilege 1108 svchost.exe Token: SeRestorePrivilege 1108 svchost.exe Token: SeShutdownPrivilege 1108 svchost.exe Token: SeSystemEnvironmentPrivilege 1108 svchost.exe Token: SeUndockPrivilege 1108 svchost.exe Token: SeManageVolumePrivilege 1108 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1108 svchost.exe Token: SeIncreaseQuotaPrivilege 1108 svchost.exe Token: SeSecurityPrivilege 1108 svchost.exe Token: SeTakeOwnershipPrivilege 1108 svchost.exe Token: SeLoadDriverPrivilege 1108 svchost.exe Token: SeSystemtimePrivilege 1108 svchost.exe Token: SeBackupPrivilege 1108 svchost.exe Token: SeRestorePrivilege 1108 svchost.exe Token: SeShutdownPrivilege 1108 svchost.exe Token: SeSystemEnvironmentPrivilege 1108 svchost.exe Token: SeUndockPrivilege 1108 svchost.exe Token: SeManageVolumePrivilege 1108 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1108 svchost.exe Token: SeIncreaseQuotaPrivilege 1108 svchost.exe Token: SeSecurityPrivilege 1108 svchost.exe Token: SeTakeOwnershipPrivilege 1108 svchost.exe Token: SeLoadDriverPrivilege 1108 svchost.exe Token: SeSystemtimePrivilege 1108 svchost.exe Token: SeBackupPrivilege 1108 svchost.exe Token: SeRestorePrivilege 1108 svchost.exe Token: SeShutdownPrivilege 1108 svchost.exe Token: SeSystemEnvironmentPrivilege 1108 svchost.exe Token: SeUndockPrivilege 1108 svchost.exe Token: SeManageVolumePrivilege 1108 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1108 svchost.exe Token: SeIncreaseQuotaPrivilege 1108 svchost.exe Token: SeSecurityPrivilege 1108 svchost.exe Token: SeTakeOwnershipPrivilege 1108 svchost.exe Token: SeLoadDriverPrivilege 1108 svchost.exe Token: SeBackupPrivilege 1108 svchost.exe Token: SeRestorePrivilege 1108 svchost.exe Token: SeShutdownPrivilege 1108 svchost.exe Token: SeSystemEnvironmentPrivilege 1108 svchost.exe Token: SeManageVolumePrivilege 1108 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1108 svchost.exe Token: SeIncreaseQuotaPrivilege 1108 svchost.exe Token: SeSecurityPrivilege 1108 svchost.exe Token: SeTakeOwnershipPrivilege 1108 svchost.exe Token: SeLoadDriverPrivilege 1108 svchost.exe Token: SeSystemtimePrivilege 1108 svchost.exe Token: SeBackupPrivilege 1108 svchost.exe Token: SeRestorePrivilege 1108 svchost.exe Token: SeShutdownPrivilege 1108 svchost.exe Token: SeSystemEnvironmentPrivilege 1108 svchost.exe Token: SeUndockPrivilege 1108 svchost.exe Token: SeManageVolumePrivilege 1108 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1108 svchost.exe Token: SeIncreaseQuotaPrivilege 1108 svchost.exe Token: SeSecurityPrivilege 1108 svchost.exe Token: SeTakeOwnershipPrivilege 1108 svchost.exe Token: SeLoadDriverPrivilege 1108 svchost.exe Token: SeSystemtimePrivilege 1108 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4544 wrote to memory of 1564 4544 cmd.exe 84 PID 4544 wrote to memory of 1564 4544 cmd.exe 84 PID 4544 wrote to memory of 816 4544 cmd.exe 85 PID 4544 wrote to memory of 816 4544 cmd.exe 85 PID 4544 wrote to memory of 4192 4544 cmd.exe 86 PID 4544 wrote to memory of 4192 4544 cmd.exe 86 PID 4544 wrote to memory of 1168 4544 cmd.exe 87 PID 4544 wrote to memory of 1168 4544 cmd.exe 87 PID 4544 wrote to memory of 876 4544 cmd.exe 88 PID 4544 wrote to memory of 876 4544 cmd.exe 88 PID 4544 wrote to memory of 1496 4544 cmd.exe 89 PID 4544 wrote to memory of 1496 4544 cmd.exe 89 PID 4544 wrote to memory of 4376 4544 cmd.exe 90 PID 4544 wrote to memory of 4376 4544 cmd.exe 90 PID 4544 wrote to memory of 3616 4544 cmd.exe 91 PID 4544 wrote to memory of 3616 4544 cmd.exe 91 PID 4544 wrote to memory of 1316 4544 cmd.exe 92 PID 4544 wrote to memory of 1316 4544 cmd.exe 92 PID 4544 wrote to memory of 2864 4544 cmd.exe 93 PID 4544 wrote to memory of 2864 4544 cmd.exe 93 PID 4544 wrote to memory of 320 4544 cmd.exe 94 PID 4544 wrote to memory of 320 4544 cmd.exe 94 PID 4544 wrote to memory of 3152 4544 cmd.exe 95 PID 4544 wrote to memory of 3152 4544 cmd.exe 95 PID 4544 wrote to memory of 4072 4544 cmd.exe 96 PID 4544 wrote to memory of 4072 4544 cmd.exe 96 PID 4544 wrote to memory of 624 4544 cmd.exe 97 PID 4544 wrote to memory of 624 4544 cmd.exe 97 PID 4544 wrote to memory of 4736 4544 cmd.exe 98 PID 4544 wrote to memory of 4736 4544 cmd.exe 98 PID 4544 wrote to memory of 312 4544 cmd.exe 99 PID 4544 wrote to memory of 312 4544 cmd.exe 99 PID 4544 wrote to memory of 1728 4544 cmd.exe 100 PID 4544 wrote to memory of 1728 4544 cmd.exe 100 PID 4544 wrote to memory of 224 4544 cmd.exe 102 PID 4544 wrote to memory of 224 4544 cmd.exe 102 PID 4544 wrote to memory of 696 4544 cmd.exe 103 PID 4544 wrote to memory of 696 4544 cmd.exe 103 PID 4544 wrote to memory of 5068 4544 cmd.exe 104 PID 4544 wrote to memory of 5068 4544 cmd.exe 104 PID 