gozi | 323601b883c4efcdfedf91176a6cd3aa74bb1f74430ccaf74ffb7712862bd1f0

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17-06-2024 10:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8299962f91574e5e55df6b185ca1863_JaffaCakes118.exe
Size

435KB
MD5

b8299962f91574e5e55df6b185ca1863
SHA1

183cf913b5e49a6afafc9f8fa64b13dd43694ad3
SHA256

323601b883c4efcdfedf91176a6cd3aa74bb1f74430ccaf74ffb7712862bd1f0
SHA512

67acec1a142453d99c2b1b13a5fd252b91cd9de3f991fc729a4284712a68af25b9bec5e1a18a03c9118c1f06b2dbee649dfd7e962b7a0e8fab64c4370f77b2bf
SSDEEP

6144:Jas7AFNN4R0Nt4Ca3ge9bZk4tqT+Gh1oHZNCtKtrOm4su4aNZhzD9F:N7AFNN4+Nt4r59tkhPwntrO4a79BF

Score

10^/10

gozi 3533 banker isfb trojan

Malware Config

Extracted

Family

gozi

Attributes

build
214107

Extracted

Family

gozi

Botnet

3533

gmail.com

google.com

s82dortha27r.top

qcnick5990.top

sd6eb.com

Attributes

build
214107
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "208661584"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a08c9314a2c0da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000092879b20bf700e4c81ff82d1ae3b836600000000020000000000106600000001000020000000aff94e571d330aa6992dda45d4c0f2cc21ce2233267fa246ba05ca6fe96e8bb7000000000e800000000200002000000004942e0d61aaec90c84eac887467eb4e9de8491873592a4b9df83c443cc0ee10200000006637dc6a0e91b23bd77ed0b1a2b70fcde50b11dc43bce9387cefdd51c360f72140000000ac16ebfe3fd2d320a9be11482467c139485972bdaa4dad3e594ee4f4b28e7ed47196ce48de948c250ede5639eb995f9b7fd2b41f58bef08a770ea41f6c1ac490	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4015950da2c0da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{519E1E19-2C95-11EF-9D11-D685EB24A7F4} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000092879b20bf700e4c81ff82d1ae3b836600000000020000000000106600000001000020000000b3efb87a6cf6eba45f6a42ae6b95129d8c0d32d60e54e37db629068d931adaa0000000000e80000000020000200000001ec560ce210bf57cefb299b851677d91a428293594519f44ae74948e0e88034120000000399358f5b5c7676417ea6c0502f99c86fecd15317b1bb9cb5bd00dc00f42c2ca40000000e095181481d5957fcc68a6a94826cd4dea2c27841c7df8d193989eff568444b204fc64bb840f4b47236877438c064554d866cad5f50722223ab02613b05f5154	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{380B244F-2C95-11EF-9D11-D685EB24A7F4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000092879b20bf700e4c81ff82d1ae3b836600000000020000000000106600000001000020000000a65307d20f8fd716e8a5c842f5f8a1bfba83b9860739e8bd32d0054868b4702d000000000e8000000002000020000000bd8a85a4035cb3b7c437ea4fd72a78c2edc79caebfcee0ee5b380b276402620d200000009530e18e4885ff04cf3413dcaeff43a3613d699ce5a756bd43d745e4c36c9ff340000000b45b5203a28d22e3e8951bf190cfef973b555ddaa4a4697433f7c70e3ef2a809493b591e6a0c5d170d15acaab15e92118fc30b2440ecf951902d43334ccb1c64	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000092879b20bf700e4c81ff82d1ae3b8366000000000200000000001066000000010000200000004834f8e09e88d0495b0429fd4c7d02cb6110833ce8efcd8023743097db0a4a6a000000000e8000000002000020000000cfa9e62cfd24c6c48c51b33c3bd2f0999a2794cb4d50585720430b6782fb07b420000000a406c023dfdc791583bac5152f6cfd540ecb23644fc3b165f31ccccfbe47052c4000000091937b8e442496437376c8afe4d95a482206783af82102ef527f7dbae17f502cc48b9afe0c6aa5ceca5479b503da1cff7e4b0306136b9c2f952975b28b8e4b84	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 809d2b3ba2c0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6B5E640D-2C95-11EF-9D11-D685EB24A7F4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{783FB961-2C95-11EF-9D11-D685EB24A7F4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31113378"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 503e7021a2c0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31113378"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 602e890da2c0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000092879b20bf700e4c81ff82d1ae3b836600000000020000000000106600000001000020000000a152446235c46cc30168a83ee5352853d169295ff71e214ef2fa58b8c744af9a000000000e8000000002000020000000e28ebec0c3d1f1b37a0eb37e15fc4dab3f7091a6b2311ea4dc7fc8fff0a6254320000000c936f73b22f40349bd04e2d801161fdf78788a2db459ae3bfa8ec200a6d2eaa24000000046cc9b258c6885afff7dd1694d3a3e0f701c9cb1035f822980f0d96d48c093b4181cfde2d2b50b0a92887f5e10282d81021a146d29651f45061a0bcd54658d2f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "208661584"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000092879b20bf700e4c81ff82d1ae3b836600000000020000000000106600000001000020000000fa0cca5988efb1a35963e2f6b3c526fac5a3ae0e8b02d4b39a45f9b298e68a3c000000000e800000000200002000000068ce81dc4a6125d03d7877b1df9e5252b1a131de302498d20b216737115cba5020000000a5e5d24fe2d1eb1aec52b7f4b5dfc70448498e6adfe4a949724449c7aaee1b15400000004cea9893ada61b95eb9fe4af0c0b96368ff742243236d56a2765e2a9b46dbf4e7f5e98dadd60cc1ac1d2e98446a2096aa3ccb89a2c20c43ea2fe82500cbe108a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

pid process

1348 iexplore.exe
388 iexplore.exe
2308 iexplore.exe
2248 iexplore.exe
3324 iexplore.exe

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

pid	process
1348	iexplore.exe
1348	iexplore.exe
968	IEXPLORE.EXE
968	IEXPLORE.EXE
388	iexplore.exe
388	iexplore.exe
4696	IEXPLORE.EXE
4696	IEXPLORE.EXE
2308	iexplore.exe
2308	iexplore.exe
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE
2248	iexplore.exe
2248	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
3324	iexplore.exe
3324	iexplore.exe
4048	IEXPLORE.EXE
4048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 1348 wrote to memory of 968	1348	iexplore.exe	IEXPLORE.EXE
PID 1348 wrote to memory of 968	1348	iexplore.exe	IEXPLORE.EXE
PID 1348 wrote to memory of 968	1348	iexplore.exe	IEXPLORE.EXE
PID 388 wrote to memory of 4696	388	iexplore.exe	IEXPLORE.EXE
PID 388 wrote to memory of 4696	388	iexplore.exe	IEXPLORE.EXE
PID 388 wrote to memory of 4696	388	iexplore.exe	IEXPLORE.EXE
PID 2308 wrote to memory of 2468	2308	iexplore.exe	IEXPLORE.EXE
PID 2308 wrote to memory of 2468	2308	iexplore.exe	IEXPLORE.EXE
PID 2308 wrote to memory of 2468	2308	iexplore.exe	IEXPLORE.EXE
PID 2248 wrote to memory of 2748	2248	iexplore.exe	IEXPLORE.EXE
PID 2248 wrote to memory of 2748	2248	iexplore.exe	IEXPLORE.EXE
PID 2248 wrote to memory of 2748	2248	iexplore.exe	IEXPLORE.EXE
PID 3324 wrote to memory of 4048	3324	iexplore.exe	IEXPLORE.EXE
PID 3324 wrote to memory of 4048	3324	iexplore.exe	IEXPLORE.EXE
PID 3324 wrote to memory of 4048	3324	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\b8299962f91574e5e55df6b185ca1863_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b8299962f91574e5e55df6b185ca1863_JaffaCakes118.exe"
1⤵
PID:2172

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:8

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1348 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:968

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:388

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:388 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4696

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2468

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:17410 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
PID:2748

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3324

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3324 CREDAT:17410 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
PID:4048

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199
Filesize
854B

MD5
8d1040b12a663ca4ec7277cfc1ce44f0

SHA1
b27fd6bbde79ebdaee158211a71493e21838756b

SHA256
3086094d4198a5bbd12938b0d2d5f696c4dfc77e1eae820added346a59aa8727

SHA512
610c72970856ef7a316152253f7025ac11635078f1aea7b84641715813792374d2447b1002f1967d62b24073ee291b3e4f3da777b71216a30488a5d7b6103ac1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
375c6db674e4fcec8998d10b5fc1a258

SHA1
503a6c5e2bb75193a47de36f21911e556518a448

SHA256
98e318dc3acdd3526fef8e45c2220e5a9a63b0a826c317b83cb833ce1421d314

SHA512
67d392e6a5e86d664ff1f49602afde6f5a5b8f3d5aff979cf79cf00f9de11cec8f24e3f4be22c0528ba97944f88301ac0e8bea8f9955c6fb38afa6742f4a78f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6DA548C7E5915679F87E910D6581DEF1_66CCC5B62B11DC0BCF6DCA05D4EDF1A5
Filesize
471B

MD5
fc49162813cbc25597907de7807f04ef

SHA1
ce34a8b7b674483020ebb02e475597c569bc4171

SHA256
99a1cc21953f31fdbcd258c2f3cd12943fbdf1140761642662c00e5bafcd0b62

SHA512
bb8a95ddf82a6c9672b3587541adf660d9d7252981f3a96efcd03610e2836b1946ae77f68416ca5dbbd99f2809a98a1176f002c5aef7e9047fe371259260ff86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199
Filesize
170B

MD5
c10e892f624726dbcba9f80b41434304

SHA1
e44adecdb1f517dc243a89336a67b0d979dac041

SHA256
c67b7810799eece4da4bca6e2d79f5f4f7f4f886747c7b463e996c173139694e

SHA512
991a21a1a3e857d7698dac787e537bf4301c2d5a9a7b438b988ee7db4a9eab76180441508b079838b90fb7e93012d97151fc2045bcf9d8d1f91863f2d5200f9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
0f0d9365a537e4de2422c7bb9ec7341c

SHA1
9b23660d57139bcf44954cb4e077b98fb1cbb9bb

SHA256
6e0387913962e55963e99173719479178b1098f0ce1c1bdae6e38139a28e077a

SHA512
e42a87a2f25204e678ea19fed81be7cbbc0139a746ece3ee83c774fe42e8a3e3b1f3f6ae08f9c0917f535c14dbae4b0456d16ab633d35dce467a44102ac4ded8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6DA548C7E5915679F87E910D6581DEF1_66CCC5B62B11DC0BCF6DCA05D4EDF1A5
Filesize
406B

MD5
0beae17ffa776f84122c6748123ac58b

SHA1
e61162c823fd6a2ffaa77a4080cc78731ad9ff0d

SHA256
bf13f1d08f02581b78c06865ea0698b0e9819f0da723adf67d408b58858abfb9

SHA512
4edc1ad6f1654362553a272ddb79422293fc161dca076a6891e44c756b99e445148097155e0207f002c3db8551853fe693b0ab114487aa5598bff58a1956ca8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8Z1Z4637\robot[1].png
Filesize
6KB

MD5
4c9acf280b47cef7def3fc91a34c7ffe

SHA1
c32bb847daf52117ab93b723d7c57d8b1e75d36b

SHA256
5f9fc5b3fbddf0e72c5c56cdcfc81c6e10c617d70b1b93fbe1e4679a8797bff7

SHA512
369d5888e0d19b46cb998ea166d421f98703aec7d82a02dc7ae10409aec253a7ce099d208500b4e39779526219301c66c2fd59fe92170b324e70cf63ce2b429c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZRDQ3WBJ\googlelogo_color_150x54dp[1].png
Filesize
3KB

MD5
9d73b3aa30bce9d8f166de5178ae4338

SHA1
d0cbc46850d8ed54625a3b2b01a2c31f37977e75

SHA256
dbef5e5530003b7233e944856c23d1437902a2d3568cdfd2beaf2166e9ca9139

SHA512
8e55d1677cdbfe9db6700840041c815329a57df69e303adc1f994757c64100fe4a3a17e86ef4613f4243e29014517234debfbcee58dab9fc56c81dd147fdc058

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF7D29E301205526CF.TMP
Filesize
16KB

MD5
1d8bf54f8f7307744894086cc83ee0df

SHA1
5fe7356b4ba728016e8a5581e066ceb32e0c0915

SHA256
29372d21efe780ed0ef9ef8213333f0fd3198c3e9c593d8f1fe828cd0e4acef5

SHA512
8e9d7e80f9fd5193d34deb62ccea084e651747a0b400b6067f257beec03a2d2033f884de9cab7f2c6aa40312838784903f15e12449bea00933911668114da6f8

Download Submit
memory/2172-1-0x0000000000EE4000-0x0000000000EE7000-memory.dmp

Filesize
12KB

Download
memory/2172-28-0x0000000000E80000-0x0000000001EF9000-memory.dmp

Filesize
16.5MB

Download
memory/2172-3-0x0000000001FE0000-0x0000000001FEF000-memory.dmp

Filesize
60KB

Download
memory/2172-2-0x0000000000E80000-0x0000000001EF9000-memory.dmp

Filesize
16.5MB

Download
memory/2172-0-0x0000000000E80000-0x0000000001EF9000-memory.dmp

Filesize
16.5MB

Download