Analysis
-
max time kernel
140s -
max time network
166s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 22:28
Static task
static1
Behavioral task
behavioral1
Sample
8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe
Resource
win10v2004-20221111-en
General
-
Target
8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe
-
Size
376KB
-
MD5
4165eb68c959487dad6ef02646aa29c3
-
SHA1
fb3afa14170009086adb3a8e48ccdc189908a324
-
SHA256
8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f
-
SHA512
24942d6a4011bbea790872e56912b1855cc9e29c03bbb706ebc4c78a46d4a9bb4fa09f57683f347a273ca4e79e69b4f6c804904f4ed93fc564a860db2b07e339
-
SSDEEP
6144:qDf6Ygsvu1uyGSQlollY8DKc/qSUhosrLEV/V6r5:Mf6BsvmuzZGTDK2qS/yd
Malware Config
Extracted
gozi
Extracted
gozi
2782923
tmadecorrespondence.com
-
exe_type
worker
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1612 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\FwReSCOM = "C:\\Windows\\system32\\appiroxy.exe" 8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe -
Drops file in System32 directory 2 IoCs
Processes:
8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exedescription ioc process File created C:\Windows\system32\appiroxy.exe 8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe File opened for modification C:\Windows\system32\appiroxy.exe 8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\EB7.tmp" 8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg" 8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exedescription pid process target process PID 960 set thread context of 780 960 8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exepid process 960 8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 780 explorer.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exepid process 960 8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
Processes:
explorer.exeAUDIODG.EXEdescription pid process Token: SeShutdownPrivilege 780 explorer.exe Token: SeShutdownPrivilege 780 explorer.exe Token: SeShutdownPrivilege 780 explorer.exe Token: SeShutdownPrivilege 780 explorer.exe Token: SeShutdownPrivilege 780 explorer.exe Token: SeShutdownPrivilege 780 explorer.exe Token: SeShutdownPrivilege 780 explorer.exe Token: SeShutdownPrivilege 780 explorer.exe Token: SeShutdownPrivilege 780 explorer.exe Token: SeShutdownPrivilege 780 explorer.exe Token: SeShutdownPrivilege 780 explorer.exe Token: SeShutdownPrivilege 780 explorer.exe Token: SeShutdownPrivilege 780 explorer.exe Token: SeShutdownPrivilege 780 explorer.exe Token: 33 1836 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1836 AUDIODG.EXE Token: 33 1836 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1836 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 27 IoCs
Processes:
explorer.exepid process 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe -
Suspicious use of SendNotifyMessage 23 IoCs
Processes:
explorer.exepid process 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe 780 explorer.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.execmd.exedescription pid process target process PID 960 wrote to memory of 780 960 8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe explorer.exe PID 960 wrote to memory of 780 960 8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe explorer.exe PID 960 wrote to memory of 780 960 8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe explorer.exe PID 960 wrote to memory of 780 960 8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe explorer.exe PID 960 wrote to memory of 780 960 8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe explorer.exe PID 960 wrote to memory of 780 960 8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe explorer.exe PID 960 wrote to memory of 780 960 8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe explorer.exe PID 960 wrote to memory of 1612 960 8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe cmd.exe PID 960 wrote to memory of 1612 960 8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe cmd.exe PID 960 wrote to memory of 1612 960 8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe cmd.exe PID 960 wrote to memory of 1612 960 8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe cmd.exe PID 1612 wrote to memory of 844 1612 cmd.exe attrib.exe PID 1612 wrote to memory of 844 1612 cmd.exe attrib.exe PID 1612 wrote to memory of 844 1612 cmd.exe attrib.exe PID 1612 wrote to memory of 844 1612 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe"C:\Users\Admin\AppData\Local\Temp\8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\7182520.bat" "C:\Users\Admin\AppData\Local\Temp\8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe""2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe"3⤵
- Views/modifies file attributes
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7182520.batFilesize
72B
MD5bd37b79d860b562df144427ffbc232af
SHA1529e9d1f12e886d8d8007660221ca7de4f9de512
SHA256f34dc2f040c2f5a320f1955fd77e4fa89bd50d48c28723b06f0c8fbcc9ef35f5
SHA5124c273e028f983f8640b1dbf45ac665afe1d5c8aa82752f9be60895ae44c79b9dc14f780f2fbedb7895a8e977670dd098d398614486b31776cb02c452f11e3270
-
C:\Users\Admin\AppData\Local\Temp\EB7.tmpFilesize
3.5MB
MD523e6b8b28e19060d30cd841ce1f02d93
SHA1e5babef1a84f75dae910bcf9a34badfd96ca56e1
SHA2564a1fdc9e4df5c4d39b2259154f0118b0bb6a59e2507dbfa10519d3c164f8efea
SHA512ce29115d0ca1d6855e2579a0ae9d4def3f0f99dcb4fc2a727e171c4730cfa437e7dc4d2b9a2a810369811c44fba584beabb33b45e2e99a56f7b0a76c59c285a1
-
memory/780-57-0x0000000000000000-mapping.dmp
-
memory/780-58-0x0000000000200000-0x000000000025C000-memory.dmpFilesize
368KB
-
memory/780-59-0x000007FEFBDE1000-0x000007FEFBDE3000-memory.dmpFilesize
8KB
-
memory/780-60-0x0000000000200000-0x000000000025C000-memory.dmpFilesize
368KB
-
memory/844-64-0x0000000000000000-mapping.dmp
-
memory/960-54-0x0000000075591000-0x0000000075593000-memory.dmpFilesize
8KB
-
memory/960-55-0x0000000002370000-0x00000000024F3000-memory.dmpFilesize
1.5MB
-
memory/960-56-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/1612-62-0x0000000000000000-mapping.dmp