Analysis

  • max time kernel
    142s
  • max time network
    167s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    10-02-2022 02:57

General

  • Target

    475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe

  • Size

    2.9MB

  • MD5

    d54474edd997f5ae1772d45974bd7005

  • SHA1

    1c6dd6518d61df04fe42b4280cbe1c0e62bb352b

  • SHA256

    475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57

  • SHA512

    e9f187eebdbef0c0b38d01c163c827ed6e6e5fcbe355ac50cded01521425a558f3d090c8b6d1039c760c623ca20432fe830d647428188428761e4b3a75d067f9

Score
10/10

Malware Config

Signatures

  • Gozi RM3

    A heavily modified version of Gozi using RM3 loader.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Modifies registry class 21 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe
    "C:\Users\Admin\AppData\Local\Temp\475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe"
    1⤵
      PID:1884
    • C:\Users\Admin\AppData\Local\Temp\475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe
      "C:\Users\Admin\AppData\Local\Temp\475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe" /SU
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:524
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" "http://go.1und1.de/os/win/ie_runonce"
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2008
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:2
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:548

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

      MD5

      a266bb7dcc38a562631361bbf61dd11b

      SHA1

      3b1efd3a66ea28b16697394703a72ca340a05bd5

      SHA256

      df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

      SHA512

      0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      MD5

      208ffdcffdac412e0255a3339ad30d1b

      SHA1

      4761b51b26f2d48eedc8ceddd38d844ed9ee5cbf

      SHA256

      d7bdaab70d3a86af9dfd4da8dbb8dd79d77b2576a3a65ef1fb6deb3a2766338d

      SHA512

      541155c024459d26bb4421eee5b7f6d53de125e29a8828955f2ab37388ac313cea3e5976bc13a83d2e4f18c2881c76e6923d7f10389a2fd16c5bc1277b699b99

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      MD5

      9adcc832c3369d9f8a8d56e70b267f84

      SHA1

      827cb12d8a9cdde2149371845c6308dea006d9ce

      SHA256

      8c46acfe32a3a7f10cc5dbc0a83164870df699e5578a7ebf1f8f0ca338547064

      SHA512

      33e50d618427336995584fc92d7dfcc0e13edf8553b3241871542aea65408879e6aac311c7a705d5009cf46b4378e12fa522af7ec6f2ccadeed8a580280a4ba2

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      MD5

      0215e205e8b7f335d4156875eb428888

      SHA1

      032189d8b71125539999cfb621f457832b067b8f

      SHA256

      8bf5a4b72a4b164e003c7ff36bab3318a462db721f98cfa9398cbde1c62114fc

      SHA512

      54701a1b22fa360aeb2aaa141bb1eb91dd6e4a4520844b26ea60ecd1f85e74e0f638c36e24976dbcb10745f5ed8b5d26cb5698b9db0932797b49e3531961f96d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      MD5

      4c39f08717acae7803e66b4600f3b619

      SHA1

      27486bcc43bf8017371c6ed8267b35561893b6d3

      SHA256

      f8093f0d8825d9e6c4f7c7330deef1b989b5c469bde104c1bf0cd5080ffe2731

      SHA512

      1057d7c2ac283d1319e9c23ce52f44a0954930ef04d107e78495d76024e6ca4f0ee6a0afce2abcadb691a00488ac4bbfb0ce88473837ae52d3b7568d7aa2d608

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

      MD5

      0dceead07ce610d7466e9f22265e952d

      SHA1

      0884e97dd246b7098e31f1ed778585ffd0e2de2a

      SHA256

      6bbccd3f0dae9a75f696682a0586e214fafca0704fb5d7e9cdc0d36ef329e70c

      SHA512

      d3b6568a66f04f7184cd4ad89788f287b6cbc5fb9976dbea2fff3ee49eaf25fa35000789d5752c4c00d2c083f17e3d5238eb43b9567c6fd395c0f9a7c469c6e0

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\XPBVYXR8.txt

      MD5

      60b4f86b3177a3f158a0ca41970cad3b

      SHA1

      6efe7deb483167b8661c26183be869a318427618

      SHA256

      45e68c5593e316ae7d9f561af1f6eaa5a3bcd4f956059cd9e407d3ef622ee996

      SHA512

      fc68c8095a975e69376947d3fb5a5e4295d4609c69d63a129e02bfd84d48c72bd001bd9db8791cbcad734e39556fc1dcc815606b3e0d931c5413b7884426bdea

    • memory/524-57-0x0000000000090000-0x0000000000091000-memory.dmp

      Filesize

      4KB

    • memory/1884-54-0x0000000075D61000-0x0000000075D63000-memory.dmp

      Filesize

      8KB

    • memory/1884-55-0x00000000001A0000-0x00000000001A2000-memory.dmp

      Filesize

      8KB