gozi | 32e22f05b55a48bc256025d5c3685f4d12538ebc57e1f4a5e8f3bf449baa40f7

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 05:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d2548ee9d87575e384119c8b19390b5_JaffaCakes118.exe
Size

269KB
MD5

9d2548ee9d87575e384119c8b19390b5
SHA1

7ba5159ab3561ee7758111ea3285dafa82aceb61
SHA256

32e22f05b55a48bc256025d5c3685f4d12538ebc57e1f4a5e8f3bf449baa40f7
SHA512

6e3f7da3a9a02700a9118853797916ffa25d8b6e0ead4eeb480c30cadcb91c4b85079367d102a0f1da44ddda7fd6a0df7ae155ecf0e25ac8c9d20054ddee06d5
SSDEEP

6144:ZVfmmDgASD5W/adCxsT4/YFqBcIsBGOhN/35:ZVfjDmtW/adCC4/UIsBhN/5

Score

10^/10

gozi 3151 banker isfb trojan

Malware Config

Extracted

Family

gozi

Attributes

build
215165

Extracted

Family

gozi

Botnet

3151

zardinglog.com

sycingshbo.com

imminesenc.com

Attributes

build
215165
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com

ru

org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cf09b8390541cd4bb6a2d18fc25a75f100000000020000000000106600000001000020000000320d2ca6cbdd5062780f2e7970a1cf11924e4dbdbde6d78132c7e9d1f3bb646d000000000e80000000020000200000006add7097671ed767e469aa75396665479125b696fc297ed577e0e70127340f099000000005012f6cae8d10ab52f63646a79771af50111ad7c15aac78ab870a8230df79b574dd730a84e47b62f0fb39686f6de0425ade13a47e2ef7f9ad11cbd6069985c8e8697522066a0797f8b74b026343e30f05f47790e85e3f3e35c023aede0af67f27df17e6e1ace248b10179e8a65488c00cb025644d4dcc8b4de1589ea5a4f1f6ee1a3e8643e930943fab481cebda6aae40000000901840afb23b788b7e1af52955db03203898ce8e19b6f979581a5d31fe042880adf81a2a74b5d6a3f22cef3a86728d99c284d8d5af1638f9212c59f581098386	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0ecfabac1bbda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cf09b8390541cd4bb6a2d18fc25a75f10000000002000000000010660000000100002000000068449ce9c3b56220651db10409aebbd9c72dbdb6e59c5382cd39e320fd93da87000000000e8000000002000020000000975ac039743ded2b17d6920c910fdf9919336cf7e7032f760e010760f95ad3a020000000f7fa5b66045f98a15d1ec73733423ba5d98256c560768d50f98ca0dc1a904efa40000000b28ea99832578c548e75cbddca6b6b484069483e97b2f2ce4f10b016de9f7c6a86683b77ad676957ef90c2cdb38ed5f61bc6d7d3b1e26733840625846bc5d7ed	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E508F221-27B4-11EF-9479-523091137F1B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2772 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2772 iexplore.exe
2772 iexplore.exe
3012 IEXPLORE.EXE
3012 IEXPLORE.EXE

pid	process
2772	iexplore.exe

pid	process
2772	iexplore.exe
2772	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2772 wrote to memory of 3012	2772	iexplore.exe	IEXPLORE.EXE
PID 2772 wrote to memory of 3012	2772	iexplore.exe	IEXPLORE.EXE
PID 2772 wrote to memory of 3012	2772	iexplore.exe	IEXPLORE.EXE
PID 2772 wrote to memory of 3012	2772	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\9d2548ee9d87575e384119c8b19390b5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9d2548ee9d87575e384119c8b19390b5_JaffaCakes118.exe"
1⤵
PID:2040

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2772 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
252B

MD5
ed28a9295f5e06ce55634e0801f09b97

SHA1
e8f42fd032c84d7905733bed21c14e04428c5e30

SHA256
b85e5bbb2de4c0a2c387c0f7bb235ece17cc5b5b032f1b24e8384d63f843deda

SHA512
4ecc86350c0a309823663fd4bc66806af5b69bb0415f14e6a0c86b1a99570520421ea02d65e601e09e49b5ca6c3a4f2d5a4a8c3aa6e4ee6e4cd5884164eab1b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
c71e58fff34b1aceb67456c7f0732f1e

SHA1
0514b8f9e3588c3846c82ba7da59e7bd434480b7

SHA256
d2f5a017ac16e0e6c3519960ed716658d0957c061ec220b9344018449b3d1e98

SHA512
fc9e4a569533d2a5c71b70cae44fae7e5d6847f2054c63629323f9cf4329969e65eba8450ecefc9f98d6e09cba69f18b2a901ae52e3f12f75b6fdd6b21312691

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
12eb97fa1878882f22566d615964e3fb