4544 wrote to memory of 2968 4544 cmd.exe 105 PID 4544 wrote to memory of 2968 4544 cmd.exe 105 PID 4544 wrote to memory of 1300 4544 cmd.exe 106 PID 4544 wrote to memory of 1300 4544 cmd.exe 106 PID 4544 wrote to memory of 408 4544 cmd.exe 107 PID 4544 wrote to memory of 408 4544 cmd.exe 107 PID 4544 wrote to memory of 1324 4544 cmd.exe 109 PID 4544 wrote to memory of 1324 4544 cmd.exe 109 PID 4544 wrote to memory of 2572 4544 cmd.exe 110 PID 4544 wrote to memory of 2572 4544 cmd.exe 110 PID 4544 wrote to memory of 208 4544 cmd.exe 111 PID 4544 wrote to memory of 208 4544 cmd.exe 111 PID 4544 wrote to memory of 2412 4544 cmd.exe 112 PID 4544 wrote to memory of 2412 4544 cmd.exe 112 PID 2412 wrote to memory of 2460 2412 net.exe 113 PID 2412 wrote to memory of 2460 2412 net.exe 113 PID 4544 wrote to memory of 1040 4544 cmd.exe 121 PID 4544 wrote to memory of 1040 4544 cmd.exe 121 PID 1040 wrote to memory of 4404 1040 net.exe 122 PID 1040 wrote to memory of 4404 1040 net.exe 122 PID 4544 wrote to memory of 4904 4544 cmd.exe 123 PID 4544 wrote to memory of 4904 4544 cmd.exe 123 PID 4544 wrote to memory of 3512 4544 cmd.exe 124 PID 4544 wrote to memory of 3512 4544 cmd.exe 124
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ggpermV3\woof.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SS 141441857225502274482⤵PID:1564
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SS 1457254955459250842⤵PID:816
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BS 12599565122860158482⤵PID:4192
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SV 148912670120884259652⤵PID:1168
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BV 314281850630347104892⤵PID:876
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CS 5385220125679217992⤵PID:1496
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /PSN 162522277122681136192⤵PID:4376
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SU AUTO2⤵PID:3616
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /PAT 3508303262810665762⤵PID:1316
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /PPN 11337353918600142052⤵PID:2864
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /IV 5104120192884294292⤵PID:320
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SM 30695243692142274942⤵PID:3152
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SP 29588830032299232362⤵PID:4072
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BS 15209282512824675832⤵PID:624
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SF 21770976114148305472⤵PID:4736
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BM 6834310621148262392⤵PID:312
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BP 3539256202381576082⤵PID:1728
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BT 156122031319252298222⤵PID:224
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BLC 166402599628704257102⤵PID:696
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CM 54611519414484262982⤵PID:5068
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CT 204101934716367178792⤵PID:2968
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CV 31516303368741141972⤵PID:1300
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CA 6587293612040211722⤵PID:408
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CO 4745427025286139732⤵PID:1324
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CSK 35381569318355298702⤵PID:2572
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SK 131422983954551552⤵PID:208
-
-
C:\Windows\system32\net.exenet stop winmgmt /y2⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop winmgmt /y3⤵PID:2460
-
-
-
C:\Windows\system32\net.exenet start winmgmt /y2⤵
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start winmgmt /y3⤵PID:4404
-
-
-
C:\Windows\system32\sc.exesc stop winmgmt2⤵
- Launches sc.exe
PID:4904
-
-
C:\Windows\system32\sc.exesc start winmgmt2⤵
- Launches sc.exe
PID:3512
-
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns2⤵
- Gathers network information
PID:2024
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1108
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1316
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Drops file in System32 directory
PID:1932
-
C:\Windows\System32\NOTEPAD.EXE"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\ggpermV3\woof.bat1⤵
- Opens file in notepad (likely ransom note)
PID:3808
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
207KB
MD5497676942d2207d6a0b8b803dec6b842
SHA136b4d906e14a6442b9e425419b80f9bff244633a
SHA256231e8c01f0a683cb5f3c14f54cada39ae8944cd6c82c0f58e2680f423cd981a7
SHA5127f8c058564586608acc477d218d27968af340eaf0bc97db183b7f05935787d0810553aae711f175e7c65d3210dfb7a1a86e71fffc5b918541c0d828da5a7ea56