gozi | ca29eb42bd3c31bfe856e3aded778cf4bdeb65130e8780f1c0ecd58a2f7ca4d5

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

515699b64c0e719d2fbbc228b1a8c1ab_JaffaCakes118.exe
Size

215KB
MD5

515699b64c0e719d2fbbc228b1a8c1ab
SHA1

bc56ae02b864b4870ee0be5ee3680f5bb4bb26a9
SHA256

ca29eb42bd3c31bfe856e3aded778cf4bdeb65130e8780f1c0ecd58a2f7ca4d5
SHA512

064e7728258ee719132b7fc4f2767ae141354ac589bc5c2c208b161879b0b43cc2f783c294f3cc1014d1b2bc26286792eadb132e5fc3e77225ef3a26dc955ff9
SSDEEP

3072:Rb9pXDyUKdySqVgQZt8OdcjFfSvbke/0t4mwqWB55syoNdL0S2L6BWnqR+yV:BHXDy1qVvZnOe/HEyo1WGd

Score

10^/10

gozi 3153 banker isfb trojan

Malware Config

Extracted

Family

gozi

Attributes

build
215165

Extracted

Family

gozi

Botnet

3153

biesbetiop.com

kircherche.com

toforemedi.com

Attributes

build
215165
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c012648398a8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AE673601-148B-11EF-BADF-D62CE60191A1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000008583c2db1b0b81320d529d3bd643009dc038e3a0edcabd655251dd3dc6618125000000000e80000000020000200000000d27c60961e53f174a9f480f5356984b92c5b128a277e77b1efbff25a83a4d74200000001b351bdef537ddb5c10b6cf7fab802ed26b4c133fb36a588688870c83a82d58b400000007a108611bb8814bc87dbb29052a1f74a9f560969d693ee8b3f3364582dfa1b238b7fd9aae89adbb6bc03071eef5009e9bdff3b38d87dce0b4ae3fb4b1ea20262	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000adb7838038de73aa857a6f6cd5279afaf11a4ee103603c0f4849609209873365000000000e8000000002000020000000d2c3e0f3322f233410d8369f375ff42e994fd7cea5e74b9aaad563a09d9a2ca190000000ee3726d76098076eb2ecc799064b4be93eae2c11370dc78e4dd3b1062f166565f890792835a4c7da829f9fa081bdd87f405957fbcdaf2ba8adb501fc09e3ad1c69486b72813922c931e5b519b37ebf3f2981a56f1c85eeb8b591a901abed6642314afbc8a1bf82c8dbae4e96dac15e168e70d94a3fd395b58862efbdd92d0b3b880c6b9dee088deda02aede605f24d9740000000b81e4e1b6d7155f0df6974651b2585c2ac69b313008a982c222895d22ad2d54fb9128640dec91ef29be330167d78b5038800840a4db7010239aec9e43451ce35	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2736 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2736 iexplore.exe
2736 iexplore.exe
2268 IEXPLORE.EXE
2268 IEXPLORE.EXE

pid	process
2736	iexplore.exe

pid	process
2736	iexplore.exe
2736	iexplore.exe
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2736 wrote to memory of 2268	2736	iexplore.exe	IEXPLORE.EXE
PID 2736 wrote to memory of 2268	2736	iexplore.exe	IEXPLORE.EXE
PID 2736 wrote to memory of 2268	2736	iexplore.exe	IEXPLORE.EXE
PID 2736 wrote to memory of 2268	2736	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\515699b64c0e719d2fbbc228b1a8c1ab_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\515699b64c0e719d2fbbc228b1a8c1ab_JaffaCakes118.exe"
1⤵
PID:1284

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2736 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2268

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
8cdd1b3251435fe22c59fac762cba8bc

SHA1
e3908b452f83dded6ca8caec7ce0be5bf3436fa6

SHA256
06b17fe25f3625ee195772b8001165b5dc8538a6fd738169f2d71943a77398ed

SHA512
b1e183b860a69508fe58cda333c6a47a89fe59a76e9e509c726afcdb9fd79faec3010afa1e3285c715a02ec8a6adb50d0eb93c22e7ec268117f3fe636812dde3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
52a709b09b32d727cf83c2516704d5e3

SHA1
53bb83750811cffcba640fe2b13455fb9df1b6d1

SHA256
ed933d43a50faa994815691ce9037d3e4db677dc49bd75ffe200fb632235ea6b

SHA512
358df1f80040b6771885b88f8bc5384049d9cd6ed8614d78330779383e58db116e4a4d9757615146632bede0865f4e0fef8939955b12601cb536fa35121b4ac4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1e4974dc50a7faa61786468c2781f9ad

SHA1
ecc1ebd8eeb845670c750115db72d49f0250ebc6

SHA256
e43029d2b850ab2968382ddc3182dc98936ee4bac7df73f6286bb036ea1fc01d

SHA512
9fb6a5fb148c5e04bbd17bf3fa383875bec37517f84a22560dcf8b56a18dc2351aa3a59ec540c7e52ec2ee50f8104fede08f2ac9347f4672fc4c8dc0fe16ca71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ed51bba5a9603e3ba753e94b918689c4

SHA1
ec1456aa2d1375bc25ae04112fe16158529b695f

SHA256
5b81637ce1962cb828a292e980538062f2351c27933ef7dad6c010fc846823db

SHA512
6a2a2f69ca3579c974ada1f47a0fcf924d845cba7b5a72fd0e57563e740a9403947f0af55e3b330c4e5fa4e6b22e4553b612f23b6bf0a8e300361cf916a54aac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
3a2b85fd23d4f8f7394aa5392925a888

SHA1
64637f900cc4d9440b39f76545479788d48f00c2

SHA256
f58d118e019059bbd9c518477e9ea3d8f54d9fb22d03bb58a2185741a82212f5

SHA512
83b913474a92fe403ea7a58b254cca70e9e38f9b6499fa585ea4914dd1c60fb81e9a3668738dbcb23f940e4ff0a0199d4c2df4d9c204ce53682e412ddb6f6987

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
062ff45889509e44e469e12aaacd8aa6

SHA1
c791ac4175ce4edbd17c058d50cfca639ea8de14

SHA256
50be25e8b772241570cf5c6ea2fa2acf5b7a4dd825455bb49e10d334316566c8

SHA512
5eeea9794a03825c295b48f7a0a46cdcc95fbd9d587d2532ad4e47cf75a37d5b2b7959f238fb3f5b669e91c2d1172773f62829d1dcf29c0876c9c839e29760d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a9148913832f7ff8472fd28bbf465c2e

SHA1
c4cce22d4d84fa96a8e1f2dd03f438a68b4fcabe

SHA256
92bd3b723f59d96c5543fbc348063498ae016366cf1f9db21132443494f9e21d

SHA512
45ef98d70531aa6e21e8d76af3992a0a7549080805365325b88ac4cdee5a9d4f0c2c2d361afc84e8096d0a551e5d999ca7e6957e4b4ddfebf37863a101e232ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
16ea3b94a4c0b5ee715739069719a8e4

SHA1
cc6f368550c7b27350fc23d99dd8965ec9497808

SHA256
6dcd7f908bfb8e653ff61f2c13e686995a01fd4f180f17d896cbaa708fba223b

SHA512
77bf885f739af249072d36c60bd77f7f0c5b630f5394eac327b967b35ecfdd374a81d56284c9fa95d0e1d77207f2efd96377e4d991be69021fd360352a1e206e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a592734ca07973dfea3bfb95488214c7

SHA1
0acce57240c924d06b12a99cbb8b6f18365315ad

SHA256
993b4370c471d8fc32cfb4f4b4db4c4733659f741ee5b2a1c5b141fc07d63b38

SHA512
7238aaca76ba76205a33b348210bb1c91774455f3be61c786058ee2e1ff5eb6f3adc6abb0909e21b3be8ea45c55656dd28e9013c2f3ea0fcbeed124f1812de06

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBBA3.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBC05.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
memory/1284-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1284-11-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1284-5-0x0000000000320000-0x0000000000322000-memory.dmp

Filesize
8KB

Download
memory/1284-1-0x00000000002E0000-0x00000000002FB000-memory.dmp

Filesize
108KB

Download