gozi_ifsb | 4d1c37dac45daec5880750b8499b337e6ccf3696bfd645c4e22f388001e79900

General

Target

scongiurare.12.01.2020.doc
Size

91KB
MD5

9edc856edd53b45e9c6f84c2e65e1cc7
SHA1

f16bd28f364c678054ea5c73651a668dfd68a5bc
SHA256

4d1c37dac45daec5880750b8499b337e6ccf3696bfd645c4e22f388001e79900
SHA512

1f268c6b48cf7b5771947f2803ffcf8a1156102f1be6c9305e9e18972c48fa68ad2b51ed7d9a3c723a0e48cfbb9b51daf74e9167692199e5027b04ff1c671c76

Score

10^/10

gozi_ifsb banker trojan

Malware Config

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
Executes dropped EXE 1 IoCs

Processes:

ms.com

pid process

1392 ms.com
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1644 regsvr32.exe

pid	process
1392	ms.com

pid	process
1644	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 56 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C4749446-3570-11EB-B59A-F648E9E4AC23} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1756411482"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d05f867a7dc9d601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 806ab68f7dc9d601	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30853501"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B76F79EF-3570-11EB-B59A-F648E9E4AC23} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001cad0ccd232972468e753df42302a60a000000000200000000001066000000010000200000005a7bace6f8718e7000e90e8646839eeee810a502f815a784baef090905630c90000000000e80000000020000200000001541801156a3016792a8f61a5d34d5bddb79b2648e66777b781f53f9fbd2ddb820000000c959b6faa8d267957be213b9e6bac16868eab3c0be6f0efe6f92e46c327e8a1c40000000cea1202db13c80e7ce763419795271869515654335e9ea46c3a3a968227cf2910a115aad51b43c1309289026e76e07838a10e2e57d2a4296fb651909ca2972af	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60c187737dc9d601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 401996737dc9d601	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001cad0ccd232972468e753df42302a60a000000000200000000001066000000010000200000007e5d4fd6a30f8679d50540b72e7664c5ff08b80528da6dec4ff136581b8b7525000000000e80000000020000200000000bd2be910277db9e433ea95d0c5875e2d085adbd3e8313353a82534eb0bdc98b20000000bd206a8f178d49f4c2d5adae58eddeec99f9b6fd8e138e96a5e9ab8b0c145e4840000000fdc628fe218a3d7fdeb8788615f94516e2cbdafedc7545323e67004fe5ef2dd99cf245b81eed4d3c5214977f5f82d79c978333e38099105b72d89640a16f2c5d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001cad0ccd232972468e753df42302a60a000000000200000000001066000000010000200000004e7048ea0d41c744fdbf420e59867a5a152f8da085b0f4a34347ad6c46497c1c000000000e8000000002000020000000022cb5dd2766063461b672f65ea2b7d5228fc2363256c5bf6c5ddf4aca2241882000000085b34f9116c2b58fd051411d31cdcbbaa037640e69bb88b4ac1216cfab3e07ad40000000c5fbec812629a6e3f8db7c83e1cfa58c1160333029534e243e491e78f3c07b37ba12060af834db9042cf3a46a61921831a07308bda5114e5b2cc97e8c27956f1	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1756255090"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001cad0ccd232972468e753df42302a60a0000000002000000000010660000000100002000000070c280d1df6f4930c99e5d5dd2440aba1a607f55df662a76b76886da132aa86d000000000e80000000020000200000003daaee658721dc31d6549e59dd23db2ee9b889b7212ae7b20cfe733123d2438520000000d465c0753ba5f680571939cd56eae7c26c602b07b82b96b689a10b448727cdf6400000006d3af626e2493f3d59444836c5e9c02841e509583b4d248472c7c00a93da3c8e56755d6351ac2f634faa634aae3053062ca354ef3d15320a2353e3b1d2fe5f83	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{945CA051-3570-11EB-B59A-F648E9E4AC23} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30853501"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

3940 WINWORD.EXE
3940 WINWORD.EXE
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exe

pid process

1560 iexplore.exe
3796 iexplore.exe
1512 iexplore.exe

pid	process
1560	iexplore.exe
3796	iexplore.exe
1512	iexplore.exe

Suspicious use of SetWindowsHookEx 30 IoCs

Processes:

WINWORD.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

pid	process
3940	WINWORD.EXE
3940	WINWORD.EXE
3940	WINWORD.EXE
3940	WINWORD.EXE
3940	WINWORD.EXE
3940	WINWORD.EXE
3940	WINWORD.EXE
3940	WINWORD.EXE
3940	WINWORD.EXE
3940	WINWORD.EXE
3940	WINWORD.EXE
3940	WINWORD.EXE
3940	WINWORD.EXE
3940	WINWORD.EXE
3940	WINWORD.EXE
3940	WINWORD.EXE
3940	WINWORD.EXE
3940	WINWORD.EXE
1560	iexplore.exe
1560	iexplore.exe
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
3796	iexplore.exe
3796	iexplore.exe
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
1512	iexplore.exe
1512	iexplore.exe
3484	IEXPLORE.EXE
3484	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

ms.comregsvr32.exeiexplore.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 1392 wrote to memory of 3768	1392	ms.com	regsvr32.exe
PID 1392 wrote to memory of 3768	1392	ms.com	regsvr32.exe
PID 3768 wrote to memory of 1644	3768	regsvr32.exe	regsvr32.exe
PID 3768 wrote to memory of 1644	3768	regsvr32.exe	regsvr32.exe
PID 3768 wrote to memory of 1644	3768	regsvr32.exe	regsvr32.exe
PID 1560 wrote to memory of 2964	1560	iexplore.exe	IEXPLORE.EXE
PID 1560 wrote to memory of 2964	1560	iexplore.exe	IEXPLORE.EXE
PID 1560 wrote to memory of 2964	1560	iexplore.exe	IEXPLORE.EXE
PID 3796 wrote to memory of 2236	3796	iexplore.exe	IEXPLORE.EXE
PID 3796 wrote to memory of 2236	3796	iexplore.exe	IEXPLORE.EXE
PID 3796 wrote to memory of 2236	3796	iexplore.exe	IEXPLORE.EXE
PID 1512 wrote to memory of 3484	1512	iexplore.exe	IEXPLORE.EXE
PID 1512 wrote to memory of 3484	1512	iexplore.exe	IEXPLORE.EXE
PID 1512 wrote to memory of 3484	1512	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\scongiurare.12.01.2020.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3940

C:\users\public\ms.com
C:\users\public\ms.com C:\users\public\ms.html
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392

C:\Windows\System32\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\temp.tmp
2⤵
- Suspicious use of WriteProcessMemory
PID:3768

C:\Windows\SysWOW64\regsvr32.exe
C:\Users\Admin\AppData\Local\Temp\temp.tmp
3⤵
- Loads dropped DLL
PID:1644

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1560

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1560 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2964

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3796

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3796 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2236

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1512 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3484

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\temp.tmp
MD5
16718ff4efd5bfca6b4fa9eef5c52bd1

SHA1
f1ed1509f69e8058176e452f681cb8fa4f13dbae

SHA256
1df19585c4a549ab0086dfdcfe2b4f062922d0ed7b79e5e09f1398b31500f727

SHA512
cd9792d423cff5e2dec723df53e6630c22221989da13ca9261ed0616764d32ed1f90c65ce98249dfe53fa5262545321d2408114e094a5057b028563b821a9594

Download Submit
C:\Users\Public\ms.com
MD5
98447a7f26ee9dac6b806924d6e21c90

SHA1
a67909346a56289b7087821437efcaa51da3b083

SHA256
c162abe51a04727507be4f98b95db6356dd64decd042dfb4090e57fa0101f2ed

SHA512
c708672a28072c7754eb99f0cf2aa81bf7205d8512ae44242848c2160acf26454029bfb4b76f928bac27a3bed260f95a71bd12bcf2620865b756ba89d66f261b

Download Submit
C:\users\public\ms.com
MD5
98447a7f26ee9dac6b806924d6e21c90

SHA1
a67909346a56289b7087821437efcaa51da3b083

SHA256
c162abe51a04727507be4f98b95db6356dd64decd042dfb4090e57fa0101f2ed

SHA512
c708672a28072c7754eb99f0cf2aa81bf7205d8512ae44242848c2160acf26454029bfb4b76f928bac27a3bed260f95a71bd12bcf2620865b756ba89d66f261b

Download Submit
C:\users\public\ms.html
MD5
c95ad501989d92e932c8b38d52955a9c

SHA1
19223f16652ae22baca91cb4030e7f81aa3efff1

SHA256
37ed664d7ba10c77315d7190e5b335e4ca4c46bc7255b76314ad7ab694db6ae0

SHA512
13bd20b2b890c8a03e4064da2dbe799f66c8d4fa43b0eb33b6b552155e123c2d39faff4834b4078d8b732f7ba69a8ab338924cf908d55fd5007d630641cb5c85

Download Submit
\Users\Admin\AppData\Local\Temp\temp.tmp
MD5
16718ff4efd5bfca6b4fa9eef5c52bd1

SHA1
f1ed1509f69e8058176e452f681cb8fa4f13dbae

SHA256
1df19585c4a549ab0086dfdcfe2b4f062922d0ed7b79e5e09f1398b31500f727

SHA512
cd9792d423cff5e2dec723df53e6630c22221989da13ca9261ed0616764d32ed1f90c65ce98249dfe53fa5262545321d2408114e094a5057b028563b821a9594

Download Submit
memory/1644-13-0x0000000000000000-mapping.dmp

Download
memory/2236-16-0x0000000000000000-mapping.dmp

Download
memory/2964-15-0x0000000000000000-mapping.dmp

Download
memory/3484-17-0x0000000000000000-mapping.dmp

Download
memory/3768-11-0x0000000000000000-mapping.dmp

Download
memory/3940-2-0x00000245313D0000-0x0000024531A07000-memory.dmp

Filesize
6.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads