gozi | 9adc313b64a286f9d056b7efabda5565e2f3d8010d5432975899af6bbe71a0ea

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
26/03/2025, 20:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7fafabbb381c34185ad30f0d5337ec8072d0705e0e9fb1d91e7358ed934fff3.dll
Size

234KB
MD5

c9d954b3f1c512e6804fd8f5637b58b6
SHA1

b452040d8072117ddbe1adf9e1eab5e4bdb150bd
SHA256

d7fafabbb381c34185ad30f0d5337ec8072d0705e0e9fb1d91e7358ed934fff3
SHA512

a4e949017016c1cfaa9bdff664c8ee20b2a34fe78788de9a4338ae5ad9a8a2623ccafe6d4584ef4f6cb29bc05dbcb3a71cbcd4051560287fbe74fb5a5738c09b
SSDEEP

6144:SCY2oo127AHBPr4CggrMbPMdsf5LLNBU94nzKE:SSD6w4bKsf5PUomE

Score

10^/10

gozi 3050 banker discovery isfb trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

3050

c.s-microsoft.com

ajax.googleapis.com

groovcerl.xyz

Attributes

build
250166
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com

ru

org
dns_servers
107.174.86.134

107.175.127.22
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Gozi family
gozi

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000596298383b88f045b768ac3737055a040000000002000000000010660000000100002000000053e7b747ce1c5857a4f07e3c5fb556896110fc0a266387b9df079d32340982df000000000e800000000200002000000093f93c0f22c7c78427829e5da1081d46706fdceed036e4aa6f12fb4a5d1e6c0c200000003982790e02a03b9d8f0533c2b8bbdc46163577ddf64ab7f5b9527e19fb7937ae40000000d7066589c2dc94a18eaa224fd6f44bdbdad7dbb9526650d022b40903ec9bbe3b86607dbda913f0a70db181c5487081dc2db22ef863b973874c2d5df06c4d944a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{019E74C1-0A84-11F0-944A-52EE77272AA8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D4B080C1-0A83-11F0-944A-52EE77272AA8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0e923ae909edb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000596298383b88f045b768ac3737055a0400000000020000000000106600000001000020000000bafe316d97a231ffa4055177a6c7b11278d7e4cf275fcd8e5f4aa108f015fc18000000000e8000000002000020000000b85a1100edd9e8139f170622db07869cf75450cb7c86f037fcab7d0d2afed0e1900000001726cb299f596123fb4cc1db17d40977e5a19a46d4e9c1fa1a1bf54d4477dc19652c474b0ad34efcbad1715bc4ccca6655595ceb21ad07d40a4700a717dc0b02f210e7bd5f8f0bd49f481e18d93fa97350d2a95584c02fe204217b22033e71c2a6e3658e34dc5caf663f9806bc144820637a0ddea4441a6c28fc22336f96d4d23269f537fe4f734f5a355bbe6fe366d9400000008a5a8c915bd9b89869999a4e40a42e6557960eb232586ae1cb605c94b04cf960e8e6d70b5029b9b3f22e2edf41da0feb6ab9a094eba077e442be824754074825	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{11B6E0E1-0A84-11F0-944A-52EE77272AA8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2860	iexplore.exe
2752	iexplore.exe
1980	iexplore.exe
2972	iexplore.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
2860	iexplore.exe
2860	iexplore.exe
1704	IEXPLORE.EXE
1704	IEXPLORE.EXE
2752	iexplore.exe
2752	iexplore.exe
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE
1980	iexplore.exe
1980	iexplore.exe
1764	IEXPLORE.EXE
1764	IEXPLORE.EXE
2972	iexplore.exe
2972	iexplore.exe
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 3060	2352	regsvr32.exe	30
PID 2352 wrote to memory of 3060	2352	regsvr32.exe	30
PID 2352 wrote to memory of 3060	2352	regsvr32.exe	30
PID 2352 wrote to memory of 3060	2352	regsvr32.exe	30
PID 2352 wrote to memory of 3060	2352	regsvr32.exe	30
PID 2352 wrote to memory of 3060	2352	regsvr32.exe	30
PID 2352 wrote to memory of 3060	2352	regsvr32.exe	30
PID 2860 wrote to memory of 1704	2860	iexplore.exe	34
PID 2860 wrote to memory of 1704	2860	iexplore.exe	34
PID 2860 wrote to memory of 1704	2860	iexplore.exe	34
PID 2860 wrote to memory of 1704	2860	iexplore.exe	34
PID 2860 wrote to memory of 2484	2860	iexplore.exe	36
PID 2860 wrote to memory of 2484	2860	iexplore.exe	36
PID 2860 wrote to memory of 2484	2860	iexplore.exe	36
PID 2860 wrote to memory of 2484	2860	iexplore.exe	36
PID 2752 wrote to memory of 2052	2752	iexplore.exe	38
PID 2752 wrote to memory of 2052	2752	iexplore.exe	38
PID 2752 wrote to memory of 2052	2752	iexplore.exe	38
PID 2752 wrote to memory of 2052	2752	iexplore.exe	38
PID 1980 wrote to memory of 1764	1980	iexplore.exe	41
PID 1980 wrote to memory of 1764	1980	iexplore.exe	41
PID 1980 wrote to memory of 1764	1980	iexplore.exe	41
PID 1980 wrote to memory of 1764	1980	iexplore.exe	41
PID 2972 wrote to memory of 2296	2972	iexplore.exe	44
PID 2972 wrote to memory of 2296	2972	iexplore.exe	44
PID 2972 wrote to memory of 2296	2972	iexplore.exe	44
PID 2972 wrote to memory of 2296	2972	iexplore.exe	44

