gozi | 314a830ad7d4517424d5c5d0953cc8196a363b6188f10a7a044453b1e30b1387

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d8fcc66026f4185de0ad716a7578f0e_JaffaCakes118.exe
Size

269KB
MD5

5d8fcc66026f4185de0ad716a7578f0e
SHA1

014ac956874985d81de3b935f5245637337eb21b
SHA256

314a830ad7d4517424d5c5d0953cc8196a363b6188f10a7a044453b1e30b1387
SHA512

a326b7edd6af034f481b1554b2de1a6c816a1824fa28164823c63c13fe3bc1c5b335cb376f636ac7ff06a0640a1fd455acf84cbbac8e7a32a350d1888e8aace0
SSDEEP

6144:OVfmmDgASD5W/adCxsT4/YFqBcIsBGOhN/35:OVfjDmtW/adCC4/UIsBhN/5

Score

10^/10

gozi 3151 banker isfb trojan

Malware Config

Extracted

Family

gozi

Attributes

build
215165

Extracted

Family

gozi

Botnet

3151

zardinglog.com

sycingshbo.com

imminesenc.com

Attributes

build
215165
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000009a51d34b24d5100b42f14dc0501e45300de3a29ee87f7a3c7b484c7a078ddbf5000000000e800000000200002000000044ac9f6082b705a12ea24b33ef2a05dcdd526647706555d65a66493c41d083869000000082dd42c6438b80b671371dbb5f27ea7f9aad91c4a224d6daf7de9b0b9ccb56f68a318da743e50462503020e1cd3a4fdf0961427a6d9661bc2b7b7222f001f044641f4002502c126f70d8029b3169e3438134bf3b95dd1e1673994eacfacaa6061fef238bfbc7c6af2ddf777d31d434a06466d1dbacdc7e5ddafe186a5c1c9e73335bca4a172bc9532afa46705b4694d6400000006fe9b1f7288c0ef3f557a28ca3fa5de8130fdd6d568ea5e5a44f166cb3801ff2ef8684d25379d6d8d3460742b0174760928eceaed83b97641658b40f0d0527c6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000047445e4c2eece560321d131f1b8128bbe3ee940377b72c33f5a50f2661c2c0a1000000000e800000000200002000000039c064f68f0c642fa884df669f5c98db94403415b763f0f516ba865a885c6acd20000000068fb8a3007b571d582da955b770d6e87c88452ebace090540aa1c1a5daaf11f4000000027a2c40961cc52e323da830fe1f1f90efd86d8733a48424add25c50e26bb15ec970604760fd1726090fccd101caea4857de0656b84e06d40e52a7e9c9cdb106c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9C83E061-166F-11EF-9511-66DD11CD6629} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0dc1e737caada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3040 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3040 iexplore.exe
3040 iexplore.exe
2580 IEXPLORE.EXE
2580 IEXPLORE.EXE

pid	process
3040	iexplore.exe

pid	process
3040	iexplore.exe
3040	iexplore.exe
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 3040 wrote to memory of 2580	3040	iexplore.exe	IEXPLORE.EXE
PID 3040 wrote to memory of 2580	3040	iexplore.exe	IEXPLORE.EXE
PID 3040 wrote to memory of 2580	3040	iexplore.exe	IEXPLORE.EXE
PID 3040 wrote to memory of 2580	3040	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\5d8fcc66026f4185de0ad716a7578f0e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5d8fcc66026f4185de0ad716a7578f0e_JaffaCakes118.exe"
1⤵
PID:2220

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2580

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
328428d3c36e5ec2de967e377b7f0578

SHA1
68831af6e6e7d54c781b0e79f047153a6c7b2a92

SHA256
654543192b2f3ea2637bbb129ea50e1a3236ab6234a836ee64b8477a4ff08ab9

SHA512
fb3e1f83ff7f1f390ee6eb8157dc00e8e4d735ddb7d90264d21c4fbb3740fde74a9fc0c1c27efe6e4c6616288b0d9769d3307192c15dfa8bc371f3f511cc30f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
251e27649d33ea6e7688f359ba6b939e

SHA1
4bf6f58b6f2f4dce2f5069b5bab790dcff9862bf

SHA256
0cc2463eaadb420aa1f365a8426e8e3895cc8a20f559fed4afb952d457882020

SHA512
eaba05f77cb1fb905919db54cc15800a04ee519f7d6a51212647e88a0a1dc8d392f46324d00fb1ee359eae086e534566ec2b182933f10e510a152c3738189eff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
acfbb0fa93dc0533c8571f217dc02361

SHA1
c6c8bd779e14bf3600f738b8a4f722433bbcd9d9

SHA256
fbaa3f520d94f74db878ee999e787215871a935b476dd86e28f010f05b14cada

SHA512
1d9e9dc60a241d0ba88d0752a2e3bba4cf0d598bbf6775171278d37c222c999c070fe6914b06e3cf856c083122cb822607bbcf095139681d2ef6a52a6a0cb237

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
54ffbf0511534ef897e250b4a0af64b8

SHA1
9e964f057f9770cb3bdb964d22f4b1aa3863f08c

SHA256
04582b1cb51c5a5b350450a20c49d25c0b94c1f0af3b052c947ddef7e38e5768

SHA512
de78c705752a37a929a029caaad66eeefbdec7475c376cb7c51c2959a7c8d2fe28c1ff2ac30ade53e7f4c948cfdfe68a921d09beb2655c3dd538bdab24c1857d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
db4988d5b52a8abed2b4779519819e62

SHA1
9d264d739272e67484da01fe9f31089e46f92702

SHA256
d756287ab4f003fda8285be026630b52d7dabf59d1be6170436234a8bd79de03

SHA512
e968feacdbf1301df2492b31c05a0d539b34f6f056972899a1f5396378220426128b634ec56d933d9c05698b775e3f00f6968d1aad576d10d0898870048ad2a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
50ea462089043966dc81f625132cc145

SHA1
8447eda357bd095f529ae9bdd35418be21a7ba86

SHA256
19e3cce7237278e23e88e606a91208459e9262d02651250beffc98f57d329f76

SHA512
7bf5444717b812308c7368b2298861ada2c01a2695cb50a262bbf4febe803ffcdd89d41fbbecfc3f448f65cbe5f28a8f722fc848d732ad31d1b14a1b8d7814fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1ffa4251ce3c64e3f088c89b3f8d46ec

SHA1
5eda9b74ffa65a3d551830613641eade862df0c6

SHA256
f0abb082b8c5b7cb56a09178456445d24a0fe083079b4acdd4e568477902c1ef

SHA512
15fa74ebf4c59e1bf695f3f2c877830f80a35f9c6d80ab427a7043a6bbbecfe92039fa66910c09943be2b0549eb50df31fd09873b4ad083ded530f15c91571ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e5cbfca0f0890a5d4518d3dd1b7c5bb3

SHA1
35e15b1aec4afda12281fb95a936976357d9da08

SHA256
1eca60923e843f9cf8a0acf2c8a9b1ed02a73b94b880fbcb660d44f2767968f0

SHA512
300d01760d77ea2196c150ae8ab39322844f2cf650e45eaea28ba8b67b4ffdd7b57316e10253a30574ceb51a0295ec54826953bfc18b623a9c4286eb041dce0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
bac186e6f9d8e372f7dc1f96b7f5859f

SHA1
914ea975e689b30235d5481dbceeca8098e8bf39

SHA256
645a4d008c89ca8b5b61ab5afa116d7f5c27a228cf4bab01c7e0eb59bdb4374e

SHA512
35ea09d819e5c65d2738b0333764d8e69f92ef89e4143e7416a3c050d254c8edbb9cd0268ab75cb882ff4057b7691e8ddea731dd608ab3a760cfbc429230ee32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
6056acd0d22458479fc04c373a951298

SHA1
2a52743e7f4fd5e08d6bedb15f50bb98aeeb5d72

SHA256
17264fbadea3e4841ba1c85d6a43228c13acd1cf99fe429cd1e4d7f866cbbe02

SHA512
64048a5b3c1ccd73e07c88edb81b925ef8b00ed06f0573d0550a0029d352a9ee4c94f4ce00eb1b43bc3510901b6ada8e64ad80c131398a3197c1cb0e8d6d36ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B46.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C05.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2C5A.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
memory/2220-0-0x00000000013A0000-0x00000000013F3000-memory.dmp

Filesize
332KB

Download
memory/2220-6-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download
memory/2220-2-0x0000000000160000-0x000000000017B000-memory.dmp

Filesize
108KB

Download
memory/2220-1-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download