gcleaner | bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c

Analysis

max time kernel
115s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-01-2025 17:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.exe
Size

2.0MB
MD5

b612eb21d3e997f804a49c9a7dfb3558
SHA1

5a1afbcafb6c233ce1afbb7dfcf674336352e83a
SHA256

bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c
SHA512

523e037ee05d40c993d1a5f4b351f14bb3787fa11832c5c68231eeca5ceb20760833ac132f8c5d17b0088c44382820d8458f5bb67b51b278236a44ef86bb450a
SSDEEP

24576:m3K8VrXXaaDmW6MKYs9j0x5h3kW9I9ECxYKBG/P8FS7FSzwQS2xXkal/I+3N+xBW:mTaFWn/s9jeh0R1jBGMF8algEMBVnA

Score

10^/10

gcleaner discovery loader

Malware Config

Extracted

Family

gcleaner

45.12.253.51

45.12.253.92

45.12.253.89

45.12.253.55

Attributes

url_path
/done.php

/delivery.php

/delivery.php

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Gcleaner family
gcleaner

Executes dropped EXE 2 IoCs

pid	Process
2912	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
2528	CggedFrog7.exe

Loads dropped DLL 7 IoCs

pid	Process
1960	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.exe
2912	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
2912	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
2912	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
2964	regsvr32.exe
2672	regsvr32.exe
2912	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 38 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\CggedFrog\translation\is-SRPRD.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\translation\is-E614I.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\translation\is-EB9D0.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\translation\is-BODOD.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\is-CFVOF.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\extensions\Meta\translation\is-QQ89G.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File opened for modification	C:\Program Files (x86)\CggedFrog\unins000.dat	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\translation\is-90TC9.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\translation\is-NJBPJ.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\translation\is-EMOAM.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\extensions\Meta\translation\is-F7K0U.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\extensions\Meta\translation\is-53J9U.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\extensions\Meta\is-L22EQ.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\is-JA7J3.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\is-9S07T.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\translation\is-F2VJ9.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\extensions\Meta\translation\is-1E53S.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\extensions\Meta\translation\is-C6BG9.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\extensions\Meta\translation\is-APT4P.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\extensions\Meta\is-VK7PC.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\unins000.dat	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\is-DL4VM.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\translation\is-PNAFN.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\translation\is-EOC6E.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\translation\is-CTK0B.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File opened for modification	C:\Program Files (x86)\CggedFrog\CggedFrog7.exe	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\translation\is-6678S.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\translation\is-B0MDR.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\is-T1RC0.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\is-B6OOK.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\is-N0PV9.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\translation\is-STBLQ.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\translation\is-U1INL.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\is-67MP3.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\extensions\Meta\translation\is-91O23.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\extensions\Meta\translation\is-GMCSD.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\extensions\Meta\translation\is-B7O1J.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
File created	C:\Program Files (x86)\CggedFrog\extensions\Meta\is-VIOK4.tmp	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CggedFrog7.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\TaggedFrogExt	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3955D421-C8F3-11d2-B7C8-A22B3D95F811}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DSOleFile.PropertyReader	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DSOleFile.PropertyReader\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{93769740-DE48-11D2-B7C8-A62255602516}\1.4\0\win32\ = "C:\\Program Files (x86)\\CggedFrog\\extensions\\Meta\\dsofile.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769743-DE48-11D2-B7C8-A62255602516}\ = "CustomProperties"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769743-DE48-11D2-B7C8-A62255602516}\TypeLib\Version = "1.4"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{71068371-CDC2-4FA2-B0AE-66673A56D5CB}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769741-DE48-11D2-B7C8-A62255602516}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{93769742-DE48-11D2-B7C8-A62255602516}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{93769743-DE48-11D2-B7C8-A62255602516}\ = "CustomProperties"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769743-DE48-11D2-B7C8-A62255602516}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769743-DE48-11D2-B7C8-A62255602516}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{93769742-DE48-11D2-B7C8-A62255602516}\TypeLib\Version = "1.4"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{93769741-DE48-11D2-B7C8-A62255602516}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{93769741-DE48-11D2-B7C8-A62255602516}\TypeLib\ = "{93769740-DE48-11D2-B7C8-A62255602516}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769741-DE48-11D2-B7C8-A62255602516}\TypeLib\ = "{93769740-DE48-11D2-B7C8-A62255602516}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{93769740-DE48-11D2-B7C8-A62255602516}\1.4\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3955D421-C8F3-11d2-B7C8-A22B3D95F811}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769742-DE48-11D2-B7C8-A62255602516}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{71068371-CDC2-4FA2-B0AE-66673A56D5CB}\ = "TaggedFrogShellMenu Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{93769742-DE48-11D2-B7C8-A62255602516}\ = "DocumentProperties"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769741-DE48-11D2-B7C8-A62255602516}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DSOleFile.PropertyReader\CurVer\ = "DSOleFile.PropertyReader.