gozi_ifsb | 83439db58d913186b422724bea2ed8d674956e8f1c2b3f00dc6c8b91d60ffdba

General

Target

decree 06.21.doc
Size

45KB
MD5

46e887ac0d356a30dc8a9971d9486dbe
SHA1

60468618a0e2e4d815af07e8652fba0437ddc5e6
SHA256

83439db58d913186b422724bea2ed8d674956e8f1c2b3f00dc6c8b91d60ffdba
SHA512

83a59a9afb67d5e4f9f49938df7a496839cda47d425b74405052ddc864a480efb4dfd0a55847e5dbe866762cc9f10210fa23cd5a8a40a06b2a0b002fff916d63

Score

10^/10

gozi_ifsb 6000 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

6000

C2

authd.feronok.com

app.bighomegl.at

Attributes

build
250204
exe_type
loader
server_id
580

rsa_pubkey.base64

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

explorer.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	2028	1888	explorer.exe	WINWORD.EXE

Blocklisted process makes network request 1 IoCs

Processes:

mshta.exe

flow pid process

5 1832 mshta.exe
Downloads MZ/PE file
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1640 regsvr32.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

flow	pid	process
5	1832	mshta.exe

pid	process
1640	regsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEWINWORD.EXEiexplore.exeiexplore.exemshta.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 407060f4045ed701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000051618adbbbd0f84eb34ff59fe7045e8f00000000020000000000106600000001000020000000b5199750582ae38b55d3ab3782098064a2f19ac08c702ea22e1aba8af1854f8c000000000e8000000002000020000000bd3b307dffd68db789ef4c630bdb735b8ca038de93bc90f50d665ad4efdffba3900000009521d3eb803d670e6342a00726e7fc34c1a97363aae804eb1f52154362938c8cc88cd110c553f6767b359a4469daf80e9d53a9c22bf0a4a09d8b20021ae48a8fce87b07b03c56586f0e80dc6708a7838b5c62d5ea10e7fc0c62498b4d4c8327a4b6034a1057e5f267ff17335be7dcd87a66e10a8ab5be9c384c5b4bb1626e9f9f31b1ed2ba0616b0d9cb5fa0c8170fe140000000b5ffd53bbb013c86d859270d825a457fc3d818e927673aac75c7a4fc3ea2f1a6d797e6b7d32e7df0eb3947084b3521428f15b978cb41d97dcee8f55e04368035	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1F1E8DA1-C9F8-11EB-B526-FEC9D8D8C4F3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{387C34A1-C9F8-11EB-B526-FEC9D8D8C4F3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000051618adbbbd0f84eb34ff59fe7045e8f000000000200000000001066000000010000200000008e9d80f424ec343df13a41bad8bd7a76cbc0490490baabf36eee97f6790bd97b000000000e800000000200002000000028078fa65e68379c542450a42eb15aa2da2793dc71363734f8be1041fee84fe620000000fe02865dc59815c81a9d33bc40fdc5725fdb830388c42bc16e1e68ac6c3b38c0400000000c864ce97b66d1a073aaecf998edf3185e8d0f80fffe42de52ae0823fb925b5f1c986fa57e7493ec448ffed6ef5ab6e5f11d2f09345ecec25881ff83f2073211	iexplore.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1888 WINWORD.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeiexplore.exe

pid process

1744 iexplore.exe
1668 iexplore.exe

pid	process
1744	iexplore.exe
1668	iexplore.exe

Suspicious use of SetWindowsHookEx 24 IoCs

Processes:

WINWORD.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

pid	process
1888	WINWORD.EXE
1888	WINWORD.EXE
1888	WINWORD.EXE
1888	WINWORD.EXE
1888	WINWORD.EXE
1888	WINWORD.EXE
1888	WINWORD.EXE
1888	WINWORD.EXE
1888	WINWORD.EXE
1888	WINWORD.EXE
1888	WINWORD.EXE
1888	WINWORD.EXE
1888	WINWORD.EXE
1888	WINWORD.EXE
1888	WINWORD.EXE
1888	WINWORD.EXE
1744	iexplore.exe
1744	iexplore.exe
1624	IEXPLORE.EXE
1624	IEXPLORE.EXE
1668	iexplore.exe
1668	iexplore.exe
1180	IEXPLORE.EXE
1180	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

WINWORD.EXEexplorer.exemshta.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 1888 wrote to memory of 2028	1888	WINWORD.EXE	explorer.exe
PID 1888 wrote to memory of 2028	1888	WINWORD.EXE	explorer.exe
PID 1888 wrote to memory of 2028	1888	WINWORD.EXE	explorer.exe
PID 1888 wrote to memory of 2028	1888	WINWORD.EXE	explorer.exe
PID 1820 wrote to memory of 1832	1820	explorer.exe	mshta.exe
PID 1820 wrote to memory of 1832	1820	explorer.exe	mshta.exe
PID 1820 wrote to memory of 1832	1820	explorer.exe	mshta.exe
PID 1820 wrote to memory of 1832	1820	explorer.exe	mshta.exe
PID 1888 wrote to memory of 552	1888	WINWORD.EXE	splwow64.exe
PID 1888 wrote to memory of 552	1888	WINWORD.EXE	splwow64.exe
PID 1888 wrote to memory of 552	1888	WINWORD.EXE	splwow64.exe
PID 1888 wrote to memory of 552	1888	WINWORD.EXE	splwow64.exe
PID 1832 wrote to memory of 1640	1832	mshta.exe	regsvr32.exe
PID 1832 wrote to memory of 1640	1832	mshta.exe	regsvr32.exe
PID 1832 wrote to memory of 1640	1832	mshta.exe	regsvr32.exe
PID 1832 wrote to memory of 1640	1832	mshta.exe	regsvr32.exe
PID 1832 wrote to memory of 1640	1832	mshta.exe	regsvr32.exe
PID 1832 wrote to memory of 1640	1832	mshta.exe	regsvr32.exe
PID 1832 wrote to memory of 1640	1832	mshta.exe	regsvr32.exe
PID 1744 wrote to memory of 1624	1744	iexplore.exe	IEXPLORE.EXE
PID 1744 wrote to memory of 1624	1744	iexplore.exe	IEXPLORE.EXE
PID 1744 wrote to memory of 1624	1744	iexplore.exe	IEXPLORE.EXE
PID 1744 wrote to memory of 1624	1744	iexplore.exe	IEXPLORE.EXE
PID 1668 wrote to memory of 1180	1668	iexplore.exe	IEXPLORE.EXE
PID 1668 wrote to memory of 1180	1668	iexplore.exe	IEXPLORE.EXE
PID 1668 wrote to memory of 1180	1668	iexplore.exe	IEXPLORE.EXE
PID 1668 wrote to memory of 1180	1668	iexplore.exe	IEXPLORE.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\decree 06.21.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888

C:\Windows\explorer.exe
"C:\Windows\explorer.exe" c:\programdata\beforeObj.hta
2⤵
- Process spawned unexpected child process
PID:2028

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:552

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\beforeObj.hta"
2⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" c:\users\public\beforeObj.jpg
3⤵
- Loads dropped DLL
PID:1640

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1744 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1624

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1668 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1180

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\beforeObj.hta
MD5
bb28452e52cf940a7cd3d3ab386bfd81

SHA1
6784811a716bdeb1871296b256847b7ec4aec26a

SHA256
79a5b5ed478100c39eda1c4c32280296d585991d2ab0722bf69be0460f3136cc

SHA512
45f512467a70da4afc118f5a1348980026ea668cf488b13578544f18e4719d92186c111c43ba565ebee50b2d117939d2a6199bc1fb1f57ceb321aeddb9ed2179

Download Submit
\??\c:\users\public\beforeObj.jpg
MD5
ac96eacfbae61a8fcf57eaf2cd106f1e

SHA1
ea2ecda37757a808cb162e7388bfe22c0329bc2e

SHA256
6bd5b6695804be9d0b8688fd7b9a0195fb981553e47e34c8f4c4d6b2434a5923

SHA512
7f164d39ec17933763cc928690c3fdf44b83abfa114f9700f804be8dd4a4e52c5133201941052e5293f22be58cca69d5c3d83f7245d5a6e95d66fb683fab211d

Download Submit
\Users\Public\beforeObj.jpg
MD5
ac96eacfbae61a8fcf57eaf2cd106f1e

SHA1
ea2ecda37757a808cb162e7388bfe22c0329bc2e

SHA256
6bd5b6695804be9d0b8688fd7b9a0195fb981553e47e34c8f4c4d6b2434a5923

SHA512
7f164d39ec17933763cc928690c3fdf44b83abfa114f9700f804be8dd4a4e52c5133201941052e5293f22be58cca69d5c3d83f7245d5a6e95d66fb683fab211d

Download Submit
memory/552-67-0x0000000000000000-mapping.dmp

Download
memory/1180-81-0x0000000000800000-0x0000000000802000-memory.dmp

Filesize
8KB

Download
memory/1180-79-0x0000000000000000-mapping.dmp

Download
memory/1624-77-0x0000000000000000-mapping.dmp

Download
memory/1640-71-0x0000000075161000-0x0000000075163000-memory.dmp

Filesize
8KB

Download
memory/1640-70-0x0000000000000000-mapping.dmp

Download
memory/1640-75-0x000000006AAB0000-0x000000006AB5F000-memory.dmp

Filesize
700KB

Download
memory/1640-74-0x000000006AAB0000-0x000000006AABD000-memory.dmp

Filesize
52KB

Download
memory/1640-76-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1832-69-0x0000000003470000-0x00000000035CC000-memory.dmp

Filesize
1.4MB

Download
memory/1832-66-0x0000000000000000-mapping.dmp

Download
memory/1888-59-0x0000000072121000-0x0000000072124000-memory.dmp

Filesize
12KB

Download
memory/1888-78-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1888-61-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1888-60-0x000000006FBA1000-0x000000006FBA3000-memory.dmp

Filesize
8KB

Download
memory/2028-63-0x000007FEFB571000-0x000007FEFB573000-memory.dmp

Filesize
8KB

Download
memory/2028-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads