gozi_ifsb | 0cdb011bfac8731aa990d921e6a4748a4ec75ec6e62e0f6d0da2c03d00955886

General

Target

documenti-12.20.doc
Size

92KB
MD5

53915ecbd649a6008ae69c0dcacf591b
SHA1

2711d278e9cf36c4924a69659157d4e7b3b05e06
SHA256

0cdb011bfac8731aa990d921e6a4748a4ec75ec6e62e0f6d0da2c03d00955886
SHA512

d67e429e6f00d60deefe1abb3f13b240dd020b486a09c136e0c0c8ebf1c5802d87c4bb0fc26248de1e069b6c007a6921dc6d3a78d72789b0eecfb078a96b5556

Score

10^/10

gozi_ifsb banker trojan

Malware Config

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
Executes dropped EXE 1 IoCs

Processes:

ms.com

pid process

2376 ms.com
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2148 regsvr32.exe

pid	process
2376	ms.com

pid	process
2148	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 56 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30853491"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30853491"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3593066612"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50d10de873c9d601	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30aaf2e073c9d601	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{24DF0D62-3567-11EB-B59A-FE97B1193F0B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001cad0ccd232972468e753df42302a60a0000000002000000000010660000000100002000000077bbcc957b7642f2bea157c30de62e809b9bfae13536fbf6160a268c4c0af1d6000000000e8000000002000020000000ed3cd1206140252b2a7bd90ce7eeed5fb15f724a70583736031ecc084e1a2d4420000000c6187f52e8e08a39f489ceb7e3c908f9e74d4f0087efe14f8e5ffa5682e5f20440000000aa901aac685f4f346af5f788f9beee749c4ff07c958ee90c48d6af3384a988a0af2a904f03cad239a6258bd46c7be17c8b3a545a754578e34594df51653a86b9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001cad0ccd232972468e753df42302a60a00000000020000000000106600000001000020000000285e5a58352f6a7b8ff291bb2de2a3f79c714d5ab34558e536f72ab56a9ee818000000000e800000000200002000000024bc5f3fadb1f9157332c3289d48a4efee5f0d4cd0d64476f498a7cb4a167db120000000f6e86c9ede683cf13dfe803a3935627fb8fa8cad98bf63ad6eb960e12f2b6ebb4000000022680364c5c765314005d442dd1bd483747fdacbbffdd818fda0e55b3caa80d34ac8d9cc014a5b784fc6c35d959297faa6d4059e941e42990ea3e1028f2cfc9b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20842ffd73c9d601	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3593066612"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001cad0ccd232972468e753df42302a60a000000000200000000001066000000010000200000006c8662ec082cb666726d4a00ca4b8ce1a533b2f22f6bf5cf5e4b118a194a8abe000000000e80000000020000200000004d1e60507d3dd2fc36927b3a725a69bfdbc8b548761f7f412e897634e9db92b020000000ab19f89691bc90fcb92fb62f7df08e2b1b5fff69b3347348aede80f641f9fb3040000000ed53f17c6278bff37fe04b1d3608ccd893deedb48a7d02b912bfb7af3b3c8cd74bdc1e29af77fe39c106adbe1c1505840fe7d115856353bffaa4137e88281aad	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{31E8EA7F-3567-11EB-B59A-FE97B1193F0B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001cad0ccd232972468e753df42302a60a00000000020000000000106600000001000020000000bb3fd62ee4391826ac31b53f1fad54e2aa6c0c52ba38315d528156d9a915b118000000000e8000000002000020000000ea0693b2bc66f7cc9908dc4a29abdb9522b592804145410970145d56d4323a2b20000000b9de7ee2da3354a078fe69d6252159e76a7315c15d0909d298f7946c528b9fa140000000df3346fb775d2a424a48c3c3a253ddf4fc9f5f3d9823cb2411270a26973952e7c83ca2ea66bd8ffeb14b9209252986c3f8430fdf8a392949461631f940c8a39c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 100201e173c9d601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{019A93F2-3567-11EB-B59A-FE97B1193F0B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

636 WINWORD.EXE
636 WINWORD.EXE
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exe

pid process

200 iexplore.exe
368 iexplore.exe
2080 iexplore.exe

pid	process
200	iexplore.exe
368	iexplore.exe
2080	iexplore.exe

Suspicious use of SetWindowsHookEx 30 IoCs

Processes:

WINWORD.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

pid	process
636	WINWORD.EXE
636	WINWORD.EXE
636	WINWORD.EXE
636	WINWORD.EXE
636	WINWORD.EXE
636	WINWORD.EXE
636	WINWORD.EXE
636	WINWORD.EXE
636	WINWORD.EXE
636	WINWORD.EXE
636	WINWORD.EXE
636	WINWORD.EXE
636	WINWORD.EXE
636	WINWORD.EXE
636	WINWORD.EXE
636	WINWORD.EXE
636	WINWORD.EXE
636	WINWORD.EXE
200	iexplore.exe
200	iexplore.exe
684	IEXPLORE.EXE
684	IEXPLORE.EXE
368	iexplore.exe
368	iexplore.exe
912	IEXPLORE.EXE
912	IEXPLORE.EXE
2080	iexplore.exe
2080	iexplore.exe
860	IEXPLORE.EXE
860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

ms.comregsvr32.exeiexplore.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 2376 wrote to memory of 1304	2376	ms.com	regsvr32.exe
PID 2376 wrote to memory of 1304	2376	ms.com	regsvr32.exe
PID 1304 wrote to memory of 2148	1304	regsvr32.exe	regsvr32.exe
PID 1304 wrote to memory of 2148	1304	regsvr32.exe	regsvr32.exe
PID 1304 wrote to memory of 2148	1304	regsvr32.exe	regsvr32.exe
PID 200 wrote to memory of 684	200	iexplore.exe	IEXPLORE.EXE
PID 200 wrote to memory of 684	200	iexplore.exe	IEXPLORE.EXE
PID 200 wrote to memory of 684	200	iexplore.exe	IEXPLORE.EXE
PID 368 wrote to memory of 912	368	iexplore.exe	IEXPLORE.EXE
PID 368 wrote to memory of 912	368	iexplore.exe	IEXPLORE.EXE
PID 368 wrote to memory of 912	368	iexplore.exe	IEXPLORE.EXE
PID 2080 wrote to memory of 860	2080	iexplore.exe	IEXPLORE.EXE
PID 2080 wrote to memory of 860	2080	iexplore.exe	IEXPLORE.EXE
PID 2080 wrote to memory of 860	2080	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\documenti-12.20.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:636

C:\users\public\ms.com
C:\users\public\ms.com C:\users\public\ms.html
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376

C:\Windows\System32\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\temp.tmp
2⤵
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\SysWOW64\regsvr32.exe
C:\Users\Admin\AppData\Local\Temp\temp.tmp
3⤵
- Loads dropped DLL
PID:2148

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:200

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:200 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:684

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:368

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:368 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:912

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:860

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\temp.tmp
MD5
a7c80246b4dbe1085b435c505a1c6bd1

SHA1
a156ffca06b7f42e57bfcecadd1342adcdb44a5d

SHA256
eb3d0ac3165028922860c3e8e61e051faed8bf9d884ac96a8a493312aa88fe31

SHA512
a1fab85125bfc3c9a26c5df9a303b6fcc0cb338411b4a63a4838523b78e69052c371cac0b6292451a496426f72b605970df5421acd1b6ce98b1638766fcaee5b

Download Submit
C:\Users\Public\ms.com
MD5
98447a7f26ee9dac6b806924d6e21c90

SHA1
a67909346a56289b7087821437efcaa51da3b083

SHA256
c162abe51a04727507be4f98b95db6356dd64decd042dfb4090e57fa0101f2ed

SHA512
c708672a28072c7754eb99f0cf2aa81bf7205d8512ae44242848c2160acf26454029bfb4b76f928bac27a3bed260f95a71bd12bcf2620865b756ba89d66f261b

Download Submit
C:\users\public\ms.com
MD5
98447a7f26ee9dac6b806924d6e21c90

SHA1
a67909346a56289b7087821437efcaa51da3b083

SHA256
c162abe51a04727507be4f98b95db6356dd64decd042dfb4090e57fa0101f2ed

SHA512
c708672a28072c7754eb99f0cf2aa81bf7205d8512ae44242848c2160acf26454029bfb4b76f928bac27a3bed260f95a71bd12bcf2620865b756ba89d66f261b

Download Submit
C:\users\public\ms.html
MD5
3d4c1e100159158e91a1d06c6821a7cc

SHA1
cdc3b2a3280c6f7e8a201cb485e85222d15bd2ed

SHA256
042b36a012b50fd8073f3d47670dba0cefe36b71a909f6cfdc66b2c5ef4fcdb2

SHA512
5adf16e5bb68a114ff66a26b4a5282698968ac2ca51bb0569982408c31bd20801a8693dc8abc01d0b3f10dbf41a7f52eccb3a7911bd98ddc7098be4b707c5af9

Download Submit
\Users\Admin\AppData\Local\Temp\temp.tmp
MD5
a7c80246b4dbe1085b435c505a1c6bd1

SHA1
a156ffca06b7f42e57bfcecadd1342adcdb44a5d

SHA256
eb3d0ac3165028922860c3e8e61e051faed8bf9d884ac96a8a493312aa88fe31

SHA512
a1fab85125bfc3c9a26c5df9a303b6fcc0cb338411b4a63a4838523b78e69052c371cac0b6292451a496426f72b605970df5421acd1b6ce98b1638766fcaee5b

Download Submit
memory/636-6-0x00000255AAB22000-0x00000255AAB2F000-memory.dmp

Filesize
52KB

Download
memory/636-2-0x00007FF9FCB20000-0x00007FF9FD157000-memory.dmp

Filesize
6.2MB

Download
memory/636-5-0x00000255AAB22000-0x00000255AAB2F000-memory.dmp

Filesize
52KB

Download
memory/636-4-0x00000255AAB22000-0x00000255AAB2F000-memory.dmp

Filesize
52KB

Download
memory/684-14-0x0000000000000000-mapping.dmp

Download
memory/860-16-0x0000000000000000-mapping.dmp

Download
memory/912-15-0x0000000000000000-mapping.dmp

Download
memory/1304-10-0x0000000000000000-mapping.dmp

Download
memory/2148-12-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads