Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 08:49
Static task
static1
Behavioral task
behavioral1
Sample
c05f4aeb60fb3c7f2f91d00fc6e6065e1da72c3c14a27ed5f6208251512f7aa3.exe
Resource
win7-20240221-en
General
-
Target
c05f4aeb60fb3c7f2f91d00fc6e6065e1da72c3c14a27ed5f6208251512f7aa3.exe
-
Size
1.8MB
-
MD5
6da22b8fe318fb2ae4ffa3441775ad02
-
SHA1
1c04233c22c101dad738305570f20c3cc2006a47
-
SHA256
c05f4aeb60fb3c7f2f91d00fc6e6065e1da72c3c14a27ed5f6208251512f7aa3
-
SHA512
c6c059a3bdbd72f29d5ca4336ab883f136ecb644d027b174559cf91594417dd465f02cd614129940bd17e9f5025f586409a7a61a15ebd67a4921cd30da8b77fa
-
SSDEEP
49152:4SuE3ftrqPKIO23Hlin6COYolnyJ2WR6wOHste0uIlCj790Lhf4xC0FyQ4L6nd:3L39qPKIOson6Cslny8WR6wOHstehsC7
Malware Config
Extracted
gozi
-
build
214062
Extracted
gozi
3184
qfelicialew.city
mzg4958lc.com
gxuxwnszau.band
-
build
214062
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
loader
-
server_id
12
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ad203987bb3644838e3bea7fc5a4d800000000020000000000106600000001000020000000be732ccd01061d320ac287d3a9607325a40de3cd9da05488ffc3f8eeb7cbb21d000000000e8000000002000020000000f8c4188318db48b879569fa8179ae664612f7d75a294e832d0ea871a05a220859000000002e98e6cdabbf8bbaa294911083dbd11778ea38569d4d15b9a3bbaa867f1c3e3ef4c215c7bbe2837603a6ddfc3353ee3f280071aaaea961ff6ee948da04a1af331e2f54c1f46e3da3ae53278db96f681b5014363519a89940f01401b43934c6d943c0c3e7dbd340e0146d21ed42f9227e405f64bd146acdbe1decf5a9df706d69299f7af16967273c123391fe27e999840000000360c4d53190ffe2f1db3da145cf3d6023c7e1e2e424e5e6da4f9b553834521dc3561c4d4b19a106f7417f13d1f9c54de34489f1ee9a1f2dbd5423dac0dc66d9d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ad203987bb3644838e3bea7fc5a4d800000000020000000000106600000001000020000000db146a5784fe3ea87d0274b075cfd9efbadce2fae6591be56322d9a39a32625b000000000e800000000200002000000043e817a49661eee3eb5698a3f8f68d1c3a2626240e65b28fb0b878459ed8365520000000cbb5706d754d4ddd48674a36c67a446312484061bfa8685297df0824b38d50d7400000004ff246113db67ca61eb45ef57df88804c110e48651e323eee93e6790f49891d70e31df41682208db419284dc2d4568e114544f030a449f2015a8de374b75e546 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f07aa670b7adda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9BF10771-19AA-11EF-B5E8-DE62917EBCA6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2988 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2988 iexplore.exe 2988 iexplore.exe 2664 IEXPLORE.EXE 2664 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2988 wrote to memory of 2664 2988 iexplore.exe IEXPLORE.EXE PID 2988 wrote to memory of 2664 2988 iexplore.exe IEXPLORE.EXE PID 2988 wrote to memory of 2664 2988 iexplore.exe IEXPLORE.EXE PID 2988 wrote to memory of 2664 2988 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\c05f4aeb60fb3c7f2f91d00fc6e6065e1da72c3c14a27ed5f6208251512f7aa3.exe"C:\Users\Admin\AppData\Local\Temp\c05f4aeb60fb3c7f2f91d00fc6e6065e1da72c3c14a27ed5f6208251512f7aa3.exe"1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD534354f91d80bc0db22ed6f39fb6bef4f
SHA1030e25338de273dab5d56976e34c1bf09eb1997c
SHA25611540911635a75183dd75d1c7aab27c9c1345192ae6a3e546cf594aeb3ea340e
SHA512d9272c2eb4bc469bc3148a7602031fa112c3bd939e6a8a92a56a2c980c37ab54dabb3fe3305627d81f6ea811ee2bfe49ac2deb5854a26b3255c6be1bbfb28a6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD58c82e3b2d238d9de1c6e279edd33e327
