Analysis
- user interaction
yes - max time kernel
505s - max time network
506s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
10/09/2026, 10:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
TGmesetups-x64-7.2.7.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
29 signatures
900 seconds
Behavioral task
behavioral2
Sample
TGmesetups-x64-7.2.7.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
21 signatures
900 seconds
Behavioral task
behavioral3
Sample
TGmesetups-x64-7.2.7.exe
Resource
win11-20260513-en
windows11-21h2-x64
20 signatures
900 seconds
General
- Target TGmesetups-x64-7.2.7.exe
- Size 91.7MB
- Sample260910-mxevhabk4t
- SHA256 1f912d02d0e790f5da37ce25b366868aab67ec58d9ccf8d6ba7b25b49d722620
- MD5 f06b25a0f1e21ebe46002b15618b1605
- SHA1 ec970867031ac37347ce681760b4edc75c7ac028
- SHA512 64a6e9fe51179d086c08c1c93a5c0e77a989cff99cc8dd08fbfc0f111fc1cd73bcd5e23352f3f26fad1ff5b054dc43cd419fa06191cd875fba0595277d35d544
- SSDEEP 1572864:IQWcT01j1mht7iINcqU2hESOrHP57FaSB1rbbcWu75O/xvvy0:IQJh1iXChERrBRVba5O/xvK0
- TLSH T1D62833377159C07AC163807149B9CA599133BA724F7285DB73C82A7E1F369C22E3BB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ GigabyteDownloadAssistant.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ GigabyteDownloadAssistant.exe - Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion GigabyteDownloadAssistant.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion GigabyteDownloadAssistant.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion GigabyteDownloadAssistant.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion GigabyteDownloadAssistant.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\Control Panel\International\Geo\Nation TGmesetups-x64-7.2.7.exe - Executes dropped EXE 3 IoCs
pid Process 4360 WinNetHelper.exe 4104 GigabyteDownloadAssistant.exe 4568 GigabyteDownloadAssistant.exe - Loads dropped DLL 9 IoCs
pid Process 4104 GigabyteDownloadAssistant.exe 4568 GigabyteDownloadAssistant.exe 3856 MsiExec.exe 2588 MsiExec.exe 2588 MsiExec.exe 2588 MsiExec.exe 2588 MsiExec.exe 2588 MsiExec.exe 2588 MsiExec.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/files/0x000700000002851a-19.dat themida behavioral2/memory/4104-33-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4104-32-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4104-34-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4104-31-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4568-39-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4568-40-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4568-42-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4568-43-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4568-57-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4104-56-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4568-58-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4104-93-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4104-94-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4104-96-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4104-99-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4104-102-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4104-104-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4104-107-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4104-110-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4104-112-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4104-115-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4104-117-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4104-120-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4104-123-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4104-125-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4104-128-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4104-130-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4104-133-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4104-136-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4104-138-0x000000022F180000-0x000000022FEFC000-memory.dmp themida behavioral2/memory/4104-141-0x000000022F180000-0x000000022FEFC000-memory.dmp themida - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA GigabyteDownloadAssistant.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA GigabyteDownloadAssistant.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: WinNetHelper.exe File opened (read-only) \??\Y: WinNetHelper.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: WinNetHelper.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: WinNetHelper.exe File opened (read-only) \??\G: WinNetHelper.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: WinNetHelper.exe File opened (read-only) \??\O: WinNetHelper.exe File opened (read-only) \??\V: WinNetHelper.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\I: WinNetHelper.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: WinNetHelper.exe File opened (read-only) \??\K: WinNetHelper.exe File opened (read-only) \??\Q: WinNetHelper.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: WinNetHelper.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\T: WinNetHelper.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\D: WinNetHelper.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\W: WinNetHelper.exe File opened (read-only) \??\X: WinNetHelper.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: WinNetHelper.exe File opened (read-only) \??\N: WinNetHelper.exe File opened (read-only) \??\Z: WinNetHelper.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: WinNetHelper.exe File opened (read-only) \??\S: WinNetHelper.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 4104 GigabyteDownloadAssistant.exe 4568 GigabyteDownloadAssistant.exe - Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
pid Process 1284 powershell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 940 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WinNetHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1380 msiexec.exe - Suspicious behavior: EnumeratesProcesses 53 IoCs
pid Process 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4568 GigabyteDownloadAssistant.exe 4568 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 1284 powershell.exe 1284 powershell.exe 1284 powershell.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 4616 msiexec.exe Token: SeCreateTokenPrivilege 4360 WinNetHelper.exe Token: SeAssignPrimaryTokenPrivilege 4360 WinNetHelper.exe Token: SeLockMemoryPrivilege 4360 WinNetHelper.exe Token: SeIncreaseQuotaPrivilege 4360 WinNetHelper.exe Token: SeMachineAccountPrivilege 4360 WinNetHelper.exe Token: SeTcbPrivilege 4360 WinNetHelper.exe Token: SeSecurityPrivilege 4360 WinNetHelper.exe Token: SeTakeOwnershipPrivilege 4360 WinNetHelper.exe Token: SeLoadDriverPrivilege 4360 WinNetHelper.exe Token: SeSystemProfilePrivilege 4360 WinNetHelper.exe Token: SeSystemtimePrivilege 4360 WinNetHelper.exe Token: SeProfSingleProcessPrivilege 4360 WinNetHelper.exe Token: SeIncBasePriorityPrivilege 4360 WinNetHelper.exe Token: SeCreatePagefilePrivilege 4360 WinNetHelper.exe Token: SeCreatePermanentPrivilege 4360 WinNetHelper.exe Token: SeBackupPrivilege 4360 WinNetHelper.exe Token: SeRestorePrivilege 4360 WinNetHelper.exe Token: SeShutdownPrivilege 4360 WinNetHelper.exe Token: SeDebugPrivilege 4360 WinNetHelper.exe Token: SeAuditPrivilege 4360 WinNetHelper.exe Token: SeSystemEnvironmentPrivilege 4360 WinNetHelper.exe Token: SeChangeNotifyPrivilege 4360 WinNetHelper.exe Token: SeRemoteShutdownPrivilege 4360 WinNetHelper.exe Token: SeUndockPrivilege 4360 WinNetHelper.exe Token: SeSyncAgentPrivilege 4360 WinNetHelper.exe Token: SeEnableDelegationPrivilege 4360 WinNetHelper.exe Token: SeManageVolumePrivilege 4360 WinNetHelper.exe Token: SeImpersonatePrivilege 4360 WinNetHelper.exe Token: SeCreateGlobalPrivilege 4360 WinNetHelper.exe Token: SeCreateTokenPrivilege 4360 WinNetHelper.exe Token: SeAssignPrimaryTokenPrivilege 4360 WinNetHelper.exe Token: SeLockMemoryPrivilege 4360 WinNetHelper.exe Token: SeIncreaseQuotaPrivilege 4360 WinNetHelper.exe Token: SeMachineAccountPrivilege 4360 WinNetHelper.exe Token: SeTcbPrivilege 4360 WinNetHelper.exe Token: SeSecurityPrivilege 4360 WinNetHelper.exe Token: SeTakeOwnershipPrivilege 4360 WinNetHelper.exe Token: SeLoadDriverPrivilege 4360 WinNetHelper.exe Token: SeSystemProfilePrivilege 4360 WinNetHelper.exe Token: SeSystemtimePrivilege 4360 WinNetHelper.exe Token: SeProfSingleProcessPrivilege 4360 WinNetHelper.exe Token: SeIncBasePriorityPrivilege 4360 WinNetHelper.exe Token: SeCreatePagefilePrivilege 4360 WinNetHelper.exe Token: SeCreatePermanentPrivilege 4360 WinNetHelper.exe Token: SeBackupPrivilege 4360 WinNetHelper.exe Token: SeRestorePrivilege 4360 WinNetHelper.exe Token: SeShutdownPrivilege 4360 WinNetHelper.exe Token: SeDebugPrivilege 4360 WinNetHelper.exe Token: SeAuditPrivilege 4360 WinNetHelper.exe Token: SeSystemEnvironmentPrivilege 4360 WinNetHelper.exe Token: SeChangeNotifyPrivilege 4360 WinNetHelper.exe Token: SeRemoteShutdownPrivilege 4360 WinNetHelper.exe Token: SeUndockPrivilege 4360 WinNetHelper.exe Token: SeSyncAgentPrivilege 4360 WinNetHelper.exe Token: SeEnableDelegationPrivilege 4360 WinNetHelper.exe Token: SeManageVolumePrivilege 4360 WinNetHelper.exe Token: SeImpersonatePrivilege 4360 WinNetHelper.exe Token: SeCreateGlobalPrivilege 4360 WinNetHelper.exe Token: SeCreateTokenPrivilege 4360 WinNetHelper.exe Token: SeAssignPrimaryTokenPrivilege 4360 WinNetHelper.exe Token: SeLockMemoryPrivilege 4360 WinNetHelper.exe Token: SeIncreaseQuotaPrivilege 4360 WinNetHelper.exe Token: SeMachineAccountPrivilege 4360 WinNetHelper.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4360 WinNetHelper.exe 1380 msiexec.exe 1380 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4104 GigabyteDownloadAssistant.exe 4104 GigabyteDownloadAssistant.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2592 wrote to memory of 4360 2592 TGmesetups-x64-7.2.7.exe 83 PID 2592 wrote to memory of 4568 2592 TGmesetups-x64-7.2.7.exe 86 PID 4616 wrote to memory of 3856 4616 msiexec.exe 89 PID 4360 wrote to memory of 1380 4360 WinNetHelper.exe 90 PID 4616 wrote to memory of 2588 4616 msiexec.exe 93 PID 4104 wrote to memory of 940 4104 GigabyteDownloadAssistant.exe 94 PID 940 wrote to memory of 1284 940 cmd.exe 96 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\TGmesetups-x64-7.2.7.exe"C:\Users\Admin\AppData\Local\Temp\TGmesetups-x64-7.2.7.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\WinNetHelper.exe"C:\Users\Admin\AppData\Local\Temp\WinNetHelper.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Telegram Desktop\Setup - Telegram Desktop 7.1.3 64bit 7.1.3\install\175BA0C\TG.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\WinNetHelper.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1788796803 "3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- System Time Discovery
- Suspicious use of FindShellTrayWindow
PID:1380
-
-
-
C:\ProgramData\GIGABYTE\GigabyteDownloadAssistant\GigabyteDownloadAssistant.exe"C:\ProgramData\GIGABYTE\GigabyteDownloadAssistant\GigabyteDownloadAssistant.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4568
-
-
C:\ProgramData\GIGABYTE\GigabyteDownloadAssistant\GigabyteDownloadAssistant.exeC:\ProgramData\GIGABYTE\GigabyteDownloadAssistant\GigabyteDownloadAssistant.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\system32\cmd.execmd.exe /c powershell -Command "Get-Process Weixin -ErrorAction SilentlyContinue | ForEach-Object {(Get-Item $_.Path).VersionInfo.FileVersion}"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-Process Weixin -ErrorAction SilentlyContinue | ForEach-Object {(Get-Item $_.Path).VersionInfo.FileVersion}"3⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
PID:1284
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0FF5F3A8428ED9DFFEF13B2A9E9A2BC1 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3856
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3AFCF8BB837ED77A6748016A60098BAC C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2588
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Hide Artifacts
1Ignore Process Interrupts
1Virtualization/Sandbox Evasion
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\GIGABYTE\GigabyteDownloadAssistant\GigabyteDownloadAssistant.exe
- Size 610KB
- SHA256 7e07a64d95b1669008014a9c594a253021f01ab0f54ec6268bde1fb743e6cec7
- MD5 58bfd83c05176914e23f8dc19a09d989
- SHA1 0677fef4d9196f37fb0de67a4197776d8589b48a
- SHA512 0da0bf87c5a90f95ac184e4f3409f11487fec257cf0281d154dbb6869fd961df83684676cf0ffb68559525e4cd251ef0ca9a5d04cae9705254e433344d6eb747
- SSDEEP 6144:p/dIyr9zoMUCqQpfhnwWM6hUd5PTLYQd4KR7pNLRLsoQKW0YQgmA21FeSJtzd6:LINMUqlhnwz6hUfTnooLWAx/eSB6
- TLSH T1CFD41986B2A406E8E2B69B3C8A26C445D6717DA64761D6CFE12437761F37BE20D3F304
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\GIGABYTE\GigabyteDownloadAssistant\qbcore.dll
- Size 4.2MB
- SHA256 09f2558fee0cb527ea00aa37f57f732f8543406718baa656318845f323a86e2a
- MD5 fce8d93f61d52eb567bf157ad3755acd
- SHA1 1dc2eac3319b801362a95e804491f90cedaed5ca
- SHA512 ced59c2d3eb7104707b61903ec39ea4621ec583282fd74156b51936f7a68bfc86a69bcf7647eb72fec1bd8903bcc5cda246220d9e7d5b69a909fc8f415afc820
- SSDEEP 98304:6ImAHAV3K1axnCp1ZhHOy0ZXp0kresTHnerlSI:6IrgVAInCp1ZhHmukKsSrgI
- TLSH T19316331F4968B898D9B5017EFCCA8D4266CEA37814166EFEB19F226B0FF3727D102454
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI9305.tmp
- Size 557KB
- SHA256 e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240
- MD5 db7612f0fd6408d664185cfc81bef0cb
- SHA1 19a6334ec00365b4f4e57d387ed885b32aa7c9aa
- SHA512 25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9
- SSDEEP 6144:X+Sud3L4YgAc8wjVMeKRtGnm3CCRloVywX9gDAOAVafv5kh4JQCmR+gj:X+SuPgAc8+MjGCCslegDiwX5vOCmR+gj
- TLSH T1AAC45A20369AC432D56D16B029ACDBAF912DBE754B3A58DBA3D85E2F45F09C24331F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_llttp1wd.p2l.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Telegram Desktop\Setup - Telegram Desktop 7.1.3 64bit 7.1.3\install\175BA0C\TG.msi
- Size 1.8MB
- SHA256 dce56874f72ebaea175b7d2a65d495908437667ef3e81fc62604da8167cf869a
- MD5 aa967b872132717ab12d81c41b98701f
- SHA1 079aa6a46fe06f3ea5eb3e8ff6e18778de7bb47c
- SHA512 b7b533f54bf355327fc422c51ab10843c99a05d74f327034db172774186b719e7271f4e052c0b88e1c518c7d45b7cc7fc62c9d6194f2ddd87385df3158873071
- SSDEEP 24576:8dLxmiaSuPgAc8rGx1wX5WCmR+gXOBkZVI+ep5U2fvEjD4wzIXX5EL96RX5uN:8dj8r6I5WCmR+ZzE37zIXX5U96RX5uN
- TLSH T180857C21A2C7C526D56D02B2F52CEE5E5538BFB30B3150E7BBE43A6F48B08C25275E16
- MD5 SHA1 SHA512 SSDEEP TLSH