1ebefbd518bca8250bfaa65253f49085d68f7dc98b916f3a6dde487402a8be86

Resubmissions

28/03/2025, 09:59

28/03/2025, 09:58

max time kernel
101s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
28/03/2025, 09:58

Target

GTAC-Server-Win32-1.7.0.zip
Size

8.1MB
MD5

5b5ab0f3d0748132c9d5ac29ffa7d4ed
SHA1

a98e900d05e3d72fc3493f832d00771811ebddef
SHA256

1ebefbd518bca8250bfaa65253f49085d68f7dc98b916f3a6dde487402a8be86
SHA512

8991b14d172b2445815badf085e899d368b60a4e1978bd37e647750d13524f34818c3035ad85151fdcea3d23d863e6c1438173be60d18fcb4e2bd5098360f59a
SSDEEP

196608:mSLKBkqWl9IPm5kXwI63dHkUCxX1ue70pmnfXaModIPP6vKsrtbb5Z:+218mhHR2l7Q7dhrNb5Z

Score

1^/10

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\GTAC-Server-Win32-1.7.0.zip
1⤵
PID:5464

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:3824

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6004

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\ad0a66c9-0822-4925-a516-7a20e4061071.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit