Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-11-2024 07:51
General
-
Target
8a60f22c8d18cdfbfe84b56a7aaa49da_JaffaCakes118.exe
-
Size
8.1MB
-
MD5
8a60f22c8d18cdfbfe84b56a7aaa49da
-
SHA1
7c8b05826c4f7c65fab370eaf141f54651f3907c
-
SHA256
f8edc9e3b84fc1a98f70b9bf3b68f86baed4e04b7daf7b70d1ac5820d6ba11e1
-
SHA512
50539e668c1a0c2214ef77f5abcb6e3d1bc59555962a46e6d3fa271fbed0724c4673fd3c9210634aae7754cb9049d5431930e7cc0952a9fe3a8d82a8fa1de825
-
SSDEEP
196608:LCK8Iwvgsb87DwQiiFFL4an2L/dfXaI+fVcZ:O93Stl4LL/ZaI
Malware Config
Extracted
gozi
Signatures
-
Gozi
Gozi is a well-known and widely distributed banking trojan.
-
Gozi family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Program Files directory 36 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 52 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 14 IoCs
-
Suspicious use of SendNotifyMessage 13 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a60f22c8d18cdfbfe84b56a7aaa49da_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8a60f22c8d18cdfbfe84b56a7aaa49da_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\cexplorer.exe"C:\Users\Admin\AppData\Roaming\cexplorer.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-SSRT8.tmp\cexplorer.tmp"C:\Users\Admin\AppData\Local\Temp\is-SSRT8.tmp\cexplorer.tmp" /SL5="$140050,6397385,121344,C:\Users\Admin\AppData\Roaming\cexplorer.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Chameleon Explorer\ChameleonExplorer.exe"C:\Program Files (x86)\Chameleon Explorer\ChameleonExplorer.exe" /trialregister4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
-
-
C:\Program Files (x86)\Chameleon Explorer\ChameleonExplorer.exe"C:\Program Files (x86)\Chameleon Explorer\ChameleonExplorer.exe" /replaceexplorer4⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
-
-
C:\Program Files (x86)\Chameleon Explorer\ChameleonFolder.exe"C:\Program Files (x86)\Chameleon Explorer\ChameleonFolder.exe" /update4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Chameleon Explorer\ChameleonExplorer.exe"C:\Program Files (x86)\Chameleon Explorer\ChameleonExplorer.exe" /update4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
-
-
-
-
C:\Users\Admin\AppData\Roaming\update.exe"C:\Users\Admin\AppData\Roaming\update.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 3443⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2416 -ip 24161⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14.4MB
MD592a3d0847fc622b31f2d0c273a676c0e
SHA1e642d694367cc98a8863d87fec82e4cf940eb48a
SHA2569a9923c08d3fc5937b6ed189e20cf416482a079bc0c898c4ed75329e0ee3ae89
SHA51201d13fd9a0dd52bc2e3f17af7a999682201c99ecf7218bca254a4944a483fd1dec2a3e6d59def501a024ad760b849787902ecb55bd33d23fa9651c0a7689cd1c
-
Filesize
4.4MB
MD55b0ae3fac33c08145dca4a9c272ebc34
SHA1940f504d835fc254602953495320bb92456177b9
SHA256137723bdd388f6e5a50b7942eff02f4cc70e6b86d8650a41f9e8956ea1e4de3b
SHA512015ffc133ad3a6937222bbc057f68b60abfe22b900b5e7c4e6ca3ec7dc6b09abaf54b595f00fa9212f370da8531af1ac5fc52b39953e1f685e81c66d1ec61f8a
-
Filesize
786KB
MD5dd5ce4d765edd75eba6f311e6e0ea10a
SHA19ea7f6516e5ad0755b74463d427055f63ed1a664
SHA25664b7f8f70a7b037d10da72eaa769078b7e4d1ac8964c5eae5515d373e816ed6d
SHA512d2782310df7cc533cc9ffaf5c1903d5bc6a500c3bbe48148c1339fb5de19c835e4a8c765da1b80b3744ea231353f76f22ba4e04c78a3d950d7ee291d6eab2216
-
Filesize
1.2MB
MD5de5f74ef4e17b2dc8ad69a3e9b8d22c7
SHA142df8fedc56761041bce47b84bd4e68ee75448d2
SHA256b89a6a57b48be10103825440d2157f2c4a56e4c6b79ad13f729429cd5393bf32
SHA512515e9b498d8cd9bb03f8d9758e891d073627dfd6fb0b931650a47d6e53722aa6e1cc3caff8c0e64f4721ad2abef7a81ef4e7b49952d3c8fc325deb5bba6b3314
-
Filesize
750KB
MD5fb76f4f533203e40ce30612a47171f94
SHA1304ba296c77a93ddb033d52578fcc147397db981
SHA2563de05f18ffe9fda589a45ea539a464e58a30f70d59d71444b018064cf831c4a6
SHA512a416a6d6efbbd69209e1867f12b9d1d11b21160f6dfe07c510b43112c22c317f805c67dd9402744a6c7e1541f6b3a061c49942fe28fa70f74aea670ba9c71995
-
Filesize
1.2MB
MD596f92c8368c1e922692f399db96da1eb
SHA11a91d68f04256ef3bc1022beb616ba65271bd914
SHA256161408b86eed7c4d9a5882aa00df3f8765ed28fa4fd9aab2c9b3dceadbd527f9
SHA512b3d3fb2d78fe2df864f0e07a8bc1610ee9d65251957e0495a34c1631895293590e0fca965ec9deb160f48a4e09a2feabd3bff6fb9a0c22888a941e308de39d14
-
Filesize
1.1MB
MD5729bc0108bcd7ec083dfa83d7a4577f2
SHA10b4efa5e1764b4ce3e3ae601c8655c7bb854a973
SHA256b1c68b1582ebb5f465512a0b834ccac095460b29136b6c7eea0475612bf16b49
SHA51249c83533ce88d346651d59d855cff18190328795401c1277f4e3d32ff34f207d2c35f026785aa6c4a85624d88bf8c927654907faf50db1d57447730d9d6ac44c
-
Filesize
6.5MB
MD5d8388140b196952bc419141fa07ac0c9
SHA171e6f4a14964c39a9b827479ffe90ec07b9145e3
SHA2566d77ff618ac5c4306dea8f34e66092e146f172570e88a3ac05166068e5a4abd6
SHA5124f8e089eba0cc90af09321cc83297cf763b9899cb65cd1ebd44697866e7458fa5ba1f3ace9e6cf7875c92fa5ac7d7fe85ff3a4af0c6f659b1849c03bba674e22
-
Filesize
434KB
MD5192e3b49aacb274d5684c4e1e0d65c35
SHA1ec255fbf5e5c3e85c53c7404e251aa94065624ee
SHA256f8ca51ccb2f07095760ff54c26589eb922eb6874857287515511431d8b0d6cec
SHA51218d2519232c0fa4743c14916dba1b720d805e843f7f6b944c86d925014b757f70c17740ed4686f9c390e9a936348abfbbc80ad60794bae15cabd83609ef4d4bd
-
Filesize
16.2MB
-
Filesize
16.2MB
-
Filesize
468KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
468KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
68KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
16.2MB
-
Filesize
6.2MB