Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

e18f4e3a6b...18.exe

windows7-x64

10

e18f4e3a6b...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/09/2024, 02:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e18f4e3a6bce5cde83fe10e2bd4342ab_JaffaCakes118.exe

  • Size

    201KB

  • MD5

    e18f4e3a6bce5cde83fe10e2bd4342ab

  • SHA1

    7b187849c9a30851e32425a6c093dcdf3663cd8a

  • SHA256

    755a5e7b70f95cef2f6aaa2110a3e9ea4d8b582f693e247ca81e03eb57eeda0b

  • SHA512

    48392de9828f352bed05befd8497ac1ab4e92c39f72e1489a9705f3da9dd7a507630f64769c9e60dc6fbd7e32fc9f6c301bcfd102d460396809b858053e5b04f

  • SSDEEP

    3072:T6gU5AEvVUVFmbiEe/AKKkFkOO+kAWXJCTdwxQJaE++SqMHcuxZ+rNwoq:+hysilAKKk6OORAWXJeF++zy0S

Score
10/10
gozi3126bankerdiscoveryisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    215165

Extracted

Family

gozi

Botnet

3126

C2

cochrimato.com

dinagetter.com

alogencian.com
Attributes
  • build

    215165

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e18f4e3a6bce5cde83fe10e2bd4342ab_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e18f4e3a6bce5cde83fe10e2bd4342ab_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1724
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    PID:3420
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4712
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4712 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4780
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2388
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1980
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3516
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3516 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:3020
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4768
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4768 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:552

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\~DFC54F0E087C096F28.TMP
    Filesize

    16KB

    MD5

    0832921d4e25a5cd5c95939a7aadc711

    SHA1

    038f83ad13e1463edb2a9c4a23025744a650fd07

    SHA256

    5a69f1b2e9950547f49b9858331b1372e013d7a9be35f0f3451aac3d4a02d0bc

    SHA512

    350fc6b42d711eed9efbc0b7163864284290af2d2c9cbd592726d79603848c70bbbde2c072420ade5babfac79825776427659e975f52352969bcabe90356cd54

    Download Submit

  • memory/1724-0-0x0000000000540000-0x0000000000541000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1724-1-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

    Download

  • memory/1724-2-0x0000000000660000-0x000000000067B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/1724-6-0x0000000000540000-0x0000000000541000-memory.dmp

    Filesize

    4KB

    Download