Analysis

  • max time kernel
    145s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-05-2024 18:10

General

  • Target

    4c640f826205255714a7a5ad0eac1758_JaffaCakes118.exe

  • Size

    231KB

  • MD5

    4c640f826205255714a7a5ad0eac1758

  • SHA1

    d67e245559f2bfdf412b8a2bbd50cd9895297265

  • SHA256

    7c16f59fc9c7134435996ebd1658d9e11f7951c5245ee6dcc176794fe8f94e58

  • SHA512

    cbf629ca740a4f56a81625e676666ce9434b7daebb3cb43c549e021442e2a4dddef57cea0fa8084ee87e3cccd6ece50756b268bf93b403493104d2c912d8572a

  • SSDEEP

    6144:RGcba3NwVhrBWUyAhCFvIA+Ed9h1RLMxn6Igquv0:RG4a9wTrB8OCJIrU9h1RLMxnVm0

Malware Config

Extracted

Family

gozi

Attributes
  • build

    214085

Extracted

Family

gozi

Botnet

3485

C2

google.com

gmail.com

s39aihzlia.com

hqrya64peyton.com

l58er.com

Attributes
  • build

    214085

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SetWindowsHookEx 20 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4c640f826205255714a7a5ad0eac1758_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4c640f826205255714a7a5ad0eac1758_JaffaCakes118.exe"
    1⤵
      PID:1580
    • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
      "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
      1⤵
        PID:2628
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3512
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3512 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1780
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3564
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3564 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:4372
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4356
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4356 CREDAT:17410 /prefetch:2
          2⤵
          • Suspicious use of SetWindowsHookEx
          PID:5116
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3672
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3672 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:5112
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1396
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1396 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1452

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3YK18YAR\googlelogo_color_150x54dp[1].png

        Filesize

        3KB

        MD5

        9d73b3aa30bce9d8f166de5178ae4338

        SHA1

        d0cbc46850d8ed54625a3b2b01a2c31f37977e75

        SHA256

        dbef5e5530003b7233e944856c23d1437902a2d3568cdfd2beaf2166e9ca9139

        SHA512

        8e55d1677cdbfe9db6700840041c815329a57df69e303adc1f994757c64100fe4a3a17e86ef4613f4243e29014517234debfbcee58dab9fc56c81dd147fdc058

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3YK18YAR\robot[1].png

        Filesize

        6KB

        MD5

        4c9acf280b47cef7def3fc91a34c7ffe

        SHA1

        c32bb847daf52117ab93b723d7c57d8b1e75d36b

        SHA256

        5f9fc5b3fbddf0e72c5c56cdcfc81c6e10c617d70b1b93fbe1e4679a8797bff7

        SHA512

        369d5888e0d19b46cb998ea166d421f98703aec7d82a02dc7ae10409aec253a7ce099d208500b4e39779526219301c66c2fd59fe92170b324e70cf63ce2b429c

      • C:\Users\Admin\AppData\Local\Temp\~DFCEC8313A32169DAF.TMP

        Filesize

        16KB

        MD5

        9a13ad21d0201e9c74683b1f40e78c07

        SHA1

        a1e14b62f9372a8227394829f60844e171a7a74d

        SHA256

        7e055fc5f05a1a771353e8266e84874b043942dd8c263346ed656b7561d2d789

        SHA512

        8ad47df37227be399e5fd8bcc60506fa900dd1799d6f2d98c725d781a12a2544133bced5388d7d5798fb6d9a191d184350d0ee80e7d04264fd40da7c80fcbacb

      • memory/1580-3-0x00000000006F0000-0x0000000000849000-memory.dmp

        Filesize

        1.3MB

      • memory/1580-2-0x000000000072A000-0x000000000072F000-memory.dmp

        Filesize

        20KB

      • memory/1580-1-0x00000000006F0000-0x0000000000849000-memory.dmp

        Filesize

        1.3MB

      • memory/1580-0-0x00000000006F0000-0x0000000000849000-memory.dmp

        Filesize

        1.3MB

      • memory/1580-4-0x00000000013E0000-0x00000000013EF000-memory.dmp

        Filesize

        60KB

      • memory/1580-16-0x00000000006F0000-0x0000000000849000-memory.dmp

        Filesize

        1.3MB