gozi | f996f60603519fb183271788ec8dcdf12f8a6430cfd0cbc924a30353cabe2537

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/03/2025, 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07a73fb70fa63ff53d091c68cb1e5728314ff7b479ca695050173faf3f8f5ea2.dll
Size

119KB
MD5

c8392d93a1f064a53abb61887cad409b
SHA1

20c77abcc1e3904bf337af924200d63aaa012b1b
SHA256

07a73fb70fa63ff53d091c68cb1e5728314ff7b479ca695050173faf3f8f5ea2
SHA512

1b677b00d7db9266a9c05f653e3dcbacd6a9ff29fa84ffcc64775b1e200618b73ca142de333116194e2937bebcd9a7008fd2112fb615cfac459c2973bcb625a8
SSDEEP

3072:3VtPSsu5yds0ZCzsRqojgfwE3DCW/5z5TCXq:lUT5yd3ZCXfIQR95Tf

Score

10^/10

gozi 7242 banker discovery isfb trojan

Malware Config

Extracted

Family

gozi

Botnet

7242

web.vortex.data.microsoft.com

ocsp.sca1b.amazontrust.com

settingsline.com

Attributes

build
250162
dns_servers
107.174.86.134

107.175.127.22
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Extracted

Family

gozi

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Gozi family
gozi

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 70fa115f529fdb01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e09fea3e529fdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009a3ee5e02be98141ae242d151f1bf51d00000000020000000000106600000001000020000000723d172030b26549f6f52cb62be89169f7d215bcfa23c6632a7c8bf7a3f42c4b000000000e800000000200002000000034b723668ad4e021806abc65cb5f7bd1de0fb57b8932faf82f3d773f319b70d490000000f1e7b7b554a35fd0f4f0563d4c37d0ba0f1dfa02183f508c15321dda5518fe1273aa02ace9d0b5082ae3a9295d8d2c5e99e0606526f3d3a18be99a3ef96d4c37b9d5b73dad4403f5c3f68e60d48d55882f93696cf3f8fc4813da1bd2eb70e17dd5f70a508afae2f324ca13a8aaf9ea1311a4cc8a607cdda97333fdf73e9f7212f6dca299f67a8fab2dfbcd9c278693d540000000b303c7bd31ba884a78aca3f95db69f2aec6dc1969a7a411bb9eb018623b305b58fb5787c1fcc6de6baf2a69f57b302bbfd8d2d4f21a3348c542b909f844fbde5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8FBC61B1-0B45-11F0-A8AB-EA7747D117E6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{82FA8331-0B45-11F0-A8AB-EA7747D117E6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9C6B3531-0B45-11F0-A8AB-EA7747D117E6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2696	iexplore.exe
1708	iexplore.exe
2512	iexplore.exe
2608	iexplore.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
2696	iexplore.exe
2696	iexplore.exe
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
1708	iexplore.exe
1708	iexplore.exe
688	IEXPLORE.EXE
688	IEXPLORE.EXE
2512	iexplore.exe
2512	iexplore.exe
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2608	iexplore.exe
2608	iexplore.exe
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2992	2988	regsvr32.exe	30
PID 2988 wrote to memory of 2992	2988	regsvr32.exe	30
PID 2988 wrote to memory of 2992	2988	regsvr32.exe	30
PID 2988 wrote to memory of 2992	2988	regsvr32.exe	30
PID 2988 wrote to memory of 2992	2988	regsvr32.exe	30
PID 2988 wrote to memory of 2992	2988	regsvr32.exe	30
PID 2988 wrote to memory of 2992	2988	regsvr32.exe	30
PID 2696 wrote to memory of 2824	2696	iexplore.exe	34
PID 2696 wrote to memory of 2824	2696	iexplore.exe	34
PID 2696 wrote to memory of 2824	2696	iexplore.exe	34
PID 2696 wrote to memory of 2824	2696	iexplore.exe	34
PID 2696 wrote to memory of 1016	2696	iexplore.exe	36
PID 2696 wrote to memory of 1016	2696	iexplore.exe	36
PID 2696 wrote to memory of 1016	2696	iexplore.exe	36
PID 2696 wrote to memory of 1016	2696	iexplore.exe	36
PID 1708 wrote to memory of 688	1708	iexplore.exe	38
PID 1708 wrote to memory of 688	1708	iexplore.exe	38
PID 1708 wrote to memory of 688	1708	iexplore.exe	38
PID 1708 wrote to memory of 688	1708	iexplore.exe	38
PID 2512 wrote to memory of 2152	2512	iexplore.exe	40
PID 2512 wrote to memory of 2152	2512	iexplore.exe	40
PID 2512 wrote to memory of 2152	2512	iexplore.exe	40
PID 2512 wrote to memory of 2152	2512	iexplore.exe	40
PID 2608 wrote to memory of 2624	2608	iexplore.exe	42
PID 2608 wrote to memory of 2624	2608	iexplore.exe	42
PID 2608 wrote to memory of 2624	2608	iexplore.exe	42
PID 2608 wrote to memory of 2624	2608	iexplore.exe	42

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\07a73fb70fa63ff53d091c68cb1e5728314ff7b479ca695050173faf3f8f5ea2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\07a73fb70fa63ff53d091c68cb1e5728314ff7b479ca695050173faf3f8f5ea2.dll
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2992

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2696 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2824
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2696 CREDAT:406551 /prefetch:2
  2⤵
  PID:1016

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1708 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:688

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2152

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2608 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b170bd37961f940ecbfe1dccdf8768dd

SHA1
19e3a7d9775250703660b00627b1754dad3b0327

SHA256
b19067b3cd626529dba00948473ddcefd65fee48fe77bceb4a453379f511db81

SHA512
7c55011dc0789a4204fdae70dfd3125b6a00a7e79787e5e2b583ec7df31e3cb9f9c2fa992e8e2305c0788b4b1adfb469da6f2ff6e4229c403d61c7b3fcbd61a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2f139c9360c4a6d64ce5efe8b14f35d

SHA1
315402eefddc6f4852c5b7b86bc1a6e58068075c

SHA256
21bacebc97753163c073535f3028abdf7e6701e9c1f57d7466d9e40e4eb8bfd9

SHA512
d5078af76b20b2f3391653c7f0ba884a349c3ee1bd2f21c947dc1d2a86fad49856ad537d79652f59e4e3bf1d0a470be48bd0a5e14588995a93946228ae3c47a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0942cd4e88e3933819efadfeda40ede4

SHA1
390865bc7791bcbb5f2728d5ffcab856698aa707

SHA256
351958744144a9044231a5e6362650c063125504a875cb20a1b04d148f912f2b

SHA512
ce0d3b14615deee83d67acf98bd5476331cc66ce5db6531bc0e2c828947a0bc8aa7c82ae4446af837759fccf6d493812d7f6ca045b40c56fa123826ee3fe53f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55551c07de8e0f057ebc2efe711c3067

SHA1
f3999efea940de5496584bcdd649067112c715ee

SHA256
f99349354db5d2e81a2ba45ec1cbc6dbf5cd9fb3ed23be695719b0eeb4cd6e69

SHA512
c75a2c0f1eba205aa4d73eebc81e6713709cf81ab88e67110b3067bcb387476e07800802d0654db4a64f6331f0b5e7e482b3bb89e9c043bb0658d4d9620ad0a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c187fceb3d109dc71839643704be50dd

SHA1
a819813c3c5c53606e00fb4841d0019ca38c27fb

SHA256
6bc009aa20ece888d744cd5c970a79831b40d5580e181c9bed7be240d72ed38a

SHA512
0d0fe9e537286dde86cc7e4479ade33b4cc12f9057c32991bc95ecadccc12703aee9e1039e28a24d2a3761ae2834a359fcc0b1a5b409666a5d0e898964322206

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
293027be0351cf45e68bf0b56b9ccbbf

SHA1
3580e9bb511473327deeb473fe87257ea30344c1

SHA256
43521d049fc10d2c8ba2e5b29390b85728251207d24be542d13cfb3bfeee85c4

SHA512
478d44f07a8e824c04cbcf4d04c03590ecff58649474a67c26b694fcb6212b2ca33091407b0991c61b57b1fc9634587c5e0679ed846a3759d564d89bfdf40a5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f3abe0c72f8bba950c3e74ceb65d286

SHA1
529c73f9d011e89e9f309c9a4e6dff5953a6f807

SHA256
64ca0b92ab830089d8da42df2e1e9205be4f763cc8fae6dd23b3e23b17d79576

SHA512
34480babf2ad2a32233d9ab826316070a3e84d8c4a567f32d718ab1bf0a0630ee4545427338fcea58abc6cd0688b142ee5750037681a95e6089eb6c27f353f90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94d6fc09b4f000b21a4d5b25f0543359

SHA1
898b87c3e600564bf8e0c07d0f18fc3c216ab0d8

SHA256
7973500e15f38516764768454050cc64623200c09b00e600618c0d95fa2d128d

SHA512
91243523195498d02973dee296149664ac5d6968884f6df0ff2c2c21fe09d8744656acb422e2d51ea0ac8fd7e935912ed26e55b6274d2b92ea5d15558adc8145

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
045bc87c34af7923d66b3a42ba60fca6

SHA1
20462198b04babf8fe6adac7976eff686904f11c

SHA256
3867ccde0b0d99d90d287c7c6e7d206b317c457fdf34bc5168d1dd7295b63409

SHA512
0e2f78be10afaf69453366ab1b9fda9fca081ab9907dd723de4ae0eb89393c4c5239cf430ab6078f25ba4bbf971c0c5e2967e468cd56292be406d47c066b28b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d85ccfcff996b4676a9a577dc6c716e

SHA1
e4b9f01b9a4773b7884678b9eee898076fc3c2aa

SHA256
d525b4630dcecd0fbb642d653055755022d877cab997490e9c6f9c8e10d71ce5

SHA512
d1563f81184776eb3e6c93080bba792ed1deb51a3c10074d87d3c1ba8ccf3dd2b6c6f2116cf76c23d69aa342f079614425e0905df5e511574ad0bf722e8921c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c2330a1b9b86869ea82b090666bb552

SHA1
2a4af4cb37219c2dfc000578c38a5d68efeb1cf3

SHA256
1368a6da866580c5a1046789426d9a05f9df3aecb2deb707a8606f60a2d0f808

SHA512
bb3ed01672f6da84995881ecabfcc7509f9b41497f44bdeea1c87f448f8c768de83eb0705bcf599d96e8d8858ef983f54e076f1c375a2f5312ee61a206d45174

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFF49.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFC09EFDB90DF51291.TMP

Filesize
16KB

MD5
371450dac2cefea3e6a70f8570bdc5fa

SHA1
6345e2f8febecad3da7b74d127719bc400d72b54

SHA256
474d1672c542efd7332bb55e4fdcfdaf0f6eb8c4ccdc89143b93db36775c62cc

SHA512
e9ed86c6d5561e856967369a6ceb05eec18257c647a96448fac030d083b3faf17b5085aa84f7f62ef7a2e192488616c53c203243a75e75522fdf930085d986e0

Download Submit
memory/2992-0-0x0000000000330000-0x0000000000355000-memory.dmp

Filesize
148KB

Download
memory/2992-11-0x0000000000331000-0x0000000000338000-memory.dmp

Filesize
28KB

Download
memory/2992-10-0x0000000000330000-0x0000000000355000-memory.dmp

Filesize
148KB

Download
memory/2992-5-0x0000000000520000-0x0000000000522000-memory.dmp

Filesize
8KB

Download
memory/2992-2-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/2992-1-0x0000000000331000-0x0000000000338000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads