Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

e10694ccc1...18.exe

windows7-x64

10

e10694ccc1...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/09/2024, 21:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e10694ccc1f5745347b999fd9175ea21_JaffaCakes118.exe

  • Size

    355KB

  • MD5

    e10694ccc1f5745347b999fd9175ea21

  • SHA1

    decf1f005ca5e5fd598c4d7045e5faeebd6f7847

  • SHA256

    5e09e5ca1e6acd32a4f5319944cc80edfb9b5f9b1a6dfbae8b6723b3051a22d5

  • SHA512

    17700476852449491b10c154530a516e8a6162a846cc2accda151370846eec45207b39e9dc1ad7d0eb966f9769f62da989f96c569e39eb45b2aaf02a87bdcbf5

  • SSDEEP

    6144:Z2PfwMqVqOnmWkKrlAUNqNCQzH10YLplTjGePo1nWT/jiVIgn:ZXMqVtn6Kr2UNqN7zH1nnPQWT/GN

Score
10/10
gozi3431bankerdiscoveryisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    214085

Extracted

Family

gozi

Botnet

3431

C2

google.com

gmail.com

zuoashlyc.com

x4fwben.xyz

rreynold77.club
Attributes
  • build

    214085

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SetWindowsHookEx 20 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e10694ccc1f5745347b999fd9175ea21_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e10694ccc1f5745347b999fd9175ea21_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:3120
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4588
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4856
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4856 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:3944
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:320
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:320 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4060
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:968
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:968 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:3572
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4644
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4644 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2380
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:904
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:904 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1588

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JACP9GNT\googlelogo_color_150x54dp[1].png
    Filesize

    3KB

    MD5

    9d73b3aa30bce9d8f166de5178ae4338

    SHA1

    d0cbc46850d8ed54625a3b2b01a2c31f37977e75

    SHA256

    dbef5e5530003b7233e944856c23d1437902a2d3568cdfd2beaf2166e9ca9139

    SHA512

    8e55d1677cdbfe9db6700840041c815329a57df69e303adc1f994757c64100fe4a3a17e86ef4613f4243e29014517234debfbcee58dab9fc56c81dd147fdc058

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JSDV0W5M\robot[1].png
    Filesize

    6KB

    MD5

    4c9acf280b47cef7def3fc91a34c7ffe

    SHA1

    c32bb847daf52117ab93b723d7c57d8b1e75d36b

    SHA256

    5f9fc5b3fbddf0e72c5c56cdcfc81c6e10c617d70b1b93fbe1e4679a8797bff7

    SHA512

    369d5888e0d19b46cb998ea166d421f98703aec7d82a02dc7ae10409aec253a7ce099d208500b4e39779526219301c66c2fd59fe92170b324e70cf63ce2b429c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\~DF9B912542CC81A00F.TMP
    Filesize

    16KB

    MD5

    5e7a61619d67da014be85c8d363f6746

    SHA1

    46293eecc569f804e93e09b56275d17b16c45086

    SHA256

    f2bce21a7c815c220c7ade8611495a01627cb25bbb7363cbc9b31247af441a3a

    SHA512

    c1244c18fe7c78837110571251919c27a267a67f82ee9ebaf23d5db67e77dea5b66817637e495cf187a066c56a87ad34374558be6c79a094b147ee41df21956c

    Download Submit

  • memory/3120-0-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3120-1-0x0000000000850000-0x00000000008C3000-memory.dmp

    Filesize

    460KB

    Download

  • memory/3120-2-0x0000000000CB0000-0x0000000000CBF000-memory.dmp

    Filesize

    60KB

    Download

  • memory/3120-9-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

    Filesize

    4KB

    Download