gozi | 33b6b1e5d890bc458a7eb8bc22602e5d6c75b147645722c30b917a70b44f9a0a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 11:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9497326cb1d85cadcb428912b8029072_JaffaCakes118.exe
Size

215KB
MD5

9497326cb1d85cadcb428912b8029072
SHA1

07b236e7ab0028c7884d5ad1f4a3e045a4abdc16
SHA256

33b6b1e5d890bc458a7eb8bc22602e5d6c75b147645722c30b917a70b44f9a0a
SHA512

80782df91bfe9f6093dc1cb7b7a6984303c52e1514d6e69364e98b237e8e93b79a44907fa3dc9e3883e563d16008a597df85f39c8609cd4d07faaa65ffd03169
SSDEEP

3072:Rb9pXDyUKdySqVgQZt8OdcjFfSvbke/0t4mwqWB55syoNdL0N2L6BWnqR+yV:BHXDy1qVvZnOe/HEyooWGd

Score

10^/10

gozi 3153 banker isfb trojan

Malware Config

Extracted

Family

gozi

Attributes

build
215165

Extracted

Family

gozi

Botnet

3153

biesbetiop.com

kircherche.com

toforemedi.com

Attributes

build
215165
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0D76F571-2262-11EF-8840-6600925E2846} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000070b9c55d2a62c34aaac475dfac03384600000000020000000000106600000001000020000000aa5514de7a13647782e92f54898e919f8f6afd103f9905a8e2ec3eafb87b65c5000000000e800000000200002000000068c13b63a28771ca5a754a720c39a11e28dc9ece82c2138c53936c461920c62d90000000398327d11487c52fb53da8ea37e35be6c24d7b73e10d372823beccbc87923c4f15f0d3a3732b4c031b2bd72f77f5cfe4c81422d28c2ce17d4de8f8952b87e87cea358cbb609a4db8d0572a8f40e13fc7dc531e28b027255d8681e776cea2fc8d2290b6a53837dfdcc73fa78946a6f2dbe827b69dabf823a01614fb9641bdb42283fb8c8bd8dbab21583dc4abae485d9140000000d2ffc08ea93c1262f18fc8bae98fe2b6bfb94e1a0d69c335a90d6b247e6a16d149547dc14b6997244db5f438446d3cfb8ecaf688c1253bf4afbd5c9e04d10010	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000070b9c55d2a62c34aaac475dfac03384600000000020000000000106600000001000020000000ea09a378aecedc193287d717d4912036aa6c31c3c8aff1cc6deb9f4beca2fb4f000000000e800000000200002000000057b0dd09084df9f3052a4246b99678288c6fc15c29681c3ea7df4a2144a9508f2000000098689152da91880612402f35407dae03c1a54781cfcde1239261d7e591b41d884000000015960740c5f61736786c782550d4186e912f9a0434a29e11e8d399f62adb1873d9ef3432ff400cb0bc68dd28dbfedda3d79a94dc14c83df689d57bd96e5f2e62	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80d854e26eb6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2548 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2548 iexplore.exe
2548 iexplore.exe
2580 IEXPLORE.EXE
2580 IEXPLORE.EXE

pid	process
2548	iexplore.exe

pid	process
2548	iexplore.exe
2548	iexplore.exe
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2548 wrote to memory of 2580	2548	iexplore.exe	IEXPLORE.EXE
PID 2548 wrote to memory of 2580	2548	iexplore.exe	IEXPLORE.EXE
PID 2548 wrote to memory of 2580	2548	iexplore.exe	IEXPLORE.EXE
PID 2548 wrote to memory of 2580	2548	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\9497326cb1d85cadcb428912b8029072_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9497326cb1d85cadcb428912b8029072_JaffaCakes118.exe"
1⤵
PID:2268

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2548 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2580

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
a33714adf121349a99b39e868e66d344

SHA1
d8c66001a695ea478e2bb41aeea145237947bf69

SHA256
3b698d4bf20381b693c1584c630751dc264f2f624a963f7f1b8d22cfac83080a

SHA512
20fb4243349dee872957a8061b4fc622391a473e464f69490fe408038cb69022749755524808c912bb477f856649161986b7b36ea0dcabe8b6f2c9b57a80baac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
4fc06ec2a59720a363017888de972c50

SHA1
05a50be5d342031642cfdf05f5c462c4a186be84

SHA256
e9c1010c637aa396b0fdf847030773ada753d43c7c09f70df8b34e43e788c03e

SHA512
24331fa1668e24872fd8c5bf908d4d9f2cdfdc8cdf894b5d05b1f1bccd227191e93007475ad423fd0f987a5a3f833f5accff5383ab991fb1941af885f988008b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
a603208fc0297585e3146eda596751a3

SHA1
d4bbc12700ccfa1b553fc801334820bcd90a4d64

SHA256
4a41823b8af817fa45ef35377494877b856e1f6c812c7b5da6e131cd774db13d

SHA512
f8b12339f9730d30d3b7aa424c218d31225987599fc92baf39115ece609bda16f7491f1cd02e2711291a369ec8c2ec944b06c9f91c4896d8b12367016bfc200a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
ce47b1ca4982e2534077b87aecc1ac23

SHA1
92dae5020ee34bd737f3c9afe8890ef342908d2f

SHA256
a7e0df69a9af6236fb3449630d07eeeb0efd0664dd4ca2258d1d387dedb9e314

SHA512
0dfb1c2a95deab1ba7588195648d1cefd6e25b1434c966c84c46d03d02f5acbdfa4ef05604b91981308cd1a4f5fa7d79c8d5acd8c1d738d9f7f5d0fba90388a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
503eb9e9204319b52c10bf085a6b3278

SHA1
0bb8695b6e8d2e51d7ee8401b32aafec4ac30110

SHA256
03a044e66a34af4833da33669268eec15fa989b06f6543f683726182e4e55ff2

SHA512
3f4d4955232519c74119f3e32d37a0d0c1ebb66cb6e37c7dbfc464f15834d871094ae57d51fa168b729e0803575a04bc5c35a375a5ee68147ef9c7777068c3e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
93a2bf96964145fb96149fd070cb347d

SHA1
456deaa025b880ab750bb13da76e5b5b6272b909

SHA256
ba7f3a9eb79d95a018309fb9e3edddb928a76f942bc493c50514555b5cf13113

SHA512
bd413a6ff045114fd3e2c9f5e8dbcfa7ac990a1547c430df9fab37df7d7ecb7255f63b74542f8bb249a5f0b02380478b34e98505bab8c2ae1dcbc436da7a097c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
6ff57d2e257cba40f68c56cc7efe8635

SHA1
433b1665fc256a62a8b1c33c20ef412bd45af230

SHA256
e4c6a743cb024026a56dbbbadbd8f0daa0a745771b4c9c0e851cfd23b7a89c4d

SHA512
fa80e34907e1897e7aaf5f67b5e231a03ad922f5740962ec8b503b3e5eecb470e80faf8b707b92233b44060945264cf16723a4832c6b790eaee7c8c5c823b080

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
bc27d7f471023e5ffbc5dbf19e48ed92

SHA1
19c8bcf030210ba66999f131c8402da2fffd25fd

SHA256
286c6408adfb027a7292b2b254fffd3a371da8f0c1be7f2777ac3756a4f7c0ae

SHA512
a703aa2e5aa42998f098e333c2fbd5ed07413316d27db29bb742dcf379f28d4b8f43268ed5b78a92aa753da31f7fb3f7fd0e2f8d6c33fa86b92d317f440ae0de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
7f7fe4220ce6fa5ff4a1c337b630f3cc

SHA1
f12be2153fccc1611508b56751c85dcb528d2e8b

SHA256
79c6896112eed8ee9b7e56f0334de85f415033bdbd19eb266e967cacab136ee1

SHA512
113c705cdc434b1c08ee3b7cfa1a145905035af0e06841146660e7baee12fb469beece09acbd506e6451a1b0e1bdacab15e7b104e3a76d82521e272d2b47984d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9770.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9882.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/2268-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2268-6-0x00000000003A0000-0x00000000003A2000-memory.dmp

Filesize
8KB

Download
memory/2268-2-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/2268-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download