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DSOleFile.PropertyReader\ = "OLE File Property Reader"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{93769740-DE48-11D2-B7C8-A62255602516}\1.4\HELPDIR\ = "C:\\Program Files (x86)\\CggedFrog\\extensions\\Meta"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{93769743-DE48-11D2-B7C8-A62255602516}\TypeLib\Version = "1.4"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769742-DE48-11D2-B7C8-A62255602516}\TypeLib\Version = "1.4"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{72E8D54B-C929-4DD8-8723-3006F89F7D58}\ = "TFShellMenu"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DSOleFile.PropertyReader.1\CLSID\ = "{3955D421-C8F3-11d2-B7C8-A22B3D95F811}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{93769740-DE48-11D2-B7C8-A62255602516}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769744-DE48-11D2-B7C8-A62255602516}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DSOleFile.PropertyReader.1\ = "OLE File Property Reader"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{93769744-DE48-11D2-B7C8-A62255602516}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{93769743-DE48-11D2-B7C8-A62255602516}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{93769741-DE48-11D2-B7C8-A62255602516}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769741-DE48-11D2-B7C8-A62255602516}\ = "_PropertyReader"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769741-DE48-11D2-B7C8-A62255602516}\TypeLib\Version = "1.4"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DSOleFile.PropertyReader.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769743-DE48-11D2-B7C8-A62255602516}\TypeLib\ = "{93769740-DE48-11D2-B7C8-A62255602516}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{93769742-DE48-11D2-B7C8-A62255602516}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769742-DE48-11D2-B7C8-A62255602516}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769742-DE48-11D2-B7C8-A62255602516}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{93769741-DE48-11D2-B7C8-A62255602516}\TypeLib\Version = "1.4"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{93769744-DE48-11D2-B7C8-A62255602516}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{71068371-CDC2-4FA2-B0AE-66673A56D5CB}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3955D421-C8F3-11d2-B7C8-A22B3D95F811}\InprocServer32\ = "C:\\Program Files (x86)\\CggedFrog\\extensions\\Meta\\dsofile.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3955D421-C8F3-11d2-B7C8-A22B3D95F811}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{93769743-DE48-11D2-B7C8-A62255602516}\TypeLib\ = "{93769740-DE48-11D2-B7C8-A62255602516}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769741-DE48-11D2-B7C8-A62255602516}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{71068371-CDC2-4FA2-B0AE-66673A56D5CB}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3955D421-C8F3-11d2-B7C8-A22B3D95F811}\ = "OLE File Property Reader Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{93769744-DE48-11D2-B7C8-A62255602516}\ = "CustomProperty"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769744-DE48-11D2-B7C8-A62255602516}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769743-DE48-11D2-B7C8-A62255602516}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{93769741-DE48-11D2-B7C8-A62255602516}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769741-DE48-11D2-B7C8-A62255602516}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{71068371-CDC2-4FA2-B0AE-66673A56D5CB}\InprocServer32\ = "C:\\Program Files (x86)\\CggedFrog\\TFShellMenu.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DSOleFile.PropertyReader\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{93769744-DE48-11D2-B7C8-A62255602516}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{93769744-DE48-11D2-B7C8-A62255602516}\TypeLib\Version = "1.4"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{72E8D54B-C929-4DD8-8723-3006F89F7D58}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{93769744-DE48-11D2-B7C8-A62255602516}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{93769743-DE48-11D2-B7C8-A62255602516}	regsvr32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2528	CggedFrog7.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2912	1960	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.exe	30
PID 1960 wrote to memory of 2912	1960	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.exe	30
PID 1960 wrote to memory of 2912	1960	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.exe	30
PID 1960 wrote to memory of 2912	1960	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.exe	30
PID 1960 wrote to memory of 2912	1960	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.exe	30
PID 1960 wrote to memory of 2912	1960	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.exe	30
PID 1960 wrote to memory of 2912	1960	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.exe	30
PID 2912 wrote to memory of 2964	2912	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp	31
PID 2912 wrote to memory of 2964	2912	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp	31
PID 2912 wrote to memory of 2964	2912	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp	31
PID 2912 wrote to memory of 2964	2912	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp	31
PID 2912 wrote to memory of 2964	2912	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp	31
PID 2912 wrote to memory of 2964	2912	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp	31
PID 2912 wrote to memory of 2964	2912	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp	31
PID 2912 wrote to memory of 2672	2912	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp	32
PID 2912 wrote to memory of 2672	2912	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp	32
PID 2912 wrote to memory of 2672	2912	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp	32
PID 2912 wrote to memory of 2672	2912	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp	32
PID 2912 wrote to memory of 2672	2912	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp	32
PID 2912 wrote to memory of 2672	2912	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp	32
PID 2912 wrote to memory of 2672	2912	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp	32
PID 2912 wrote to memory of 2452	2912	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp	33
PID 2912 wrote to memory of 2452	2912	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp	33
PID 2912 wrote to memory of 2452	2912	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp	33
PID 2912 wrote to memory of 2452	2912	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp	33
PID 2912 wrote to memory of 2528	2912	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp	35
PID 2912 wrote to memory of 2528	2912	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp	35
PID 2912 wrote to memory of 2528	2912	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp	35
PID 2912 wrote to memory of 2528	2912	bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp	35

C:\Users\Admin\AppData\Local\Temp\bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.exe
"C:\Users\Admin\AppData\Local\Temp\bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Local\Temp\is-172K5.tmp\bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-172K5.tmp\bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp" /SL5="$5014C,1843076,319488,C:\Users\Admin\AppData\Local\Temp\bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\CggedFrog\TFShellMenu.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2964
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\CggedFrog\extensions\Meta\dsofile.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2672
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Delete /F /TN "NavFrog 7"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2452
- - C:\Program Files (x86)\CggedFrog\CggedFrog7.exe
    "C:\Program Files (x86)\CggedFrog\CggedFrog7.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\CggedFrog\TFShellMenu.dll

Filesize
80KB

MD5
aa1c938f60e065a350f07af972faf21c

SHA1
cb7c5c2becd64e4ebcb410e86d6fb01624a0984b

SHA256
f3455a77cb7fad3d842deecbbe386dfa7ad8fca98856a99c15374e3c46c04d23

SHA512
dedfe61d8dec35d741e4db7617dd8f5dae492ce35ca215bdea2970fc4e202f5ad93461c062aa34f1659fbc36783e8b88e5240a698098728ff3a76cb1f18a196d

Download Submit
C:\Program Files (x86)\CggedFrog\extensions\Meta\dsofile.dll

Filesize
39KB

MD5
9fb080566c3a4fb15ce48add38cc70dc

SHA1
ad66885c72ca78247a60f26b6c391a9878e5fa26

SHA256
f78978cf74047a690751bd377e71d002deb8a797b9be4b7d55ff279caf853b82

SHA512
a4d0d89bab5e85fd42abea5f17f99972356f4aae76a4dde0b19fd7dacdcf693edf1dc1bb87748c39a07c6adb2c4269576da602056e94bceeb66b7579121d0559

Download Submit
\Program Files (x86)\CggedFrog\CggedFrog7.exe

Filesize
2.1MB

MD5
8bb5a1dcb7aaa32626f8180b2769a77e

SHA1
93f80063524828893796382721986272e293aa4d

SHA256
577490d1249efb93d64632e8ef46590fcc17a13b70a6c13d27934e56fca2719d

SHA512
da20dc0bfee9abc603cafdc096ebf288cd03ad4efc9984c3061df166b07d5a7254818b00533e17e56215289458f791e58a68f2a39391d6ce2368b7677d8cdbdb

Download Submit
\Users\Admin\AppData\Local\Temp\is-172K5.tmp\bf11b43e1f298bc90370b1dd83868443542a7c365a4afb204e8e2d6ffd89e44c.tmp

Filesize
955KB

MD5
71b23c68dc698518b17e8c2486245883

SHA1
4e26a8c1845431b0630ba3a58ee3e0e78cfc5d17

SHA256
975ee3a1a4c6c4b836b9c26b8dc0839f024294a07b2f554ad210c8284a8cb568

SHA512
60fc272e81735f8f7f9294686321c5557d4499095893af6294ee483954765d0edb169a6edb353a3aa86b3bdf52c5030e15b3329fa82af6122248baa9b61d9a69

Download Submit
\Users\Admin\AppData\Local\Temp\is-UJEJG.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-UJEJG.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/1960-105-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1960-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1960-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2528-107-0x0000000000400000-0x0000000001410000-memory.dmp

Filesize
16.1MB

Download
memory/2528-101-0x0000000000400000-0x0000000001410000-memory.dmp

Filesize
16.1MB

Download
memory/2528-102-0x0000000000400000-0x0000000001410000-memory.dmp

Filesize
16.1MB

Download
memory/2912-15-0x0000000000400000-0x00000000004FF000-memory.dmp

Filesize
1020KB

Download
memory/2912-104-0x0000000003B40000-0x0000000004B50000-memory.dmp

Filesize
16.1MB

Download
memory/2912-103-0x0000000000400000-0x00000000004FF000-memory.dmp

Filesize
1020KB

Download
memory/2912-100-0x0000000003B40000-0x0000000004B50000-memory.dmp

Filesize
16.1MB

Download