Analysis
-
max time kernel
146s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 11:44
Static task
static1
Behavioral task
behavioral1
Sample
6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exe
Resource
win7-20220901-en
General
-
Target
6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exe
-
Size
333KB
-
MD5
91f61c4a45f95f9a3dff57b88c767281
-
SHA1
0c10a806bf70c939f1c3a184b0be11dae97082bf
-
SHA256
6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a
-
SHA512
e63e3ff71ff0b353ad335ae735907d73f2a2a64466a299270c2903043a792094c6a19013eb5828576908afc2a3920a28fb3c58ed8953079360ec2d9910eeeb5a
-
SSDEEP
6144:ubCa5e8wuDkSW5/koD0KUw00LiT1z22X2:+5e9ykSW5/kkUwKt2
Malware Config
Extracted
gozi
Extracted
gozi
1010
organfriandpopul.su/bbr_src/utilites/xxx
alrthesecuritywith.su/bbr_src/utilites/xxx
circumstanceshave.su/bbr_src/utilites/xxx
-
exe_type
worker
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1712 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dpmoprov = "C:\\Windows\\system32\\cmstwave.exe" 6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exe -
Drops file in System32 directory 2 IoCs
Processes:
6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exedescription ioc process File created C:\Windows\system32\cmstwave.exe 6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exe File opened for modification C:\Windows\system32\cmstwave.exe 6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exedescription pid process target process PID 2012 set thread context of 1720 2012 6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exe explorer.exe -
Drops file in Windows directory 1 IoCs
Processes:
explorer.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exepid process 2012 6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1720 explorer.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exepid process 2012 6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
explorer.exeAUDIODG.EXEdescription pid process Token: SeShutdownPrivilege 1720 explorer.exe Token: SeShutdownPrivilege 1720 explorer.exe Token: SeShutdownPrivilege 1720 explorer.exe Token: SeShutdownPrivilege 1720 explorer.exe Token: SeShutdownPrivilege 1720 explorer.exe Token: SeShutdownPrivilege 1720 explorer.exe Token: SeShutdownPrivilege 1720 explorer.exe Token: SeShutdownPrivilege 1720 explorer.exe Token: SeShutdownPrivilege 1720 explorer.exe Token: SeShutdownPrivilege 1720 explorer.exe Token: 33 1468 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1468 AUDIODG.EXE Token: 33 1468 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1468 AUDIODG.EXE Token: SeShutdownPrivilege 1720 explorer.exe Token: SeShutdownPrivilege 1720 explorer.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
explorer.exepid process 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe -
Suspicious use of SendNotifyMessage 17 IoCs
Processes:
explorer.exepid process 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exepid process 2012 6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.execmd.exedescription pid process target process PID 2012 wrote to memory of 1720 2012 6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exe explorer.exe PID 2012 wrote to memory of 1720 2012 6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exe explorer.exe PID 2012 wrote to memory of 1720 2012 6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exe explorer.exe PID 2012 wrote to memory of 1720 2012 6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exe explorer.exe PID 2012 wrote to memory of 1720 2012 6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exe explorer.exe PID 2012 wrote to memory of 1720 2012 6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exe explorer.exe PID 2012 wrote to memory of 1720 2012 6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exe explorer.exe PID 2012 wrote to memory of 1712 2012 6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exe cmd.exe PID 2012 wrote to memory of 1712 2012 6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exe cmd.exe PID 2012 wrote to memory of 1712 2012 6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exe cmd.exe PID 2012 wrote to memory of 1712 2012 6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exe cmd.exe PID 1712 wrote to memory of 1436 1712 cmd.exe attrib.exe PID 1712 wrote to memory of 1436 1712 cmd.exe attrib.exe PID 1712 wrote to memory of 1436 1712 cmd.exe attrib.exe PID 1712 wrote to memory of 1436 1712 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exe"C:\Users\Admin\AppData\Local\Temp\6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\7087141.bat" "C:\Users\Admin\AppData\Local\Temp\6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exe""2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exe"3⤵
- Views/modifies file attributes
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5941⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7087141.batFilesize
72B
MD5ed8f7547e341fddc0d088c39a52b7439
SHA18ef9a472b93e8ba6a9e6740b6fc19d7efa784d30
SHA256d58af9443318e6e0cd3a78bc7be1dfb5bd9fa089caa5a29b0ffdd8876c10e2cb
SHA51231f1a63a8f5c5f1731f37d3a430e8bb595735ca58a0f45cab5ade2e20fc240d7f8f2c67a47056ca26a33589e881dd4fb1a6771507dfa71a22b74ea13050584cf
-
memory/1436-65-0x0000000000000000-mapping.dmp
-
memory/1712-62-0x0000000000000000-mapping.dmp
-
memory/1720-61-0x000007FEFB771000-0x000007FEFB773000-memory.dmpFilesize
8KB
-
memory/1720-59-0x0000000000000000-mapping.dmp
-
memory/1720-60-0x0000000001B40000-0x0000000001BB6000-memory.dmpFilesize
472KB
-
memory/1720-66-0x0000000001B40000-0x0000000001BB6000-memory.dmpFilesize
472KB
-
memory/1720-67-0x0000000002E00000-0x0000000002E10000-memory.dmpFilesize
64KB
-
memory/2012-54-0x0000000074B51000-0x0000000074B53000-memory.dmpFilesize
8KB
-
memory/2012-58-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2012-63-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2012-55-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2012-56-0x0000000000401000-0x0000000000405000-memory.dmpFilesize
16KB