Analysis
- user interaction
yes - max time kernel
62s - max time network
31s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
29/10/2026, 22:27
General
- Target gcfscape186.exe
- Size 525KB
- Sample261029-2dd67aft31
- SHA256 c0e86c83b0f1dc9cabb39d72384cfb841fbc87b87d03fe6510147a05753b6c93
- MD5 f32ef0669bbd2663606c3a6e39e48123
- SHA1 0d69b30b18d1844eed0b983f08006db46a93b552
- SHA512 025a3486853de692efbfc2fa3f43a477e7b2eb21af3aeecda7af437736577eb3252315ad718e068f56bfc414e91cc75c73226819575b62f92ae374f40fa0f992
- SSDEEP 12288:z7blMvUAU89ydPw8BSw11dc3yWt67azlqqnHTEknjMxIoYlnlz:z7blYnU8L8BSu1KCw67aRq8Imj4Y3
- TLSH T140B4235383E16533D84286B84D26A1585E37BE2B6C38351E358C5F1C5F7B3D2A22FBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 1280 gcfscape186.tmp 4204 GCFScape.exe - Loads dropped DLL 1 IoCs
pid Process 4204 GCFScape.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 8 IoCs
description ioc Process File opened for modification C:\Program Files\Nem's Tools\GCFScape\HLLib.dll gcfscape186.tmp File created C:\Program Files\Nem's Tools\GCFScape\unins000.dat gcfscape186.tmp File created C:\Program Files\Nem's Tools\GCFScape\is-AQBGM.tmp gcfscape186.tmp File created C:\Program Files\Nem's Tools\GCFScape\is-ERR7Q.tmp gcfscape186.tmp File created C:\Program Files\Nem's Tools\GCFScape\is-584LP.tmp gcfscape186.tmp File created C:\Program Files\Nem's Tools\GCFScape\is-P01UR.tmp gcfscape186.tmp File opened for modification C:\Program Files\Nem's Tools\GCFScape\unins000.dat gcfscape186.tmp File opened for modification C:\Program Files\Nem's Tools\GCFScape\GCFScape.exe gcfscape186.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gcfscape186.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gcfscape186.exe - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral1/memory/4512-0-0x0000000000400000-0x0000000000415000-memory.dmp innosetup behavioral1/memory/4512-7-0x0000000000400000-0x0000000000415000-memory.dmp innosetup behavioral1/memory/4512-44-0x0000000000400000-0x0000000000415000-memory.dmp innosetup - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pak\ = "PAKFile" gcfscape186.tmp Key created \REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU GCFScape.exe Set value (int) \REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" GCFScape.exe Key created \REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell GCFScape.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ GCFScape.exe Set value (int) \REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" GCFScape.exe Set value (str) \REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" GCFScape.exe Set value (int) \REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" GCFScape.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NCFFile gcfscape186.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PAKFile\shell\open\command\ = "\"C:\\Program Files\\Nem's Tools\\GCFScape\\GCFScape.exe\" \"%1\"" gcfscape186.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SGAFile gcfscape186.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VPKFile gcfscape186.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VPKFile\shell\open\command\ = "\"C:\\Program Files\\Nem's Tools\\GCFScape\\GCFScape.exe\" \"%1\"" gcfscape186.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WADFile\shell\open\command gcfscape186.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XZPFile\shell\open\command\ = "\"C:\\Program Files\\Nem's Tools\\GCFScape\\GCFScape.exe\" \"%1\"" gcfscape186.tmp Key created \REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} GCFScape.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GCFFile\shell gcfscape186.tmp Key created \REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 GCFScape.exe Key created \REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg GCFScape.exe Set value (int) \REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" GCFScape.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PAKFile gcfscape186.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NCFFile\DefaultIcon gcfscape186.