SHA16817274973148c1c3efee5cdcae69dc1b865868e
SHA256402b7caaf2c153c319633e13ab2ec9d12a53c9d9b7e523b59c312576fe039d34
SHA512739a7cbf9ad01f03b15147d6ed182ca943b91461ab381b5c78de0041cf78399631a1727b01b54456de28928d7d8dbbf06d415e427d3f1008ba89c807f67fd0fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5e09896c55410fc1ebb5a0cf157684d7c
SHA1742db5e1d8f515ed4196bb5f8b083961c0c64ed5
SHA256defb5886ce415ab06050cc64392cfdbdc571fdc1341e7321e238d08d31bb6c2d
SHA512f6949ba62fcebcafce615630477c0120f3634a5ce850b4811cf0a4d211dae92ef24c71af8d4f15fb685719cdd326f4db38135b131236e6d75a56c20c140dd380
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD583f562bc40ae7f37409f3e7327384ae4
SHA158ec8a91941ca0f9e6ba2a97d0ed118ea98c3dd4
SHA2564c8e1cf1884e1151e39945edf193e9b6a510b6f62c82b9f56a03113d9ed2779d
SHA5129c71c6e8b5e387c6dd6f64a035f4ef1988a266d042146e071a01c1642f7aef5630de899b404570a5431d3c2327995cae33710b90863ceea606a74dfcc6bb5a9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD529c1ed1efa752326d5aa861422a3f9a2
SHA1810052975447b27b51515ebb068546425b68664a
SHA256b2eb2eaf794db6f38197109bdd5d25b4cc43111833fbd036552fecd39c706b53
SHA51253efdccd9d7e45e4d3cc02e7fc00487227a1940e5c46b5437025348b4c751b6f533ab9b72fd8ee37af1f37f4d10d83e4d82708867fefe149e380d29c8dc6341d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5efff0d70997c69978d803ed1dbce5515
SHA1bf19426cfaf05b2654f72197496aa9bcd20d0faa
SHA256b2798801647a933c095374ffd0edab3eac52d4cd1793bf7c2bce4a9c5b095688
SHA51245fc9d49c60ceb1ed4d7cc54e84044c7291057d156119eda2ab323680138f303136a2abfb5575a828b63381540b7ea556091a663662a99d0f00922f662ad2a06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD54525ed4202cb1e846940c992b8e0d0ff
SHA12a5d4db0a837d21b2ab56ef7a8eab6e4a155643b
SHA256ed7f1e9e7bdd1020c53473af2835d7f4304b8db2a065f854486970d4d9a1aa1f
SHA5121bbaad85faf94bee569136df6012fb8797342d2db9b473d4b21d96bbbb839c14cca1bd36fa4636f984796573281cad649aae3f2b905db12fd71896ded0569ab2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD53915fd8827e3aa66c3e2d53597a9195e
SHA1887fb528dca88b85861bf272975262c58e32f3f9
SHA2560ca2aafb6542e66a4cce375d055140460aa9b8f54262adbb74709be9dcd7203c
SHA51206bf49c32d8beb8f9d6745ba700b058072d5aea4558d5835328995a20bfac016e0b3fc9c192d9113213e621bf0587d8677efde234662b9f9f273aa63d94757af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5fda0f12a73db9a4e438b79c85e3dca19
SHA1ccc94e5d119a78c3e9f71e0ff4debbdf00a96d42
SHA2562a2048b022bde582e749e9da029045cf862cdf6f97f2a47f66b8019cbb399e18
SHA512ea583d9cb8253108a83c67c720169eec8e4748c4e4aa40857512cede07f81b89d6cfc13079e932c63fc9945167a107a367165e55a5631a816e32f128984ab034
-
C:\Users\Admin\AppData\Local\Temp\CabA4DA.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\TarA5CB.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
memory/2196-13-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/2196-0-0x0000000000400000-0x00000000005E8000-memory.dmpFilesize
1.9MB
-
memory/2196-4-0x00000000003A0000-0x00000000003BB000-memory.dmpFilesize
108KB
-
memory/2196-2-0x000000000058F000-0x0000000000594000-memory.dmpFilesize
20KB
-
memory/2196-1-0x0000000000400000-0x00000000005E8000-memory.dmpFilesize
1.9MB
-
memory/2196-3-0x0000000000400000-0x00000000005E8000-memory.dmpFilesize
1.9MB
-
memory/2196-8-0x00000000003D0000-0x00000000003D2000-memory.dmpFilesize
8KB