Analysis

  • max time kernel
    140s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    17-05-2024 08:32

General

  • Target

    4f2d8bb1f96447d2caaf1e71d06cc1b9_JaffaCakes118.exe

  • Size

    354KB

  • MD5

    4f2d8bb1f96447d2caaf1e71d06cc1b9

  • SHA1

    09540f4c5cf1846827241542bdee459ad9a42da8

  • SHA256

    204e6d0a34efc884ebe85de278f9806ab9bcf2b587491dea24ef3979b5aed6a1

  • SHA512

    74c19a7ddee24d9a11466edcbb0b8cbffd2b08c9025b94a488cc3ffeabb7d2c074edfd88191540d31ab7db2fe69c484bbbc50b233a6ae098df82f41bd2592f5e

  • SSDEEP

    6144:jEp7pQMOtvhiNyVyZHbzU5/JMi+xLus/AWQB9X:apWhcyIZHnU5RPu4B9X

Malware Config

Extracted

Family

gozi

Attributes
  • build

    214062

Extracted

Family

gozi

Botnet

3177

C2

wgcjeremy11.band

skelsigabriella.fun

xelectauishanie.email

Attributes
  • build

    214062

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SetWindowsHookEx 20 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4f2d8bb1f96447d2caaf1e71d06cc1b9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4f2d8bb1f96447d2caaf1e71d06cc1b9_JaffaCakes118.exe"
    1⤵
      PID:3028
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2516
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2516 CREDAT:275457 /prefetch:2
        2⤵
        • Suspicious use of SetWindowsHookEx
        PID:3052
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:920
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:920 CREDAT:275457 /prefetch:2
        2⤵
        • Suspicious use of SetWindowsHookEx
        PID:3024
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1964
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:275457 /prefetch:2
        2⤵
        • Suspicious use of SetWindowsHookEx
        PID:1284
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1592
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1592 CREDAT:275457 /prefetch:2
        2⤵
        • Suspicious use of SetWindowsHookEx
        PID:820
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2036
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:2
        2⤵
        • Suspicious use of SetWindowsHookEx
        PID:2076

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      acf8c58452418730e4cc40c3c1a0ea34

      SHA1

      b03b6d3f51d985a8efdbfa5f96aca19f41bc5427

      SHA256

      7a4cff4165cbb4e2918cf4b56a3f6af6a7ced6957640fa8633fbaa82868260d8

      SHA512

      c0f4ba7973911b5f4cde49b42d1d0af580c9fa8e93f5464a6e3c7e57e6c28899d96737f09fc376247988218b6c5f63617aced5428a72460c7469d84cc9107ca1

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      6d9ee14af793e753cf6573125b838375

      SHA1

      3e9cb778cefd90b961314679a95ed2adfefa6d15

      SHA256

      341cced90a19072c1844e87e9d1532c283cf1db0ceb7388e815c46c2f67ad970

      SHA512

      1d35f61c0e2192e10ac1c75553aa3f46950c44e33e0e4678dddb9b48d18230e9b52e1bdc4cfa9115e55d5feb57d8a507bc9cb29ed0df0b368f32acdd48baffb6

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      98576be17016b03000da26eb101e6eea

      SHA1

      1913bc5e729ed20df708724f620fc706b157a7a7

      SHA256

      b7ed37326da487433bd34433ec754961a519d93497ea76f47d1ca32067684102

      SHA512

      ea84e0bb0099612bf0400008f5feb90e56a00a76cf96992766271f176eecd4b879530e94f933466d2ea57c53224c4a8f9ada253dfc3fd20d81fd90bd5aec6c89

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      fd0e205117b24151569279a3538fa30f

      SHA1

      486d24ac00e592b5dd2110b1033aa4bed4e3a956

      SHA256

      91d047e8046cdf3b4c1fbeb1638f96092d85a9b446bea6a557c8213bb9e9d17e

      SHA512

      fa415e2bf827f14d8e2d2e48f8a022bfeed05e890ad217d8df2d186b91dd14df7366a814ed1738d27f8a5a534955966b7d20003745e96ce12d6fe54920a52793

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      54a2cfdeb3dd16b61dc2b31ef8e3322a

      SHA1

      0cf9dce3157f967f8fd519e95f16eba8e3436c86

      SHA256

      f2790b6c74e0a168be30455b0ff01fb71cef5a1a5aef1fa63df6c6d2c7d58485

      SHA512

      d0c72b4a5900d13496f6ab593ffd61640a89d9e966c7a0c9f9827a7e3078e56d07caf337c1b51b5f4748938165835c14e77e29b03283460a3a4b53790f6568a3

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      abb0c30c7cc8649b83f936e88b3dde4b

