gozi | bca1f60d115f797a0234a94e8981a8fb5d74d94bb193661cdc94f9fb6cb888c9

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 11:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1287ed32e22472ff98d78c7687fe3389_JaffaCakes118.exe
Size

215KB
MD5

1287ed32e22472ff98d78c7687fe3389
SHA1

be8bf040099b4d037cdc6d7e01a4e08e4570276e
SHA256

bca1f60d115f797a0234a94e8981a8fb5d74d94bb193661cdc94f9fb6cb888c9
SHA512

565c6b04ad6a04d4f9b61b592bfe53a23cf7c686e7a2b5a4c4c0fe91e694df2fb0b57f9acbb4a586b89685dbda8aaec76bcdc1cfc786864c97b745c4e86fa75a
SSDEEP

3072:Rb9pXDyUKdySqVgQZt8OdcjFfSvbke/0t4mwqWB55syoNdL0Z2L6BWnqR+yV:BHXDy1qVvZnOe/HEyoQWGd

Score

10^/10

gozi 3153 banker isfb trojan

Malware Config

Extracted

Family

gozi

Attributes

build
215165

Extracted

Family

gozi

Botnet

3153

biesbetiop.com

kircherche.com

toforemedi.com

Attributes

build
215165
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com

ru

org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0788956169eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fd9f6c1d40c054499c46bb7606839f360000000002000000000010660000000100002000000085942f4e34c4ca68f1aeebf3089286d4f8b1b8c825f62237f343f50453beb80e000000000e800000000200002000000001e173afd04fc3c7bc737a1f204aeabf844997505aae0e45fb86e44f25fdd6d6900000001f3583fc7063fb73c366db3b821a7437bc2a36f54d9ec60eb343116e1c1dd30ebb7d4689464b393bb4e34f897431fb63b63af25f1c3dad39f1a8f638dbf51e597240c23f185c697df190728e83225c46b775af1d1c48ff151763598657180dfda523166cb525ed2006c2e59d72ff92721ebe9281209478ba6ca9959ffa287c7bae6d19a8044cedf4823c5c2b38bacb1440000000c4655e553ac337098e51ddda3ee459a4b1176a14116cca563834528c0f234e275551087e54a8f7cad822e7a1076045cb1d88a470c53b86d7bdf773928da9102a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{81A94401-0A09-11EF-910D-CE7E212FECBD} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fd9f6c1d40c054499c46bb7606839f36000000000200000000001066000000010000200000004f4242b04744a38066c7f92c21f17aff3a1b6ed6860a905c2aedc327b412bd95000000000e80000000020000200000009e631f7a333017f845b5a6030f930e5507aaf00fe7d0548cf3fb98fcde62066b200000008e667525aeaad85fbab6a08c918349c14c5b1fa0e7a4e97bbdd3d737834100804000000041e944eb3c8954f9bbcf0d4b078fa8dc6f90645ffbfb49ebdb44376e7e0b50d26184d1074f6da5445978faa87bcacfec9033a2bbc45372c655d0544e14148d24	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2148	iexplore.exe
2148	iexplore.exe
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2640	2148	iexplore.exe	31
PID 2148 wrote to memory of 2640	2148	iexplore.exe	31
PID 2148 wrote to memory of 2640	2148	iexplore.exe	31
PID 2148 wrote to memory of 2640	2148	iexplore.exe	31

C:\Users\Admin\AppData\Local\Temp\1287ed32e22472ff98d78c7687fe3389_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1287ed32e22472ff98d78c7687fe3389_JaffaCakes118.exe"
1⤵
PID:2244

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
db072815fb7855e4683b0a81a93f991d

SHA1
d20b1b73f0c944ee93175f71d430409f7468d10a

SHA256
d332224dc6189ab3abc257655e33f94d7225d5c7d031abd44d7c85c59d396b7d

SHA512
5de6db360ef8a9e5003faf9482920371c7ed1160415d8c1e54018ced56d414b57542c3ff28b2c518b3135254fe432cdb707ef9a5a5b4823d779f17b9bc12d31e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4313667447427d22f1bab602e1d12665

SHA1
5064354d4a851cdfc77a606d6823875a54eed093

SHA256
71b1ead45cf85527380e24858ee0bf3e969ad9910c33cdf3ddee1a743cc2f1cd

SHA512
f2619b146b1d0f7bacc2227525d75b2db7127c07f5bb5f11f070b648cfc45f470f33675ae32245fb605b8e1b8058744a6bf986c3e0e9e0bcbf854c562286b698

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5c62175084d5624224f7f97a1d8afef

SHA1
209586e58f469dbc14e0246c2524d9ad31ba34df

SHA256
f19525dc6ac412c31c3a649b9286465b15fb674e2a7071ad35aa778c5c29fec2

SHA512
8e52f72af1ed1bd22885b74b4cce6ad1926ae567fddd2a90355bacbf7969e1b8572ab142828c9cab898314e2cde6d29f6ed9103c7abf3b66e9ad2a6630a3de9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0ae674d5768de9f8f9e8041d24e0635

SHA1
e5592b0a2510df3f7d0df91af9cd2cfa684f53e8

SHA256
c5a73be66a462008fb045fcda0cb91a4bbfe1c21eaed3b9a7a422c98a5f0357a

SHA512
8c5c8bbd2821e7c7908eb5537ea5eb40151778cae1272db4ebb8e8f13c44716e5bfa445dcb6a40105c15418a0729494628a0824256c1597defce1be116b5ed96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91e1d992e78fe81608fc2640237c7684

SHA1
94def51040be35926a0f7e225cc9fd011e834bc7

SHA256
66ba7ba31bb53974ecf3cdc207e8f310758f11c06ff609cd2a7137ae31fed033

SHA512
3c37dc238c625a78f395e677806922cfebffd716561669fe26b7d06380f6985513d623393b7ce922c6ff162c33e0b8ee0a7e79ca184ecbde62cd6cbdbe583b52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0846d2587c93da4fcd87100d9c161e20

SHA1
ef7925960491c73c55c50941ef817cfcad92ce9e

SHA256
e5f31b54dbb5f3cf29aaf3a520ea38fc4844a539c55a60efd7a5356dc3eb2ca1

SHA512
b561d9769ff126e5651c439ade9e2f832552c0ff645f90c1b4c3087af619e5d27a458ed7c15979dd6b6a0aa76ff94fe2c00c6a531066be0dcb1c84b84bd0018b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0346b21de728bd4733aa160a9ab6fc62

SHA1
7642a317772b66cf5886ebefc6436136173050ca

SHA256
1930db7d96903fa866acecd7f71ec9e9617f9266285db38ed0e0d76fb7604a9a

SHA512
92ddec8621b0d4ea57c26f62a455a0e5b168f685674a3770be54d45d2555fc126ee4388992c1609f6691235dee1f82a15b9a8e42ee5bb2ee109de3c7f0dc0e11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0828df84cd7cbb872447bd153b19d95c

SHA1
5186098b8c37e67087df0bc6897915420a22cfeb

SHA256
ea33a53933851446a90e1c5b12a5a0efe05dd3782d2e615746604e5bda1b4fa2

SHA512
f1f2735e05233a9e4df810f881868faf48ac34852207b36855e705903c506f1dc6254fe57c53a82e92a0017c69c3b865b794f93237ecbb78d9b0c3acd45f1c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a8c122a4b06fbbfe14135a3e80d4ad7

SHA1
baf55d20c13cd2e380cc3b4aba52216946e55954

SHA256
9d5a978ee7facbc84728bb8604d853c30a77cbe4f99567d77cc5032b3e2d286c

SHA512
925c3a62ba62713f4d90836851c45d2132f68bf1fe2cb3c8095dae33f7541975fecc12f8330dc909986995631e16441ef71d0db0e8667e5e77b862a0752b3f64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3782b8bf664cdf4b07cb09ba129cbd63

SHA1
e3584135db2402c8439c6df826a74fd40f8edbba

SHA256
eae9d63a2bccf8eea43ef4a03bf0af58024edc64907501cb124400d9a9c01d49

SHA512
35058154128fdeff444f9a810ade38ce0490d64d02e0bc18a7bbaffcb1a60f37aed582685528ee7cdf279dcebbcce8744415d810d4bc695b65d6f11ba1d37b9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
dc6ea9cd96e5c2ed2f3c2b9cec2d5328

SHA1
939544f562527d500f4c20777f3ad721d96df40e

SHA256
fbc1a6837ae123fcb1d4928a44dd4e1760ac81e9a68d1a66a45346b579bb47f5

SHA512
d37384806938ffcbb0dc62e09916127dbcd90e96d29aa8c4c7735a6c7929588b045b6a431c4a8e333651066c30ba89232b9088bf89597585a167ec678a020227

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9703.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar985F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
memory/2244-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2244-6-0x00000000002B0000-0x00000000002B2000-memory.dmp

Filesize
8KB

Download
memory/2244-2-0x00000000001F0000-0x000000000020B000-memory.dmp

Filesize
108KB

Download
memory/2244-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads