Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
24-06-2021 04:00
Static task
static1
Behavioral task
behavioral1
Sample
31b94c5a94aa8ce7e187360b0dc702b473d1c5d498d4de26f137b272ccbadaed.exe
Resource
win7v20210410
General
-
Target
31b94c5a94aa8ce7e187360b0dc702b473d1c5d498d4de26f137b272ccbadaed.exe
-
Size
315KB
-
MD5
99246958839423b9af0d2ea872c505d9
-
SHA1
6aba8c858610174bcff3c9cee57d8f7bc5d11564
-
SHA256
31b94c5a94aa8ce7e187360b0dc702b473d1c5d498d4de26f137b272ccbadaed
-
SHA512
b72cc152f2bb3799d678b4b371a85167ba441483a17d9a1c736df2a111abb0ad4ef7494939ed557ab25931a7fa35db52d0211f6899ed5a92f7e98756dfc0337e
Malware Config
Extracted
gozi_rm3
-
build
300974
Extracted
gozi_rm3
202106191
https://gogorobest.xyz
-
build
300974
-
exe_type
loader
-
non_target_locale
RU
-
server_id
12
-
url_path
index.htm
Signatures
-
Processes:
iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6260DD31-D4A1-11EB-95C8-E6C0E22A01F8} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7188DE71-D4A1-11EB-95C8-E6C0E22A01F8} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{79E733F1-D4A1-11EB-95C8-E6C0E22A01F8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10603911ae68d701 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000051618adbbbd0f84eb34ff59fe7045e8f0000000002000000000010660000000100002000000074df6ac669530de38512f5096189f7f5a666ec254aef9da5901066dfffb51d54000000000e80000000020000200000009c1ac6b6ca6c58d10e9f00d09e6332f037d2ef3798e35972e1a4818dd39f5b8a20000000b6268266fa7675fc9a93e7f6f2897c1bbf8f24a5801be4c82fb2534b533c83a840000000161f2a2191179652953ab4e07b858bf258a7b4a44909286268cde8e5dcc65da626c3191e8bf05fecd362ffbe9a912c1c631a83b0e6efd753b9ed0643c40fc585 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{59F90231-D4A1-11EB-95C8-E6C0E22A01F8} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000051618adbbbd0f84eb34ff59fe7045e8f00000000020000000000106600000001000020000000812e3c98a87b7cd876da00f9902f4e4583a36bc3df14685a2f79194075cb8d7d000000000e800000000200002000000005f5af364a5de1675c78ebe03e22a41a182648b88551b954524f4cf74e81be6d90000000dd9dc3ef986e21d00058a08a9ebb712ab5741887ec58c2d27d07e34e527409b817b6ba4543cff321a4bc7bc2e2684b1996a86b9de03775c3df5d0fde2b5f4b1bcca430eaba02c443d0a747084a333459708dfca13ee1ae55cfd3176851cfa8f008c52096ebb9a9f5ec9940fc53cc6fafd4077e6d50c25c6ae78e198d0dbb57bc249709ddc30acaaaf9e37c737c7e0ef34000000035ae92bff3018b4272a90b7021fbab6c30c38eb6e8faf787b6901cd11e6731a71e5acea0d29951ab7d56b79c34acce4a069b2255064c199761a16b567a35ac32 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
Processes:
iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exepid process 1516 iexplore.exe 1616 iexplore.exe 796 iexplore.exe 952 iexplore.exe 1112 iexplore.exe 832 iexplore.exe 2036 iexplore.exe 1412 iexplore.exe -
Suspicious use of SetWindowsHookEx 32 IoCs
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEpid process 1516 iexplore.exe 1516 iexplore.exe 548 IEXPLORE.EXE 548 IEXPLORE.EXE 1616 iexplore.exe 1616 iexplore.exe 1408 IEXPLORE.EXE 1408 IEXPLORE.EXE 796 iexplore.exe 796 iexplore.exe 1556 IEXPLORE.EXE 1556 IEXPLORE.EXE 952 iexplore.exe 952 iexplore.exe 340 IEXPLORE.EXE 340 IEXPLORE.EXE 1112 iexplore.exe 1112 iexplore.exe 1296 IEXPLORE.EXE 1296 IEXPLORE.EXE 832 iexplore.exe 832 iexplore.exe 684 IEXPLORE.EXE 684 IEXPLORE.EXE 2036 iexplore.exe 2036 iexplore.exe 1700 IEXPLORE.EXE 1700 IEXPLORE.EXE 1412 iexplore.exe 1412 iexplore.exe 628 IEXPLORE.EXE 628 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exedescription pid process target process PID 1516 wrote to memory of 548 1516 iexplore.exe IEXPLORE.EXE PID 1516 wrote to memory of 548 1516 iexplore.exe IEXPLORE.EXE PID 1516 wrote to memory of 548 1516 iexplore.exe IEXPLORE.EXE PID 1516 wrote to memory of 548 1516 iexplore.exe IEXPLORE.EXE PID 1616 wrote to memory of 1408 1616 iexplore.exe IEXPLORE.EXE PID 1616 wrote to memory of 1408 1616 iexplore.exe IEXPLORE.EXE PID 1616 wrote to memory of 1408 1616 iexplore.exe IEXPLORE.EXE PID 1616 wrote to memory of 1408 1616 iexplore.exe IEXPLORE.EXE PID 796 wrote to memory of 1556 796 iexplore.exe IEXPLORE.EXE PID 796 wrote to memory of 1556 796 iexplore.exe IEXPLORE.EXE PID 796 wrote to memory of 1556 796 iexplore.exe IEXPLORE.EXE PID 796 wrote to memory of 1556 796 iexplore.exe IEXPLORE.EXE PID 952 wrote to memory of 340 952 iexplore.exe IEXPLORE.EXE PID 952 wrote to memory of 340 952 iexplore.exe IEXPLORE.EXE PID 952 wrote to memory of 340 952 iexplore.exe IEXPLORE.EXE PID 952 wrote to memory of 340 952 iexplore.exe IEXPLORE.EXE PID 1112 wrote to memory of 1296 1112 iexplore.exe IEXPLORE.EXE PID 1112 wrote to memory of 1296 1112 iexplore.exe IEXPLORE.EXE PID 1112 wrote to memory of 1296 1112 iexplore.exe IEXPLORE.EXE PID 1112 wrote to memory of 1296 1112 iexplore.exe IEXPLORE.EXE PID 832 wrote to memory of 684 832 iexplore.exe IEXPLORE.EXE PID 832 wrote to memory of 684 832 iexplore.exe IEXPLORE.EXE PID 832 wrote to memory of 684 832 iexplore.exe IEXPLORE.EXE PID 832 wrote to memory of 684 832 iexplore.exe IEXPLORE.EXE PID 2036 wrote to memory of 1700 2036 iexplore.exe IEXPLORE.EXE PID 2036 wrote to memory of 1700 2036 iexplore.exe IEXPLORE.EXE PID 2036 wrote to memory of 1700 2036 iexplore.exe IEXPLORE.EXE PID 2036 wrote to memory of 1700 2036 iexplore.exe IEXPLORE.EXE PID 1412 wrote to memory of 628 1412 iexplore.exe IEXPLORE.EXE PID 1412 wrote to memory of 628 1412 iexplore.exe IEXPLORE.EXE PID 1412 wrote to memory of 628 1412 iexplore.exe IEXPLORE.EXE PID 1412 wrote to memory of 628 1412 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\31b94c5a94aa8ce7e187360b0dc702b473d1c5d498d4de26f137b272ccbadaed.exe"C:\Users\Admin\AppData\Local\Temp\31b94c5a94aa8ce7e187360b0dc702b473d1c5d498d4de26f137b272ccbadaed.exe"1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1516 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1616 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:796 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:952 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1112 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:832 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1412 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751MD5
0675c0d0da9a6eac284a10c2ddda636a
SHA16c7856ef6be6b6fce283423cf9d48e7d101d7fa7
SHA2567852903b2b3bd59c816aa0a74272a4c51bae13f38bb72a67f3fd04b50d061b50
SHA51209a3f652bd943a7cc3def436c9fe769bf5c30499b78d63598fc2fc23fa15932a08d545354129fc346133efbda456edfe8d4a10bab5a50abe7d132c2228815232
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4MD5
33903bc82111f229f0d3253b54e7dc56
SHA13c251b0440960195337ed9608a786a5aa44adea5
SHA256a5599d4d4c3755410c3f394e1351e788375e8e487b9b4525e2e671ce9a9262c5