      SHA1

      0e080f904a48aaf8be2c5c7258d7c6ab218d248b

      SHA256

      50fdf9031e432711cafdc7b1afa90681a84fa7223185e4fab45e54aaaa3526d8

      SHA512

      b14f19e3ae6accf65e61dc980670876a8cfd0269ef7b8532d95ca4e14b09a109a13ceccfc1306c362f4312b499886008a2fefecf3a5e8619711841f28204334b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      95cbd58ecf167e55acee880a07e8d206

      SHA1

      9bbc09cd63f0ed4e49e009236af0263e202cf7ee

      SHA256

      bf9cb0f7e5440fe42b4bce8fae76b0f9c1d817f6da228157b3638331f57d4940

      SHA512

      7615b29592b6172c6fb194e185875793179cc63246057f4aa8ec56311b39fc5b7bc27b7b5408ae5b9a08043ab6769fb35806de33d15d8e44a103c5f19ebe8007

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      e804a5879e38a466804d328d1522de1e

      SHA1

      94b991eb5d70d2b599c36a043f8889a67bb98b15

      SHA256

      e73ef3b1f36e4df384d9a59d32fba9e41f2ad3539eceded8068080c45d9a5988

      SHA512

      801a6ad02b107a1d997b6950ed3eec457eb9446e01d57a95b308b7e1a4b50fb2d76948aa918541e3aa2cb717d29e324795c6221787e79f7cfbac6e170983f490

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JB8Q1DZR\errorPageStrings[1]

      Filesize

      2KB

      MD5

      e3e4a98353f119b80b323302f26b78fa

      SHA1

      20ee35a370cdd3a8a7d04b506410300fd0a6a864

      SHA256

      9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66

      SHA512

      d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPR7YYBV\httpErrorPagesScripts[2]

      Filesize

      8KB

      MD5

      3f57b781cb3ef114dd0b665151571b7b

      SHA1

      ce6a63f996df3a1cccb81720e21204b825e0238c

      SHA256

      46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad

      SHA512

      8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UA1HZF3D\NewErrorPageTemplate[1]

      Filesize

      1KB

      MD5

      cdf81e591d9cbfb47a7f97a2bcdb70b9

      SHA1

      8f12010dfaacdecad77b70a3e781c707cf328496

      SHA256

      204d95c6fb161368c795bb63e538fe0b11f9e406494bb5758b3b0d60c5f651bd

      SHA512

      977dcc2c6488acaf0e5970cef1a7a72c9f9dc6bb82da54f057e0853c8e939e4ab01b163eb7a5058e093a8bc44ecad9d06880fdc883e67e28ac67fee4d070a4cc

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VIF0OH2A\dnserror[1]

      Filesize

      1KB

      MD5

      73c70b34b5f8f158d38a94b9d7766515

      SHA1

      e9eaa065bd6585a1b176e13615fd7e6ef96230a9

      SHA256

      3ebd34328a4386b4eba1f3d5f1252e7bd13744a6918720735020b4689c13fcf4

      SHA512

      927dcd4a8cfdeb0f970cb4ee3f059168b37e1e4e04733ed3356f77ca0448d2145e1abdd4f7ce1c6ca23c1e3676056894625b17987cc56c84c78e73f60e08fc0d

    • C:\Users\Admin\AppData\Local\Temp\Cab9791.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\Cab985E.tmp

      Filesize

      68KB

      MD5

      29f65ba8e88c063813cc50a4ea544e93

      SHA1

      05a7040d5c127e68c25d81cc51271ffb8bef3568

      SHA256

      1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

      SHA512

      e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    • C:\Users\Admin\AppData\Local\Temp\Tar9875.tmp

      Filesize

      177KB

      MD5

      435a9ac180383f9fa094131b173a2f7b

      SHA1

      76944ea657a9db94f9a4bef38f88c46ed4166983

      SHA256

      67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

      SHA512

      1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    • C:\Users\Admin\AppData\Local\Temp\~DFDAB3386666F26B08.TMP

      Filesize

      16KB

      MD5

      2c83e2c624d6bcd9b4e48d7469a7abbb

      SHA1

      11b14e4ee27e3ef0e9e83a481b66113699e6184a

      SHA256

      fd9511347fad8bdeedd510a875c76a088941ee294e6ccb9fc26f5b76ca2039f7

      SHA512

      09dc4f4a9683e97d8003114c612d321f251182623af17deca1ebc7733bd1b7da6e9201dc8fa77a722351d9fa1c85ab2d6854fe0df3bd23c8d7bab3bbaac71e20

    • memory/3028-0-0x0000000000400000-0x0000000000465000-memory.dmp

      Filesize

      404KB

    • memory/3028-6-0x0000000000330000-0x0000000000332000-memory.dmp

      Filesize

      8KB

    • memory/3028-2-0x00000000002B0000-0x00000000002CB000-memory.dmp

      Filesize

      108KB

    • memory/3028-1-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB