Loading ...

Play interactive tourEdit tour

Analysis Report cGDmJSd.exe

Overview

General Information

Sample Name:cGDmJSd.exe
Analysis ID:404287
MD5:852d67a27e454bd389fa7f02a8cbe23f
SHA1:5330fedad485e0e4c23b2abe1075a1f984fde9fc
SHA256:a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8
Infos:

Most interesting Screenshot:

Detection

Score:0
Range:0 - 100
Whitelisted:true
Confidence:100%

Signatures

Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
Queries the installation date of Windows
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info

Classification

Startup

  • System is w10x64
  • cGDmJSd.exe (PID: 6484 cmdline: 'C:\Users\user\Desktop\cGDmJSd.exe' MD5: 852D67A27E454BD389FA7F02A8CBE23F)
    • conhost.exe (PID: 6516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: Binary string: powershell.pdb source: cGDmJSd.exe
Source: cGDmJSd.exe, 00000000.00000003.338604743.000000001B47F000.00000004.00000001.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: cGDmJSd.exe, 00000000.00000002.606479641.0000000003246000.00000004.00000001.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: cGDmJSd.exe, 00000000.00000002.604081269.0000000002F81000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: cGDmJSd.exe, 00000000.00000002.606479641.0000000003246000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: cGDmJSd.exe, 00000000.00000003.339835267.000000001B53C000.00000004.00000001.sdmpString found in binary or memory: http://wwwrosoCPS/default.htm0
Source: cGDmJSd.exe, 00000000.00000002.606479641.0000000003246000.00000004.00000001.sdmpString found in binary or memory: https://github.com/Pester/Pester
Source: cGDmJSd.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: cGDmJSd.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: cGDmJSd.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: cGDmJSd.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: cGDmJSd.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: cGDmJSd.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: cGDmJSd.exe, 00000000.00000002.603631615.0000000002D60000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamenlsbres.dll.muij% vs cGDmJSd.exe
Source: cGDmJSd.exe, 00000000.00000002.602016715.0000000000F5B000.00000004.00000020.sdmpBinary or memory string: OriginalFilenameclr.dllT vs cGDmJSd.exe
Source: cGDmJSd.exe, 00000000.00000002.604081269.0000000002F81000.00000004.00000001.sdmpBinary or memory string: OriginalFilename vs cGDmJSd.exe
Source: cGDmJSd.exe, 00000000.00000002.604445361.0000000002FE9000.00000004.00000001.sdmpBinary or memory string: OriginalFileName vs cGDmJSd.exe
Source: cGDmJSd.exe, 00000000.00000003.339506697.000000001C457000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs cGDmJSd.exe
Source: cGDmJSd.exe, 00000000.00000002.603607573.0000000002D50000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamenlsbres.dllj% vs cGDmJSd.exe
Source: cGDmJSd.exe, 00000000.00000000.333387343.00007FF6746EE000.00000002.00020000.sdmpBinary or memory string: OriginalFilenamePowerShell.EXEj% vs cGDmJSd.exe
Source: cGDmJSd.exeBinary or memory string: OriginalFilenamePowerShell.EXEj% vs cGDmJSd.exe
Source: classification engineClassification label: clean4.winEXE@2/4@0/0
Source: C:\Users\user\Desktop\cGDmJSd.exeFile created: C:\Users\user\Documents\20210504Jump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeMutant created: \Sessions\1\BaseNamedObjects\PSReadlineHistoryFile_1337272027
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6516:120:WilError_01
Source: C:\Users\user\Desktop\cGDmJSd.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hcrqdxq5.nd2.ps1Jump to behavior
Source: cGDmJSd.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\cGDmJSd.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dllJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\cGDmJSd.exe 'C:\Users\user\Desktop\cGDmJSd.exe'
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\cGDmJSd.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}\InProcServer32Jump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
Source: cGDmJSd.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: cGDmJSd.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: powershell.pdb source: cGDmJSd.exe
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeWindow / User API: threadDelayed 4973Jump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeWindow / User API: threadDelayed 2628Jump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exe TID: 6700Thread sleep time: -6456360425798339s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exe TID: 6700Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeMemory allocated: page read and write | page guardJump to behavior
Source: cGDmJSd.exe, 00000000.00000002.602482981.0000000001510000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
Source: cGDmJSd.exe, 00000000.00000002.602482981.0000000001510000.00000002.00000001.sdmpBinary or memory string: Progman
Source: cGDmJSd.exe, 00000000.00000002.602482981.0000000001510000.00000002.00000001.sdmpBinary or memory string: &Program Manager
Source: cGDmJSd.exe, 00000000.00000002.602482981.0000000001510000.00000002.00000001.sdmpBinary or memory string: Progmanlock
Source: C:\Users\user\Desktop\cGDmJSd.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDateJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.2\Microsoft.PowerShell.PSReadline.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\cGDmJSd.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection2Masquerading1OS Credential DumpingProcess Discovery2Remote ServicesData from Local SystemExfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDisable or Modify Tools1LSASS MemoryVirtualization/Sandbox Evasion21Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion21Security Account ManagerApplication Window Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection2NTDSSystem Information Discovery22Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 404287 Sample: cGDmJSd.exe Startdate: 04/05/2021 Architecture: WINDOWS Score: 0 5 cGDmJSd.exe 27 2->5         started        process3 7 conhost.exe 5->7         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.