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NCFFile\shell gcfscape186.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vpk\ = "VPKFile" gcfscape186.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VPKFile\ = "Valve Pack File" gcfscape186.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VPKFile\DefaultIcon\ = "C:\\Program Files\\Nem's Tools\\GCFScape\\GCFScape.exe,1" gcfscape186.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WADFile\shell\open gcfscape186.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XZPFile\ = "XBox Zip File" gcfscape186.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GCFFile\DefaultIcon\ = "C:\\Program Files\\Nem's Tools\\GCFScape\\GCFScape.exe,1" gcfscape186.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GCFFile\shell\open gcfscape186.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GCFFile\shell\open\command\ = "\"C:\\Program Files\\Nem's Tools\\GCFScape\\GCFScape.exe\" \"%1\"" gcfscape186.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NCFFile\DefaultIcon\ = "C:\\Program Files\\Nem's Tools\\GCFScape\\GCFScape.exe,1" gcfscape186.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PAKFile\ = "Pack File" gcfscape186.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PAKFile\DefaultIcon\ = "C:\\Program Files\\Nem's Tools\\GCFScape\\GCFScape.exe,1" gcfscape186.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SGAFile\shell gcfscape186.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wad gcfscape186.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WADFile\shell\open\command\ = "\"C:\\Program Files\\Nem's Tools\\GCFScape\\GCFScape.exe\" \"%1\"" gcfscape186.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.xzp gcfscape186.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XZPFile\shell gcfscape186.tmp Set value (data) \REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff GCFScape.exe Set value (data) \REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff GCFScape.exe Key created \Registry\User\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\NotificationData GCFScape.exe Set value (int) \REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" GCFScape.exe Set value (int) \REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" GCFScape.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xzp\ = "XZPFile" gcfscape186.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XZPFile\DefaultIcon\ = "C:\\Program Files\\Nem's Tools\\GCFScape\\GCFScape.exe,1" gcfscape186.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XZPFile\shell\open\command gcfscape186.tmp Key created \REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell GCFScape.exe Set value (data) \REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 GCFScape.exe Set value (data) \REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff GCFScape.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PAKFile\DefaultIcon gcfscape186.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GCFFile\shell\open\command gcfscape186.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NCFFile\ = "No Cache File" gcfscape186.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NCFFile\shell\open\command gcfscape186.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pak gcfscape186.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sga\ = "SGAFile" gcfscape186.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SGAFile\shell\open\command\ = "\"C:\\Program Files\\Nem's Tools\\GCFScape\\GCFScape.exe\" \"%1\"" gcfscape186.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WADFile\ = "Half-Life 1 Texture Package" gcfscape186.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GCFFile\ = "Game Cache File" gcfscape186.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SGAFile\shell\open\command gcfscape186.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VPKFile\DefaultIcon gcfscape186.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VPKFile\shell\open\command gcfscape186.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WADFile\DefaultIcon\ = "C:\\Program Files\\Nem's Tools\\GCFScape\\GCFScape.exe,1" gcfscape186.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XZPFile\DefaultIcon gcfscape186.tmp - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1280 gcfscape186.tmp 1280 gcfscape186.tmp - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1280 gcfscape186.tmp - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4204 GCFScape.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4512 wrote to memory of 1280 4512 gcfscape186.exe 81 PID 1280 wrote to memory of 3472 1280 gcfscape186.tmp 84 PID 1280 wrote to memory of 4204 1280 gcfscape186.tmp 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\gcfscape186.exe"C:\Users\Admin\AppData\Local\Temp\gcfscape186.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\is-8BGET.tmp\gcfscape186.tmp"C:\Users\Admin\AppData\Local\Temp\is-8BGET.tmp\gcfscape186.tmp" /SL5="$502F2,288793,57856,C:\Users\Admin\AppData\Local\Temp\gcfscape186.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Nem's Tools\GCFScape\Readme.txt3⤵
- System Location Discovery: System Language Discovery
PID:3472
-
-
C:\Program Files\Nem's Tools\GCFScape\GCFScape.exe"C:\Program Files\Nem's Tools\GCFScape\GCFScape.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4204
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Nem's Tools\GCFScape\GCFScape.exe
- Size 267KB
- SHA256 09d1a09b20c56366eae0f411fba65ba713f89aa8297325f23272994d05e7df2c
- MD5 702f3037869a480282d38613134ee930
- SHA1 c231dae9c34d919789be7c9f89641acb77f81359
- SHA512 e449117281d4eb596ae0fa058cf131b062a859ef6b3fec8716fc7d7c78d857cce8c2956a03b9407129266ec34b2b1da2c54e341eb1556be7a99d11f07730d71f
- SSDEEP 6144:L0ZLaROqOOkQT5uY96uw1xpcNs7uiLO2:IZeROqOID8z
- TLSH T16E444A1332E60EB2EDBF0BB924B052A00731B6575A2FC68E5A4091CDCDDB7D099617DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Nem's Tools\GCFScape\HLLib.dll
- Size 219KB
- SHA256 a6639ecc03e1052e9e0de76dd5ad4dfaa81cf9d3ab931b4c59799407bbdcd0dd
- MD5 f992cbc53a0469cfe021d3504bfea99d
- SHA1 7f74ea1dfec9a28928558778bca6fa95d67768c3
- SHA512 c1c3e667101322212798291bb9a8ad42d989beae5115939744efa1c547988d655ed57b23e67a53fbb968364a42ddffd4a35cdf0f50340f7bbdfc67595bdade2e
- SSDEEP 3072:Xmz3+EYmKFC+9x8VSZick2Oi1y4TBfkFUTr5bc5KpY2OlyLhKDtRuHxx:XmD+4KAcxbZy2Oi1y4TBMyv5FXOlZ4
- TLSH T126242A1B727944B3CCB2C17CD9864A2196B2704107A2DBEF1568C37E0D2BBE92D7E6D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Nem's Tools\GCFScape\Readme.txt
- Size 15KB
- SHA256 0c61619eac35842e8dd3e01ffc6202dc87e7f5a595718511874390500075dfb7
- MD5 30a722c2e5cc4a16f73c2553cd9cc277
- SHA1 c94a23d27e56e67bfd3ed06613622468a7a024c0
- SHA512 1e647b84683ec9a221ffdddea679dabe418281c25320729a580fe4dd8e83a991e9c361c49c34c672d17f14f3fe96757e5003d4c2958c2930983c5002391fde50
- SSDEEP 192:MgHwdWEtQ6uAWTAONYCmmrX+XNCfPZVEE/ucOSzNCvVVTzpzGcpudB4hAb39V9:SttoGObbaXNgzEQJOAstVTzpzGQwOhSB
- TLSH T13272935BAEC3336708FA08112A846676EB3D907DE71A1A223C5CD15C3771B54B2FE29D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Nem's Tools\GCFScape\unins000.exe
- Size 708KB
- SHA256 78d4c4fd174ef96721ec9f5312fb2e67eff92b6bd7bc12fd929f07bf8f01748a
- MD5 2fb270f7a2f71406f22877554b1404f3
- SHA1 a44285b991ea835fa70306b2251ae7bc34c97a4a
- SHA512 c7d887d8720926f17a06e618781f71fe2fc947c460ccdb3494cc01f1ea54da63300e2f5f76cbd9b3d3329752a43e3aa7bcece83afc9442f7d19aa105bc698c00
- SSDEEP 12288:2sMLIMoi3rPR37dzHRA6nX0D9OKWbO7SERb5rNUK1bce0syxyRd:xMcMoi3rPR37dzHRA6G7WbuSEmK50syU
- TLSH T114F47C32F2A08837C1B32E789D1B82955936FD103E39B59736E91F0C4F796817A272D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-8BGET.tmp\gcfscape186.tmp
- Size 697KB
- SHA256 cc783a04ccbca4edd06564f8ec88fe5a15f1e3bb26cec7de5e090313520d98f3
- MD5 832dab307e54aa08f4b6cdd9b9720361
- SHA1 ebd007fb7482040ecf34339e4bf917209c1018df
- SHA512 358d43522fd460eb1511708e4df22ea454a95e5bc3c4841931027b5fa3fb1dda05d496d8ad0a8b9279b99e6be74220fe243db8f08ef49845e9fb35c350ef4b49
- SSDEEP 12288:usMLIMoi3rPR37dzHRA6nX0D9OKWbO7SERb5rNUK1bce0syxyR:JMcMoi3rPR37dzHRA6G7WbuSEmK50syQ
- TLSH T166E47D32F2A08837C1B32E789D1B82955936FD103E39B59776E91F0C4F796817A272D2
- MD5 SHA1 SHA512 SSDEEP TLSH