File name:

gnotify.exe

Full analysis: https://app.any.run/tasks/2e14cb03-6457-4ced-a6c0-581838cc99a6
Verdict: Malicious activity
Analysis date: February 09, 2024, 00:56:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

3DF7AC30A381C57D0C70EAEFEE3C4EF2

SHA1:

315104E4D6F2960701E381BB696C09A417845160

SHA256:

871F7E88B91A5A5D7262ED042C02AF55995C9A17AC419CA7B6B25EAC0E5B3B7A

SSDEEP:

6144:Lzr5DTRbdlE+uP38JYhSbOs2CCOqeuNJDQxZ5KQOv5Nc1/2s:FDTv0Hr2yDQKQOvk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • gnotify.exe (PID: 4052)

  • SUSPICIOUS

    • Reads the Internet Settings

      • gnotify.exe (PID: 4052)
      • gnotify.exe (PID: 2060)

    • Reads settings of System Certificates

      • gnotify.exe (PID: 4052)
      • gnotify.exe (PID: 2060)

    • Reads security settings of Internet Explorer

      • gnotify.exe (PID: 4052)
      • gnotify.exe (PID: 2060)

    • Checks Windows Trust Settings

      • gnotify.exe (PID: 4052)
      • gnotify.exe (PID: 2060)

  • INFO

    • Checks supported languages

      • gnotify.exe (PID: 4052)
      • gnotify.exe (PID: 2060)

    • Checks proxy server information

      • gnotify.exe (PID: 4052)
      • gnotify.exe (PID: 2060)

    • Reads the computer name

      • gnotify.exe (PID: 4052)
      • gnotify.exe (PID: 2060)

    • Reads the software policy settings

      • gnotify.exe (PID: 4052)
      • gnotify.exe (PID: 2060)

    • Reads the machine GUID from the registry

      • gnotify.exe (PID: 4052)
      • gnotify.exe (PID: 2060)

    • Creates files or folders in the user directory

      • gnotify.exe (PID: 4052)

    • Application launched itself

      • iexplore.exe (PID: 2624)

    • Manual execution by a user

      • gnotify.exe (PID: 2060)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2005:07:15 23:48:31+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 7
CodeSize: 380928
InitializedDataSize: 102400
UninitializedDataSize: -
EntryPoint: 0x4c8b6
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.25.0
ProductVersionNumber: 1.0.25.0
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Google Inc.
FileDescription: Gmail Notifier
FileVersion: 1.0.25.0
LegalCopyright: Copyright © Google Inc. 2004-2005
OriginalFileName: gnotify.exe
ProductName: Gmail
ProductVersion: 1.0.25.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start gnotify.exe iexplore.exe iexplore.exe gnotify.exe

Process information

PID
CMD
Path
Indicators
Parent process
2060"C:\Users\admin\Desktop\gnotify.exe" C:\Users\admin\Desktop\gnotify.exe
explorer.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Gmail Notifier
Exit code:
0
Version:
1.0.25.0
Modules
Images
c:\users\admin\desktop\gnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
2120"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2624 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2624"C:\Program Files\Internet Explorer\iexplore.exe" http://mail.google.com/mail/C:\Program Files\Internet Explorer\iexplore.exe
gnotify.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
4052"C:\Users\admin\Desktop\gnotify.exe" C:\Users\admin\Desktop\gnotify.exe
explorer.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Gmail Notifier
Exit code:
0
Version:
1.0.25.0
Modules
Images
c:\users\admin\desktop\gnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
Total events
28 023
Read events
27 744
Write events
195
Delete events
84

Modification events

(PID) Process:(4052) gnotify.exeKey:HKEY_CURRENT_USER\Software\Google\Autoupdate-G001
Operation:delete valueName:WantProductRestart
Value:
(PID) Process:(4052) gnotify.exeKey:HKEY_CURRENT_USER\Software\Google\Autoupdate-G001
Operation:writeName:AppPath
Value:
C:\Users\admin\Desktop
(PID) Process:(4052) gnotify.exeKey:HKEY_CURRENT_USER\Software\Google\Autoupdate-G001
Operation:writeName:InstalledVersion
Value:
1.0.25.0
(PID) Process:(4052) gnotify.exeKey:HKEY_CURRENT_USER\Software\Google\Autoupdate-G001
Operation:writeName:NextUpdate
Value:
(PID) Process:(4052) gnotify.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(4052) gnotify.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
(PID) Process:(4052) gnotify.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyOverride
Value:
(PID) Process:(4052) gnotify.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoConfigURL
Value:
(PID) Process:(4052) gnotify.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoDetect
Value:
(PID) Process:(4052) gnotify.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005C010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
0
Suspicious files
38
Text files
15
Unknown types
0

Dropped files

PID
Process
Filename
Type
4052gnotify.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_1C8038BAE9D4E52C4463A14FAB50BBA7binary
MD5:63BD5BD0263FBF67BB87D67993C74217
SHA256:9D287735E87FD9C62E87D405C59DAD9CE9905051AA7C6E51530ABBFCA07E0284
4052gnotify.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:2B33B0833148DC664D6B13C3F7E97BC2
SHA256:FEDE4ADCE8CF32BB9DC17A6F389971EBCE68EF8415F949F5690B04612EE8E5A3
2624iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
2624iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
4052gnotify.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:AC89A852C2AAA3D389B2D2DD312AD367
SHA256:0B720E19270C672F9B6E0EC40B468AC49376807DE08A814573FE038779534F45
4052gnotify.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_4FF70BED6E50B22FE9799AB821C4C486binary
MD5:E1A780984945DE3B7302D82A09D299F9
SHA256:FDE7F7EB2A6045E082D1F70B7D5546B60F65355E3D8DE9ED3644CE2CCB11EA44
2120iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_2EC0646BCB2ECEB8E3F0133D269FDC23binary
MD5:E0E531E4CC3B47DEE237F5F137073896
SHA256:A453F65AEE24FA346E2EA914BB764797F837047CFF940458545CE33216A76B01
2120iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\FNCZA8DN.txttext
MD5:8D72BD7347FD596BEE2593F3A4EE1E88
SHA256:79226D5BFBB598F55A75E7E2494B089C6FBF16A44F241997822ABBFC201C4102
2120iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_2EC0646BCB2ECEB8E3F0133D269FDC23binary
MD5:B321CBD34DEA0E9B442CF2BCAA636388
SHA256:ADA124D6AF6EBE2A2171D17374D9613B06D4FC99E86C5E7AA066638FBBD50E89
4052gnotify.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_1C8038BAE9D4E52C4463A14FAB50BBA7binary
MD5:0D7D523B7B934F1EA34BF545A5CEA324
SHA256:D17F2EDEFB5A6CEE6D573CD547C46751531203418504626C5FDD9C5F38696D4B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
44
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4052
gnotify.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f34bf006e77033a5
unknown
—
—
unknown
4052
gnotify.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
4052
gnotify.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
unknown
4052
gnotify.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBNRO0CFNoMoCn81RqoChws%3D
unknown
binary
471 b
unknown
4052
gnotify.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCmczDWmpesCwrD1wNc%2FGMh
unknown
binary
472 b
unknown
2624
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
313 b
unknown
2120
iexplore.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECtH1GJS9B2iEi7XtPFvvko%3D
unknown
binary
471 b
unknown
2120
iexplore.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDf%2FqechPhkiAm5teJWf%2BUv
unknown
binary
472 b
unknown
2120
iexplore.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCw14DGj8KB%2FwqJau317vru
unknown
binary
472 b
unknown
1080
svchost.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?6776476d79efed94
unknown
compressed
65.2 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4052
gnotify.exe
172.217.16.196:443
www.google.com
GOOGLE
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4052
gnotify.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4052
gnotify.exe
142.250.184.195:80
ocsp.pki.goog
GOOGLE
US
whitelisted
4052
gnotify.exe
108.177.15.84:443
accounts.google.com
GOOGLE
US
unknown
2120
iexplore.exe
172.217.18.5:443
mail.google.com
GOOGLE
US
whitelisted
2120
iexplore.exe
142.250.184.195:80
ocsp.pki.goog
GOOGLE
US
whitelisted
2120
iexplore.exe
108.177.15.84:443
accounts.google.com
GOOGLE
US
unknown

DNS requests

Domain
IP
Reputation
www.google.com
  • 172.217.16.196
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.pki.goog
  • 142.250.184.195
whitelisted
accounts.google.com
  • 108.177.15.84
shared
mail.google.com
  • 172.217.18.5
shared
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.131
  • 104.126.37.128
  • 104.126.37.145
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.gstatic.com
  • 142.250.186.35
whitelisted
fonts.gstatic.com
  • 142.250.186.67
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
gnotify.exe