SHA1
c41bdbd6433679e74cfc2549be660f3300181dda

SHA256
5b527fa83ee43a6d879c5316b608f4c81016774c2d84cc093dd70fa8b2d6a8a6

SHA512
bde2591ff1573561ec5d6b5b8e3f69c90b1f348ea674f47051a6f4f48a94cee25cb68939f577ead979aa7dc1201dbf6e9f45c0621eb441a1ff304dc76d002c57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
dd0c204f2b69c9ea3ec697538ceb1b3c

SHA1
fcf72b07a74498a7c261d246f560c60cf659edf0

SHA256
6bfa52ee9d470eaeeb6e753d83ab6346082cc05235e2e5d73f60813f27f940cf

SHA512
27f7bfbf4ba36266036943d3dbb3cc8339f68b6033fdd363f62c60376204e8abc9ba4e956569e407da108c62f8a5ddf412ca1920ebdf12a166ac8964d54d256d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
5bf71b06afb64802bcf7b8aa8a28d428

SHA1
c785202d18e8a58c8fd429a3928d661841b264b9

SHA256
bc490ccdf64933457bfbaba1a32f429fd2abd8b56979eeac0af631b12ce0e9d4

SHA512
ea5028dd5ac86c1779ecb7a1863d410121c2b8b404907ab70d03c7d2abe1f139cd9de54fafeb6cbdfad8f0107d71f73eb0f169e674f4c742579b03767167ff84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
34ae2addbc7ada952be7161591685dbd

SHA1
234f0c6b327fac52e92b0558b62def3b53f24e55

SHA256
c1dae1ac1747e01edfc0a681e4326e027e7468dfb49e751e7f1d54acdec8636a

SHA512
359026f388067a16e920854f923f147f00aa18c8ab82e50b4a5ff611aa95e3d51b7fb94e50518f3bb9884ea8424f9136dc67560e971bcbbef44b699e2c2d9ffe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
c068d9bc303e1bc72e9366f1517c185d

SHA1
ef8795c98af0a3d249d4dbf02af5c9ab0d135ee7

SHA256
c2998fc04ac16338d1f8463b4549d73d5d2f8e5dd3673978138cb17e148c7c42

SHA512
b3fe45a8f892e25a15f1033ac35418882b33ae1e83906694eed2d9f26d347c8d7c40141005218a8aef8f312d132d33532827e84ecd1cac35d3e3a1e794b619a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
3a283f6e5a185c676b931355c6b4cdeb

SHA1
5c31a928d3d06b323987501fba85bb2832a1ed08

SHA256
a2418e9b862a682129636e6edd40e69b981e77462e3e685c2d726b4502929c33

SHA512
92acf0cb3f84e545b6477acecc48b4e453034c3780d5fb572453689d7a92cf2196ca701a538be261295bdb88d0936098a5ac34b772bdbe5d58cdecb30405c93b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
50378f9e2c76b5a1f8026fad7c0b7d1e

SHA1
09d6361612d61631688916c2dcda9aa9eccea532

SHA256
c5e85374c86943fa01b9fb6cf7fd0aec9791bc91a1672fbdfca9611348d33764

SHA512
c1d837d0c9f1d4f7eb407591b917b424087c58375a6c188ca0ba9cafffc59e7521c70ad257f5003c69c6ed3923ee8255525fc90cc2179ace3ad6dc3cd9520afd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
bd276564f459a0e09fb91a596a3d416c

SHA1
ca7103d0b06a75bf2023e82b3bb3806b5eb9e80a

SHA256
fb0e1b774f11beb998f2572168acf6d58b5cb51e729139897b70c9b527227dd3

SHA512
fdb952b2143a6eb62e54bce1ab09acda0d505ddd7dfbf372da5f8aaaacdd4ab1e624c2230cb9fc8e1a002749b2c3053b9ff449c30bad056a73b455eabc7be095

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
0807f5a7b8f7dfad72e9a72e4f1d18ec

SHA1
277a44fe38050060629a7cf31992e6e99a34b70b

SHA256
76ce4d4f881626f9230970f90464bfdd190a196229a09c174f5d788efc7fac1f

SHA512
789e17162153a4d010d3f72d988f25c8ed2982823c38941e4f2d22c3384ac6bfe476223666f683cfc918989a1fca72eded6688eff0ec4e3d1f44dde5dcd2381e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
adffea79f788f4ac9ddacb114092e67d

SHA1
2ed0b4f917581bc760b98a0f7991bbacd87316d8

SHA256
9c0e470fbe1e8849e7373f3d0468f0c037f78f5e2580b5896ac49366d88f74c7

SHA512
8456a545701ad6ebe7e43fe1d06514cd8e3fae05e15b1426b250801f3ad20a59b5a0043389101f3edd53717e845d2b27f32de993b216cb717be6e9d997fad241

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9247.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/2040-2-0x0000000000180000-0x000000000019B000-memory.dmp

Filesize
108KB

Download
memory/2040-1-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2040-0-0x00000000000B0000-0x0000000000103000-memory.dmp

Filesize
332KB

Download
memory/2040-6-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download