Analysis
-
max time kernel
80s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-07-2022 17:10
Static task
static1
Behavioral task
behavioral1
Sample
3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.exe
Resource
win10v2004-20220414-en
General
-
Target
3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.exe
-
Size
369KB
-
MD5
506e018cc6924a36703773cfe8310746
-
SHA1
3ade716c25d6c7417316687dfd16af63b85eb3b5
-
SHA256
3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3
-
SHA512
62032047608c35cf94e561b8501330723165300dc86262023eb312dab6f1b49c81c26e25e7c121591b79f9a1be40df158a7e788108c7b339270d9e60681d4baa
Malware Config
Extracted
gozi_ifsb
1000
dipsitripsikey70.com/adwordsdata/dropbox/xxx
underbulletkey77.com/adwordsdata/dropbox/xxx
statisticaregger32.com/adwordsdata/dropbox/xxx
-
exe_type
worker
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1504 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Authives = "C:\\Windows\\system32\\cnvfres2.exe" 3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.exe -
Drops file in System32 directory 2 IoCs
Processes:
3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.exedescription ioc process File created C:\Windows\system32\cnvfres2.exe 3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.exe File opened for modification C:\Windows\system32\cnvfres2.exe 3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.exedescription pid process target process PID 1648 set thread context of 1968 1648 3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.exe explorer.exe -
Drops file in Windows directory 1 IoCs
Processes:
explorer.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.exepid process 1648 3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1968 explorer.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.exepid process 1648 3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
explorer.exeAUDIODG.EXEdescription pid process Token: SeShutdownPrivilege 1968 explorer.exe Token: SeShutdownPrivilege 1968 explorer.exe Token: SeShutdownPrivilege 1968 explorer.exe Token: SeShutdownPrivilege 1968 explorer.exe Token: SeShutdownPrivilege 1968 explorer.exe Token: SeShutdownPrivilege 1968 explorer.exe Token: SeShutdownPrivilege 1968 explorer.exe Token: SeShutdownPrivilege 1968 explorer.exe Token: SeShutdownPrivilege 1968 explorer.exe Token: SeShutdownPrivilege 1968 explorer.exe Token: 33 1404 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1404 AUDIODG.EXE Token: 33 1404 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1404 AUDIODG.EXE Token: SeShutdownPrivilege 1968 explorer.exe Token: SeShutdownPrivilege 1968 explorer.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
explorer.exepid process 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe -
Suspicious use of SendNotifyMessage 17 IoCs
Processes:
explorer.exepid process 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
explorer.exepid process 1968 explorer.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.execmd.exedescription pid process target process PID 1648 wrote to memory of 1968 1648 3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.exe explorer.exe PID 1648 wrote to memory of 1968 1648 3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.exe explorer.exe PID 1648 wrote to memory of 1968 1648 3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.exe explorer.exe PID 1648 wrote to memory of 1968 1648 3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.exe explorer.exe PID 1648 wrote to memory of 1968 1648 3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.exe explorer.exe PID 1648 wrote to memory of 1968 1648 3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.exe explorer.exe PID 1648 wrote to memory of 1968 1648 3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.exe explorer.exe PID 1648 wrote to memory of 1504 1648 3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.exe cmd.exe PID 1648 wrote to memory of 1504 1648 3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.exe cmd.exe PID 1648 wrote to memory of 1504 1648 3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.exe cmd.exe PID 1648 wrote to memory of 1504 1648 3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.exe cmd.exe PID 1504 wrote to memory of 660 1504 cmd.exe attrib.exe PID 1504 wrote to memory of 660 1504 cmd.exe attrib.exe PID 1504 wrote to memory of 660 1504 cmd.exe attrib.exe PID 1504 wrote to memory of 660 1504 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.exe"C:\Users\Admin\AppData\Local\Temp\3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\7101836.bat" "C:\Users\Admin\AppData\Local\Temp\3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.exe""2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\3b3c2bbd44645af71db243bdb80635e8ab9e5c6c830d1362ad0fbb439c22c4f3.exe"3⤵
- Views/modifies file attributes
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5601⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7101836.batFilesize
72B
MD500615ec1de7c8c6f2ad51d052ddc6cb2
SHA15828b6b5b9ffa0564fda055ea6f314ee1481e0cb
SHA256b77f6932602f9db141df14ac628fd79c41ce8064bf3db82f50f785e169280b6c
SHA51267eba5a0c3217f332e106ab0fbc7c0ebc3ef752cdc40b2f19b66842fed78a849d506289fc2d845218d967a457286ff8c858fa0f1e096774a5e12dfb080c92389
-
memory/660-63-0x0000000000000000-mapping.dmp
-
memory/1504-59-0x0000000000000000-mapping.dmp
-
memory/1648-54-0x00000000031D0000-0x00000000031D3000-memory.dmpFilesize
12KB
-
memory/1648-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmpFilesize
8KB
-
memory/1648-56-0x0000000000400000-0x000000000120B000-memory.dmpFilesize
14.0MB
-
memory/1648-60-0x00000000031D0000-0x00000000031D3000-memory.dmpFilesize
12KB
-
memory/1648-64-0x0000000000400000-0x000000000120B000-memory.dmpFilesize
14.0MB
-
memory/1968-57-0x0000000000000000-mapping.dmp
-
memory/1968-58-0x000007FEFB2E1000-0x000007FEFB2E3000-memory.dmpFilesize
8KB
-
memory/1968-61-0x0000000001B00000-0x0000000001B7F000-memory.dmpFilesize
508KB
-
memory/1968-65-0x0000000001B00000-0x0000000001B7F000-memory.dmpFilesize
508KB