Overview

overview

10

Static

static

3

ggpermV3.rar

windows7-x64

1

ggpermV3.rar

windows10-2004-x64

1

ggpermV3/A...64.exe

windows7-x64

1

ggpermV3/A...64.exe

windows10-2004-x64

1

ggpermV3/F...er.bat

windows7-x64

1

ggpermV3/F...er.bat

windows10-2004-x64

1

ggpermV3/N...on.dll

windows7-x64

1

ggpermV3/N...on.dll

windows10-2004-x64

1

ggpermV3/S...UI.dll

windows7-x64

1

ggpermV3/S...UI.dll

windows10-2004-x64

1

ggpermV3/T...er.exe

windows7-x64

ggpermV3/T...er.exe

windows10-2004-x64

8

ggpermV3/a...64.sys

windows7-x64

1

ggpermV3/a...64.sys

windows10-2004-x64

1

ggpermV3/ggpermV3.exe

windows7-x64

3

ggpermV3/ggpermV3.exe

windows10-2004-x64

3

ggpermV3/m...er.bat

windows7-x64

3

ggpermV3/m...er.bat

windows10-2004-x64

3

ggpermV3/s...er.exe

windows7-x64

1

ggpermV3/s...er.exe

windows10-2004-x64

1

ggpermV3/s...er.exe

windows7-x64

1

ggpermV3/s...er.exe

windows10-2004-x64

1

ggpermV3/s...er.pdb

windows7-x64

3

ggpermV3/s...er.pdb

windows10-2004-x64

3

ggpermV3/s...g.json

windows7-x64

3

ggpermV3/s...g.json

windows10-2004-x64

3

ggpermV3/woof.bat

windows7-x64

8

ggpermV3/woof.bat

windows10-2004-x64

8

Resubmissions

09/11/2024, 22:49

241109-2r2veatfrl10

09/11/2024, 22:47

241109-2qkjqssrdz10

09/11/2024, 22:46

241109-2p2fvstfqj10

09/11/2024, 22:44

241109-2nsgkasrbt10

07/11/2024, 16:00

241107-tfl1taxpgl10

28/02/2024, 21:26

240228-1amtgsec84

10/02/2024, 17:17

240210-vtnl8sge3610

Sharing

Copy URL Twitter E-mail

General

  • Target
    ggpermV3.rar
  • Size 1.0MB
  • Sample241109-2r2veatfrl
  • SHA256 c4d74e49c44c880ec1b4cdede24423872f931e617b33d6bdba31e0534a12b809
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
defense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Targets

    • Target
      ggpermV3.rar
    • Size 1.0MB
    • SHA256 c4d74e49c44c880ec1b4cdede24423872f931e617b33d6bdba31e0534a12b809
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral1behavioral2
    • Target
      ggpermV3/AMIDEWINx64.EXE
    • Size 453KB
    • SHA256 53e3b72f8eb13acf3cb69d4cb124e8dc64fc541555c3c95cc8003b8046853955
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral3behavioral4
    • Target
      ggpermV3/Final_Cleaner.bat
    • Size 107KB
    • SHA256 00023ce602db623e47de1029595339eec4ee5019c6017236c9b721cac0ae4032
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral5behavioral6
    • Target
      ggpermV3/Newtonsoft.Json.dll
    • Size 695KB
    • SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral7behavioral8
    • Target
      ggpermV3/Siticone.UI.dll
    • Size 1.3MB
    • SHA256 27c56a28cbde094157206da1bfcd7a395111ab97b8a5ff600b11c2175dcefb26
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral10behavioral9
    • Target
      ggpermV3/Trinity Cleaner.exe
    • Size 752KB
    • SHA256 fd5d49ac3a9a4130261f43ef6e6c9c6a4a317e7ba421f88e22e0fbe96fd45429
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealer

    • Deletes NTFS Change Journal

      The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.

      ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies Windows Firewall

      evasion

    • Stops running service(s)

      evasionexecution

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral11behavioral12
    • Target
      ggpermV3/amifldrv64.sys
    • Size 18KB
    • SHA256 37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral13behavioral14
    • Target
      ggpermV3/ggpermV3.exe
    • Size 62KB
    • SHA256 e333b29fa06d2138c9a4c634fde1fe4212bd2a027c0175008001c8af60d34053
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral15behavioral16
    • Target
      ggpermV3/macchanger.bat
    • Size 2KB
    • SHA256 4d8d40a7e435fc815d088d7309a6bece3a9d798b4fb8170ca3d9c4c7c8c6784f
    • MD5 SHA1 SHA512
    Score
    3/10
    persistenceprivilege_escalation
    behavioral17behavioral18
    • Target
      ggpermV3/sxghr-driver.dll
    • Size 5KB
    • SHA256 70d8f0ce3cb2651052a628564e2ce0d715822fad141273c65892cd5515bc7741
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral19behavioral20
    • Target
      ggpermV3/sxghr-driver.exe
    • Size 137KB
    • SHA256 a89fcdf02e9d587c2c00cbfa5efada6b308f62d7d8a296f7a1cfc8c4991de375
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral21behavioral22
    • Target
      ggpermV3/sxghr-driver.pdb
    • Size 10KB
    • SHA256 2947c85cd0c1630c6cc1b1d193655d5102a737cf4fe82114cb18e8180a528adc
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral23behavioral24
    • Target
      ggpermV3/sxghr-driver.runtimeconfig.json
    • Size 268B
    • SHA256 162d81f468bec570ec15e527433f4de5d5729ffe338ab79b22671f38760d34bd
    • MD5 SHA1 SHA512
    Score
    3/10
    discovery
    behavioral25behavioral26
    • Target
      ggpermV3/woof.bat
    • Size 1KB
    • SHA256 bfffd2faf6710e02912de0eec63b593f35a8bebef114932b4a4bc9c67fad59b8
    • MD5 SHA1 SHA512
    Score
    8/10
    evasionexecutiondiscovery
    behavioral27behavioral28

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

System Services

1
T1569

Service Execution

1
T1569.002

Windows Management Instrumentation

1
T1047

Persistence

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Direct Volume Access

1
T1006

Impair Defenses

2
T1562

Disable or Modify System Firewall

1
T1562.004

Indicator Removal

3
T1070

File Deletion

3
T1070.004

Modify Registry

2
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

3
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Data Destruction

1
T1485

Inhibit System Recovery

3
T1490

Service Stop

1
T1489

Tasks

static1

Score
3/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

defense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealer
Score
10/10

behavioral12

defense_evasiondiscoveryevasionexecutionspywarestealer
Score
8/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

persistenceprivilege_escalation
Score
3/10

behavioral18

persistenceprivilege_escalation
Score
3/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

discovery
Score
3/10

behavioral24

Score
3/10

behavioral25

discovery
Score
3/10

behavioral26

Score
3/10

behavioral27

evasionexecution
Score
8/10

behavioral28

discoveryevasionexecution
Score
8/10