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d7fafabbb381c34185ad30f0d5337ec8072d0705e0e9fb1d91e7358ed934fff3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d7fafabbb381c34185ad30f0d5337ec8072d0705e0e9fb1d91e7358ed934fff3.dll
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:3060

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1704
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275463 /prefetch:2
  2⤵
  PID:2484

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2752 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2052

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1980 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1764

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c73ed8047f2c90848c32b3063dd487a6

SHA1
84827a5a30d8ce9f9eae8ae4007cda11f050917a

SHA256
842d337f941e5d57a3948940c8abf764ae73e561228e862b7f3fb84bf61e6204

SHA512
5c39327fa1e61d3164b57cfe5223001682f72f6fb9ba29918052a109264b96020f2dbd53e729cb6b6aa581085d9bebf7da7d78752e14edd76906507105f89836

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3ccf3e0fa42ac6875cf6c5445ccd4eb

SHA1
b4eda7c9d93c708c23391aa0a6fb21a0e482e359

SHA256
b3c09d75dbfc4b2aa6426287313f0e7131e82675771a7c6f748b1fe1f04dafcd

SHA512
efe7f45b380a516ed1d169789d00fd62f43c863be802dad6ef4eb5e90ddcf3ee7142278a3f5375b40fb4595abfe402347852db7242ec1f83032f04fb23bcfd20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0faa34f42c117041caaa228061f13f8

SHA1
d9304933d7e39f6ef4084dcfd242ee5d9ce5b98c

SHA256
7b6c790124b2dd836046d1375f70e45147d7b3fed914a41fd9207121528d4756

SHA512
795914d792dca3fe29fd53c2fce7830e159bdb2022ee995059e6e7bc8295c49d6a1ab006dd1f6837689d7659882951d6b239284391537cb3824493c9a48fa654

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71c7f4e8e41cbbf941737bdf9f5d2358

SHA1
22998e06bc9bbfeb8cd73e90601a3e6ac5a927cc

SHA256
1c2756944a3baa420e95dd2c17c267b427bc8dc60f7c79c1f53c90a0dd302cd8

SHA512
43f6ccd16a057679fa98f56e238b921ced9073ec32660c4b17f1d330a514177ee4bb3dc3efdf905db66b1c6061c61a3e6a4c83033f7a6c99a506da2ed6194ca3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a35f7666518585259d89fc42ed2799f

SHA1
2e40fdda46ddd8a6f3e562e7d526f105e0d55c02

SHA256
93a1f8cf51b32294323258650ad004f2b8478a8c1406f4480b3ca89260457c3d

SHA512
7d92d279293adb44c47852cd613392210e002edf94796fef5f8afbd0f8e7c1f100246b6ae9c4e63178bf66d62e8fe2a5781798107b638321d23af12f2ec6be9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e05300d5bcae7f5796ff510f5a07140f

SHA1
521ab729212494712c9a00aafa148595b3b8f4d2

SHA256
caddb610d8ca13e4425bf7bfcc133e25e0828b1ea01f0b82efcc17c57ab40a67

SHA512
eb65ecae42c02e182716d71ed44d63c5eeccb3dec9a4fc49e38e5e1696954778b66f7e2fa4d9a04b9ea9b82d62f3a0f2f8bf65ff27b9bf1ee1845aeab1e9d299

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f9bf64c7f0162dc4b6e3905129a69a2

