File name:

gnotify.exe

Full analysis: https://app.any.run/tasks/2e14cb03-6457-4ced-a6c0-581838cc99a6
Verdict: Malicious activity
Analysis date: February 09, 2024, 00:56:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

3DF7AC30A381C57D0C70EAEFEE3C4EF2

SHA1:

315104E4D6F2960701E381BB696C09A417845160

SHA256:

871F7E88B91A5A5D7262ED042C02AF55995C9A17AC419CA7B6B25EAC0E5B3B7A

SSDEEP:

6144:Lzr5DTRbdlE+uP38JYhSbOs2CCOqeuNJDQxZ5KQOv5Nc1/2s:FDTv0Hr2yDQKQOvk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • gnotify.exe (PID: 4052)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • gnotify.exe (PID: 4052)
      • gnotify.exe (PID: 2060)

    • Reads security settings of Internet Explorer

      • gnotify.exe (PID: 4052)
      • gnotify.exe (PID: 2060)

    • Reads the Internet Settings

      • gnotify.exe (PID: 4052)
      • gnotify.exe (PID: 2060)

    • Checks Windows Trust Settings

      • gnotify.exe (PID: 4052)
      • gnotify.exe (PID: 2060)

  • INFO

    • Checks proxy server information

      • gnotify.exe (PID: 4052)
      • gnotify.exe (PID: 2060)

    • Reads the computer name

      • gnotify.exe (PID: 4052)
      • gnotify.exe (PID: 2060)

    • Checks supported languages

      • gnotify.exe (PID: 4052)
      • gnotify.exe (PID: 2060)

    • Creates files or folders in the user directory

      • gnotify.exe (PID: 4052)

    • Reads the software policy settings

      • gnotify.exe (PID: 4052)
      • gnotify.exe (PID: 2060)

    • Application launched itself

      • iexplore.exe (PID: 2624)

    • Reads the machine GUID from the registry

      • gnotify.exe (PID: 4052)
      • gnotify.exe (PID: 2060)

    • Manual execution by a user

      • gnotify.exe (PID: 2060)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2005:07:15 23:48:31+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 7
CodeSize: 380928
InitializedDataSize: 102400
UninitializedDataSize: -
EntryPoint: 0x4c8b6
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.25.0
ProductVersionNumber: 1.0.25.0
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Google Inc.
FileDescription: Gmail Notifier
FileVersion: 1.0.25.0
LegalCopyright: Copyright © Google Inc. 2004-2005
OriginalFileName: gnotify.exe
ProductName: Gmail
ProductVersion: 1.0.25.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start gnotify.exe iexplore.exe iexplore.exe gnotify.exe

Process information

PID
CMD
Path
Indicators
Parent process
2060"C:\Users\admin\Desktop\gnotify.exe" C:\Users\admin\Desktop\gnotify.exe
explorer.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Gmail Notifier
Exit code:
0
Version:
1.0.25.0
Modules
Images
c:\users\admin\desktop\gnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
2120"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2624 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2624"C:\Program Files\Internet Explorer\iexplore.exe" http://mail.google.com/mail/C:\Program Files\Internet Explorer\iexplore.exe
gnotify.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
4052"C:\Users\admin\Desktop\gnotify.exe" C:\Users\admin\Desktop\gnotify.exe
explorer.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Gmail Notifier
Exit code:
0
Version:
1.0.25.0
Modules
Images
c:\users\admin\desktop\gnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
Total events
28 023
Read events
27 744
Write events
195
Delete events
84

Modification events

(PID) Process:(4052) gnotify.exeKey:HKEY_CURRENT_USER\Software\Google\Autoupdate-G001
Operation:delete valueName:WantProductRestart
Value:
(PID) Process:(4052) gnotify.exeKey:HKEY_CURRENT_USER\Software\Google\Autoupdate-G001
Operation:writeName:AppPath
Value:
C:\Users\admin\Desktop
(PID) Process:(4052) gnotify.exeKey:HKEY_CURRENT_USER\Software\Google\Autoupdate-G001
Operation:writeName:InstalledVersion
Value:
1.0.25.0
(PID) Process:(4052) gnotify.exeKey:HKEY_CURRENT_USER\Software\Google\Autoupdate-G001
Operation:writeName:NextUpdate
Value:
(PID) Process:(4052) gnotify.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(4052) gnotify.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
(PID) Process:(4052) gnotify.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyOverride
Value:
(PID) Process:(4052) gnotify.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoConfigURL
Value:
(PID) Process:(4052) gnotify.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoDetect
Value:
(PID) Process:(4052) gnotify.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005C010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
0
Suspicious files
38
Text files
15
Unknown types
0

Dropped files

PID
Process
Filename
Type
4052gnotify.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:0AD18F486A508A6C80D6D467666F7469
SHA256:A23ED969F6816C5D4343AB65E5918520D62F80A517E4DFBA02F8400FB7FC85A1
2120iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_2EC0646BCB2ECEB8E3F0133D269FDC23binary
MD5:E0E531E4CC3B47DEE237F5F137073896
SHA256:A453F65AEE24FA346E2EA914BB764797F837047CFF940458545CE33216A76B01
4052gnotify.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_1C8038BAE9D4E52C4463A14FAB50BBA7binary
MD5:63BD5BD0263FBF67BB87D67993C74217
SHA256:9D287735E87FD9C62E87D405C59DAD9CE9905051AA7C6E51530ABBFCA07E0284
2624iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Abinary
MD5:4593171E43E2BE5E7F65BF950E623523
SHA256:61BA7465AE8B5EFDA02524BE0EF27D1E42C205E4A0E5523F7AE505685824D2D2
4052gnotify.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_4FF70BED6E50B22FE9799AB821C4C486binary
MD5:E1A780984945DE3B7302D82A09D299F9
SHA256:FDE7F7EB2A6045E082D1F70B7D5546B60F65355E3D8DE9ED3644CE2CCB11EA44
4052gnotify.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:5425960DA0951BA397C56A87DBCA371A
SHA256:7C71EBB695893DA93875F58FF1A7C708A8986A1BCFCC094E52D73337B1B4F5ED
4052gnotify.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_1C8038BAE9D4E52C4463A14FAB50BBA7binary
MD5:0D7D523B7B934F1EA34BF545A5CEA324
SHA256:D17F2EDEFB5A6CEE6D573CD547C46751531203418504626C5FDD9C5F38696D4B
2120iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_2EC0646BCB2ECEB8E3F0133D269FDC23binary
MD5:B321CBD34DEA0E9B442CF2BCAA636388
SHA256:ADA124D6AF6EBE2A2171D17374D9613B06D4FC99E86C5E7AA066638FBBD50E89
4052gnotify.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_4FF70BED6E50B22FE9799AB821C4C486binary
MD5:F64196C883DABE4F91687441ABE2B94D
SHA256:B2F088BB269625562325C2E5E5A7397C3672E56CF9CAC975FE78B6D8507AB48D
4052gnotify.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:6E9F64457E1CABDAD4B7B273056A63C7
SHA256:815A85138788B58125A38CA9D11B63D6F58AEEF4E38927C14F17DC73308C2EAD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
44
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4052
gnotify.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
4052
gnotify.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f34bf006e77033a5
unknown
—
—
unknown
4052
gnotify.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
unknown
4052
gnotify.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBNRO0CFNoMoCn81RqoChws%3D
unknown
binary
471 b
unknown
4052
gnotify.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCmczDWmpesCwrD1wNc%2FGMh
unknown
binary
472 b
unknown
2120
iexplore.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECtH1GJS9B2iEi7XtPFvvko%3D
unknown
binary
471 b
unknown
2624
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
313 b
unknown
2120
iexplore.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDf%2FqechPhkiAm5teJWf%2BUv
unknown
binary
472 b
unknown
2120
iexplore.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCw14DGj8KB%2FwqJau317vru
unknown
binary
472 b
unknown
1080
svchost.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?6776476d79efed94
unknown
compressed
65.2 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4052
gnotify.exe
172.217.16.196:443
www.google.com
GOOGLE
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4052
gnotify.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4052
gnotify.exe
142.250.184.195:80
ocsp.pki.goog
GOOGLE
US
whitelisted
4052
gnotify.exe
108.177.15.84:443
accounts.google.com
GOOGLE
US
unknown
2120
iexplore.exe
172.217.18.5:443
mail.google.com
GOOGLE
US
whitelisted
2120
iexplore.exe
142.250.184.195:80
ocsp.pki.goog
GOOGLE
US
whitelisted
2120
iexplore.exe
108.177.15.84:443
accounts.google.com
GOOGLE
US
unknown

DNS requests

Domain
IP
Reputation
www.google.com
  • 172.217.16.196
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.pki.goog
  • 142.250.184.195
whitelisted
accounts.google.com
  • 108.177.15.84
shared
mail.google.com
  • 172.217.18.5
shared
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.131
  • 104.126.37.128
  • 104.126.37.145
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.gstatic.com
  • 142.250.186.35
whitelisted
fonts.gstatic.com
  • 142.250.186.67
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
gnotify.exe