SHA512a374919bb96e04dcd17038ef8638c22602e8969e2b6ace2060beec85dc39781bfcaa1bf31ab54898e1279d05c71d37a78d92c43d3679ce1df890d08799419795
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9E1A1F5F9038B3A725570AC643199BE3MD5
1f2bc239e5eaee908952ee78fc85d40a
SHA11c6ec44ebf112b4114d88a4cb9481d8256560bcc
SHA25658cc42d2628227c13950db87d60e23784bcef3e10be7ab198afc854923feee15
SHA5128b1a1d18693e94a75bf09aa2de7e832ad1caf08eb558897fcfa5ba5c3c5b3111dd027171bfe6f695558ba2ae2e8e13f98d9389dd8282d56b6f6244385e26ba3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357MD5
a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751MD5
95959cb667c87e7ddf468087f8d147cf
SHA1a4624c19c909295292cee877ea7c6c4d016b3530
SHA25617a58392be3788f5727dc6f40312f0838efb8ceda33fe412cbe9ae014e0f059e
SHA512490b5eefdd5cad38a353c10ebeb8ea3ded687378397a87150d4503b29daca2d6f3a0d861b2005bf90b34838cd67e146e0a92594f8958ba24659a4c4e181e5745
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4MD5
c3591f454cce0ae7ba2caa3df7577d8e
SHA1e6e1a3204dd8921ad74a63ce052164b5542611ea
SHA2564ae81ee7b78c7dbdbaabf01f8645b4389e632accecf344c6b76fba23960a238f
SHA512baee11f09f14d407322bf3195e69b6e19c98caa98499e9f256bb8dad273624485fcf473584d87ba8cce639d5fdca3bc474e891353e264d39ee7eda5a4e785c8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015MD5
1159601eb6ee2e5973a159473b6dfb75
SHA1b8c1229f778a2e8fdb82dc5d43046ea28050c16a
SHA2560eb7a14703fd1153944ffaccdc9d269025d692224a779e3e3cb16e0b6e439a6b
SHA512877bca1704dc6291e9b8391d0e72a3bbcd6a4fc0c22be48840277a120cabb4891d7d8dd69d718303c234a290ca3a6f53ace9a7421d6f3813af798aa929b0abff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9E1A1F5F9038B3A725570AC643199BE3MD5
903a06c43dd774746eb41514237722b8
SHA1fa259817fbfd3ea13f44bfd2dad688feb805de8e
SHA2562c0934013c426d17aa757c2cb13f6df95be002d9511aa4f2b16e34d41fd9ebb9
SHA5121f4cf5447826978b25a80d27a2ced54376f1276777383bd9d143822ee2ef74362bf53146bc902d6842ff120cc8467a46ef515f92bfa66898fb503ac3605a11f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357MD5
efd7be3d2d85a5efba925a8be0874c42
SHA122a2e2ba33d410340a891053f092a3ba3d0356c5
SHA2569b6734f0dd49f61e062722053ccf46493b1c353a1b37b964cf0d506eb833e6d2
SHA512e14d32a67e3ea3db941bd61d20032b7459570d0e912d5b429239f73304e81c63be9fcf15cd99909ff9402c726d629e11fd8a999ef6b46d30e6c444727fe0ae31
-
memory/340-81-0x0000000000000000-mapping.dmp
-
memory/548-65-0x0000000000000000-mapping.dmp
-
memory/628-88-0x0000000000000000-mapping.dmp
-
memory/684-83-0x0000000000000000-mapping.dmp
-
memory/1048-61-0x0000000001000000-0x00000000014EC000-memory.dmpFilesize
4.9MB
-
memory/1048-62-0x0000000000230000-0x0000000000240000-memory.dmpFilesize
64KB
-
memory/1048-59-0x0000000000220000-0x000000000022C000-memory.dmpFilesize
48KB
-
memory/1048-60-0x0000000075721000-0x0000000075723000-memory.dmpFilesize
8KB
-
memory/1048-67-0x0000000000270000-0x0000000000272000-memory.dmpFilesize
8KB
-
memory/1296-82-0x0000000000000000-mapping.dmp
-
memory/1408-70-0x00000000005D0000-0x00000000005D2000-memory.dmpFilesize
8KB
-
memory/1408-68-0x0000000000000000-mapping.dmp
-
memory/1556-78-0x0000000000000000-mapping.dmp
-
memory/1700-85-0x0000000000000000-mapping.dmp
-
memory/1700-87-0x0000000000470000-0x0000000000472000-memory.dmpFilesize
8KB
-
memory/2036-84-0x000007FEFBB41000-0x000007FEFBB43000-memory.dmpFilesize
8KB