SHA1
3d4678bfd30d7cf595410f631c4c6c8e69977fba

SHA256
bf8b5494dc7c642b24099f45e241b9286a5c4c174943c14b3f45a04180712fa9

SHA512
5ecf3a6f1d077e85864b4cff10e63b88daad68a491aee734a0c9587b753b83a4c3cec26fa382907965a85651ee150e882af154cbd1b28873e747f5bc5d175b9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43897be67e77b8f773678565cc5f6fd9

SHA1
27f82f4cce2ba50af02e5aeea62d38e573b4fa81

SHA256
5dab98e4b1bd99cbb983745a10eaa339b6158df5c0a76558c20531064e632bf3

SHA512
4c9e2895ed7131aaf016f7f67b709746ac5920011d4c6f68cb8af742ae3ce99734c7da560d9948e31d1ffc7bdb971f1b374ec56a91290e4f2f48ba081ac31e63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b39259adf6d2579e21a20d37612b32d4

SHA1
3c7e3d7c6d812ffe6f1ff01f4f954c4d08149de1

SHA256
82266818ca3236ed978c318ff1c8b6a9d291d562984778f0b386a80aeb5ab083

SHA512
4d5b3219f99731dfd927305b8b89015f7e0cb8df5e432a94cb0d1a62e551d2762744d3a7a7214074fb8baf1cb3f7690e0228d15a1522988b5c9c365650731702

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9ee31763e484aedb152a2b1cbfefe12

SHA1
03142151ed327b10e7250ce363affcb1639a594a

SHA256
20b5f23b1ff85352c3bee72e7ec270eae9bda8aacfd8652a7cf5ddef40047f64

SHA512
b41ada967a760d290a1ad0b26083e760ed3b17d840ffc48c72a605b86e1456c30d24f8d1c427df8ae20c0b92d45ccf82d24f89690d800f8f79cafd2a2aa72486

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
166f4a11c64ac9d42bb5864d777c6953

SHA1
d1a0db0863f33d94d9a8e392968725d4880cd9f2

SHA256
f31be02d05d5ac22c6cfe2e8075bbbe296cb076388b1b5113bb4e1a2d74842a0

SHA512
22422148856aa90ef5c098c62f58a3ae5c6c4bcb7b7f7ff18fcb045c6cae06c63430ac1e02a9938b29384fc41ec8ddd35f0ec5d113161aa22741cdb349eeaeba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad58389e00bd9ab07c6c7ff3f58bfe39

SHA1
68d9e857a426101a8c30c539d6e6289970b5d7bc

SHA256
b8b098737eeb834dbf800a27c23758b61ae114dfb70e59e0b87a0c9561455fe6

SHA512
dcdb8b2e849f7ecbe9e9a56f08fd69f3461cada538b37875b18d5b3cc5dccf0bfd02f0ea3cb08bc1247a0bd0ab00527093e7bb788333b79ce5a8b59b39b1ad07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1dd0d2a07d3ec7e6628e079535aa4016

SHA1
12b9a95baca143012f25857cdbd27dc6079604b1

SHA256
68ec67f9847c49be4f20f7f7d75e6e2799ab50c6a4196865ac1e07ae99230936

SHA512
41683846811c5973486586f19a88c9dc18da919d6497012739b5aba01131c7eba6a29361e965642ee54141f8e8133bae0a76108a82ca1234a5d132a3f740bb76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1209bf74a38b73f5e432ca09fe6aa731

SHA1
a49b012320ca8632cc2183a962e23ae9b2b1376a

SHA256
f0085cc4cfc0f94777f3457b797abe29a07c464405e6be66227722d8eee94512

SHA512
92b45bd02db995bdc02a665ddd34ef7e5ecb9ebde7576346fc43dd182d809fef6ed38743e783c0af47d45664968e35a022e5cae4542ebabec4ede79bce66eb79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61526deef05f557d4b89c1548f3b7e46

SHA1
384197e34daaf156e948b1c5c9143ebd5da8acdb

SHA256
0c0ee31985cd2527e90cb541e6c531f0889d9581631b228ad0b9eb6103082c6d

SHA512
1814f05f2d369ad7ae8192dc02c274f8f0161f05c1941ed6ef66aaa06ff8aee8c8ecef98bff45664a400cd77c18d51118043162505bfcd195c940d15acbc5997

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37b2879c5d96350d7a5fad1118d1a77e

SHA1
19de5381bfee81b8daad0898fc9fc1620e488c7f

SHA256
cd330df1d76c446700c734941bb57459f319712bb89082d9d283c96ae9bd0a0c

SHA512
1031fe63a14bd59af3915920378d71b7e95a6b400db09e8537cfb9f1eeefda8a9a93974f4e14fff3a876f45ddd4d9f71f1773a4bda23c5ea0995b305cfa77c6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbdbd6152b397f94bdbfe7ce92e7dd40

SHA1
a718c5ceae04a683955344f71fc11eae57b48b7d

SHA256
9bad48020183dc2be4f9969f8a83b49b2dc24383d2fb58e80aea7c7618e76254

SHA512
f8bd866225320e344a0c3ae9956631aea10b0400439e43af517203879737565c60dfcb09556225026a2b2c0b336a25ec265f28ea6fb040a838662ad135f87a24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9de4e63d85cb4532ba7ab6d453ec445a

SHA1
a8813f1d9b516c1e7831efbc63522591dfe7bc9e

SHA256
da324b63d39d17b109b4ce3c95237fa9a2ff27dbd58d65e1bf75b83346c77eab

SHA512
d2ec75012ac4dfe69e983a152bf790bd1ab0e1957aba9ecb488368d53aea105d8801c92758b8ed6af2adab2ff97c3a3cbac28e777458b5f932121f1951db692d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad0d256502b473c3cf2d0a9219fbc928

SHA1
e34d6dd074207525b865439e4ec1951e9edced75

SHA256
d40b2f00eb3f7e27ac4afe17476f551c14d9bbbc315b0566ed091d62c047196d

SHA512
e03f5acf578fec384097f2d03cb6352cbe15e8d2bd27b67c03f5f9df9ebdf9da447485223c7d32b097bb492b9c0dbc35f07ccb2f9ce49d59f048c5491de01f2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
568ccea28f34728b0b4d14e97b6db7a9

SHA1
14afd3638c67c5326c260ff96f3a28981d11199c

SHA256
903e7372fe9d282b16682de56cc20d2e091ecc10cacb2e4307ec590bed734c40

SHA512
41f859c92d45648b3c00b063b4edaeaba2c35d89cb1dff1af6e31128e9175618821b42ec151ab8fc4850d81b422abf353c60095143cb030ae6256dab1353d451

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a473ceebb03a3f6ed52806f29a596015

SHA1
8ab6f7dfbc4d4d243cc0da10d01e56d520fda70e

SHA256
f9d2bccee6cc6da8041bc2033dd4def614590560b640cb2503fe2fc207bba185

SHA512
90c2397c0764abfbcde9c48ca2db6a99737a5a3a6045c65b76fbc2a750a02adb18724435ba05804aedbcd646e1294eb081c8bc6d8b8d061b1a0cd1b5ef2c070e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfcfb422a74f763b2a0bb5b5763b9f31

SHA1
aa1300b03690d4ace77761a77746f4c60d91181f

SHA256
4f5bcf176db849481242069fbbbec273c909b9bdfe0dc26b8189bdfc1fcd5cc1

SHA512
50d62ad3ac97b97ecaccd0c4db44aa71654cb5d8eaa4a8ccc95df77bb2f44378aa7b6835d68720ec2399e4134fd88c9b3bd7e28ae34059d72b17ad38a19c7f68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26399f0dbba9b6d548768a1e1d0493da

SHA1
4b4668ec62f65147bf246fe4e76f059bdfe0e126

SHA256
e08adad21b4df2e1f39bc33bcb865d5c5e3e4650a6ae75a6f060f6fd3779d447

SHA512
1e34ff9e5b363265c53d8f6738bcbe970b0598aae6e9137bd3fbb1b469632112f10ee4ac2ab97a5436638ffe1deba391a5bed64f0df79d25126fed4247456581

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85432989d96131c17c7abdc252c76fc8

SHA1
916ec16c42497b4ca585e5b1c88add867d6b7f89

SHA256
51d2b489f3feebe5dd1337b460b685569fc3a474b07feaaca9d568cf0552f6fb

SHA512
7907380992a413719b1f8c8d68da4a94e603c604154aab3f571de99c076de85945ff6d7ca1050a7d91f46f9d60cc2d83b068a0602af4053895bcff94f7de9629

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a987603d85745c104f2b124d59546311

SHA1
e190b48fc66266afff2f6a31eb4a1fc0d14dd446

SHA256
a90124f2b0225f5cefd3b8b4dd24f8f01e53a8dff83ca66d8ab97cd46e5bf335

SHA512
84269f61b1f209116d9a373e999706b33a03153e51adb308fc1386942deb3a126c85bc742a66f7e0dc4732216ccbdb4953665a8970f6dd1111f656f20a0b62b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae0dcbc519a3472890b4b0535010019a

SHA1
7a14e2dfbc6eec776b464c120df8e9e8fa635bab

SHA256
0ac49fe7a868cee9904c6f738a31f82e8c299c631a4cba0804e5d7f713262d4b

SHA512
40b374db7085efa1272f502eba8c89c4f294bb9f83ff341df033988f10a9d2b8b4e0df59cc2546e7344717259aaeb243b8a543d5e2925432ade8e5bfe6016a1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55dacc2096d8d5434bf21958cabbd00a

SHA1
034f8ba2bc7611191a4d72eb17758abe575ee97e

SHA256
b85348322870ee631729a39f3a603f0a263accd9298734015622c926c4f2b438

SHA512
e8f0ef27e7d8918a03edfdf5b7cc7033aaf4f972539de0de70171f2fce1f8d288843fc6c0e8bb8db786713e73b18981633db4a5e237793e921e821bae010c63d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea56e94aa47098539006bda54c99821d

SHA1
14040d0f9005b364322700e760ae6038dd5c4ef3

SHA256
afb26d4d95f9cd805376dc413b13daff535ecbbf4e33edd5faedec7068f98298

SHA512
5b4d1cef152ca1e4906fbfd398a1bb9f44a07434f70ee9d2071b8313645065e5b85696ce6171902a8c345b38b96cb20c4aa53e72395ad847258f9cde1d1b003c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
161243e9b6756db2ca9cb06f84485674

SHA1
cf7fafcaf6d17d927ead60a3f0b2060addecdb6b

SHA256
f326051cc82c825ab008231d7d9a623c277da3711ffe49cfa0064ed03b277b85

SHA512
a9de8b61ab9a751e453dc0e0c6fdf3510e6c31b0a6bb617e83b199ca539107dd2cd0b1d8c6bbcf2e50c210bd113981ebf4307cda030efda210ee7d967ee22c07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcb11335a3a0d4a89fbd8695ef8a877d

SHA1
09688ffa429d70957f22de05429462aabb460f72

SHA256
0e21dc5b6a67d7d867aae34bb2d6a9c650e8073cd91a0246e6371bb0d3fe2da7

SHA512
60ab1489fd768ced2f9c211ebe922a64952167296214194bc719b8d575c42438808c0b2c3d0dce019d750eac8aed50957a13ee0bade4cd999441f4e8fc6771f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77801dfcd2bd043ebc76614108809bc9

SHA1
c14f59c4bd75d2af8dac60ed02f3372cb594a6f6

SHA256
f06235697fec731b15ab69b76563ef69893df8165e8fd8450421f0b01c9d0d69

SHA512
ef32b33f7ba90ac77f0bcb708406a1e0c1a67fb6ca337a84226683e536db8daa4bad8a6ae0ac5c9e589d33833f2f712f22807815725eff31c0114949702b5233

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF07E.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF4216C8DF2660C69D.TMP

Filesize
16KB

MD5
ec6d178802c8fdf2561a34b1f1d83785

SHA1
57fdadd63c40ab2195772483b3aba9a7818827d6

SHA256
a57c53dc3cced3724c18270c779d231d1696fe5b08c408221b978e261efcf7e1

SHA512
ec2caab0291c90cff7fc1308367d22b0ded84d8633746c7342420afb3bca9c92e2d6b9450935166df67952b3304265701977dc8445e1a7366c7903670627c7aa

Download Submit
C:\Windows\System32\catroot2\dberr.txt

Filesize
193KB

MD5
c26e35136b6984d57a6f53c5a628aceb

SHA1
2875b65f8152d8a4cf2dadd8c74370da68bf2bce

SHA256
86d2743e070ff759d1196ac38c65e25f1642b8230e98cc6a04666b13a1fcb315

SHA512
b68b50446c592c9b50a20e43ad3d51e23861a3b2593193c62a90c1e92dbedbd98f6708f0ede2fe874aa7b3dcbb94959ed54a01d99eae5e7d3aaf8bfcb2fa01c4

Download Submit
memory/3060-642-0x0000000000270000-0x00000000002B5000-memory.dmp

Filesize
276KB

Download
memory/3060-0-0x0000000000270000-0x00000000002B5000-memory.dmp

Filesize
276KB

Download
memory/3060-15-0x00000000025F0000-0x00000000025F2000-memory.dmp

Filesize
8KB

Download
memory/3060-12-0x0000000002570000-0x0000000002580000-memory.dmp

Filesize
64KB

Download
memory/3060-9-0x0000000000270000-0x00000000002B5000-memory.dmp

Filesize
276KB

Download
memory/3060-10-0x0000000000271000-0x0000000000288000-memory.dmp

Filesize
92KB

Download
memory/3060-8-0x0000000000271000-0x0000000000288000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads