gozi | 1c9a64fff52f3884a88657652d8941c0ea70d61198a4f861c022cb5ba32b4813

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.exe
Size 739KB
Sample261018-2656daat2p
SHA256 1c9a64fff52f3884a88657652d8941c0ea70d61198a4f861c022cb5ba32b4813
MD5 526b8aaa7ee83f6b44dedbdd145ee39d
SHA1 0213ab34e8655539e218e2937572203167e33e96
SHA512 069ca359a76bd84db68e6a888bcd1bd022e41da032c825c1006477c2dad37d6f036d74ac520c417a0ab54c4e39007253bbd132be851b4d51b02e8344bbe48dd8
SSDEEP 12288:BP1oOc1k0zIK3OU5KG4/DgOqWkMEqjc00RehQ:joL90KnqrNEs0
TLSH
T103F4F101BAF1C079E4BE42B10DB9DA6A4278BD310B6489FB73C4761E1A325E06E3575F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker 1000 collection defense_evasion discovery execution gozi isfb persistence privilege_escalation trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1000

skymate.at
monde.at
loadpkl3478.com

Attributes

exe_type
worker
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Family: Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3272	adsliner.exe

Executes dropped EXE 1 IoCs

pid	Process
3272	adsliner.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	explorer.exe

Accesses Microsoft Outlook profiles 1 TTPs 7 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	explorer.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook	explorer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\aclubase = "C:\\Users\\Admin\\AppData\\Roaming\\3bc2zFwk\\adsliner.exe"	jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4912	tasklist.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3272 set thread context of 4964	3272	adsliner.exe	97
PID 4964 set thread context of 5876	4964	svchost.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 14 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1460	cmd.exe
4212	cmd.exe
4740	cmd.exe
3244	cmd.exe
2780	cmd.exe
3172	cmd.exe
3352	cmd.exe
4900	cmd.exe
4880	cmd.exe
1228	cmd.exe
3732	cmd.exe
3196	cmd.exe
2352	cmd.exe
1448	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adsliner.exe

Checks SCSI registry key(s) 3 TTPs 44 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters	adsliner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	adsliner.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	adsliner.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	adsliner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters	jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	adsliner.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	adsliner.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	adsliner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	adsliner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	adsliner.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	adsliner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters	jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	adsliner.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	adsliner.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	adsliner.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	adsliner.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	adsliner.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	adsliner.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	adsliner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters	adsliner.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	adsliner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	adsliner.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	adsliner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	adsliner.exe

Discovers systems in the same network 1 TTPs 1 IoCs

discovery

Remote System Discovery

T1018

pid	Process
4132	net.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1424	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3272	adsliner.exe
3272	adsliner.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5876	explorer.exe

Suspicious behavior: MapViewOfSection 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
3272	adsliner.exe
4964	svchost.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4532	jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.exe
Token: SeLoadDriverPrivilege	3272	adsliner.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeDebugPrivilege	4912	tasklist.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5876	explorer.exe

Suspicious use of UnmapMainImage 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Process Hollowing

T1055.012

pid	Process
5876	explorer.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 3244	4532	jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.exe	92
PID 3244 wrote to memory of 1228	3244	cmd.exe	94
PID 1228 wrote to memory of 3272	1228	cmd.exe	95
PID 3272 wrote to memory of 4964	3272	adsliner.exe	97
PID 3272 wrote to memory of 4964	3272	adsliner.exe	97
PID 4964 wrote to memory of 5876	4964	svchost.exe	83
PID 5876 wrote to memory of 2780	5876	explorer.exe	98
PID 2780 wrote to memory of 1424	2780	cmd.exe	100
PID 5876 wrote to memory of 3732	5876	explorer.exe	103
PID 5876 wrote to memory of 3228	5876	explorer.exe	105
PID 3228 wrote to memory of 4132	3228	cmd.exe	107
PID 5876 wrote to memory of 3196	5876	explorer.exe	108
PID 5876 wrote to memory of 2352	5876	explorer.exe	110
PID 2352 wrote to memory of 5432	2352	cmd.exe	112
PID 5876 wrote to memory of 1448	5876	explorer.exe	113
PID 5876 wrote to memory of 3172	5876	explorer.exe	115
PID 3172 wrote to memory of 4912	3172	cmd.exe	117
PID 5876 wrote to memory of 3352	5876	explorer.exe	118
PID 5876 wrote to memory of 4900	5876	explorer.exe	120
PID 4900 wrote to memory of 5896	4900	cmd.exe	122
PID 5876 wrote to memory of 1460	5876	explorer.exe	123
PID 5876 wrote to memory of 4212	5876	explorer.exe	125
PID 4212 wrote to memory of 4204	4212	cmd.exe	127
PID 5876 wrote to memory of 4740	5876	explorer.exe	128
PID 5876 wrote to memory of 4880	5876	explorer.exe	130
PID 5876 wrote to memory of 3152	5876	explorer.exe	132

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	explorer.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	explorer.exe

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:5876
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\169C\8B4E.bat" "C:\Users\Admin\AppData\Roaming\3bc2zFwk\adsliner.exe" "C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3244
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /C ""C:\Users\Admin\AppData\Roaming\3bc2zFwk\adsliner.exe" "C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE""
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1228
    - - C:\Users\Admin\AppData\Roaming\3bc2zFwk\adsliner.exe
        
        "C:\Users\Admin\AppData\Roaming\3bc2zFwk\adsliner.exe" "C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE"
        5⤵
        Deletes itself
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3272
      - C:\Windows\system32\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:4964
- C:\Windows\SYSTEM32\cmd.exe
  cmd /C "systeminfo.exe > C:\Users\Admin\AppData\Local\Temp\E1C2.bin1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\system32\systeminfo.exe
    systeminfo.exe
    3⤵
    - Gathers system information
    PID:1424
- C:\Windows\SYSTEM32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\E1C2.bin1"
  2⤵
  - Executes a command shell one-liner
  PID:3732
- C:\Windows\SYSTEM32\cmd.exe
  cmd /C "net view >> C:\Users\Admin\AppData\Local\Temp\E1C2.bin1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Windows\system32\net.exe
    net view
    3⤵
    - Discovers systems in the same network
    PID:4132
- C:\Windows\SYSTEM32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\E1C2.bin1"
  2⤵
  - Executes a command shell one-liner
  PID:3196
- C:\Windows\SYSTEM32\cmd.exe
  cmd /C "nslookup 127.0.0.1 >> C:\Users\Admin\AppData\Local\Temp\E1C2.bin1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\system32\nslookup.exe
    nslookup 127.0.0.1
    3⤵
    PID:5432
- C:\Windows\SYSTEM32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\E1C2.bin1"
  2⤵
  - Executes a command shell one-liner
  PID:1448
- C:\Windows\SYSTEM32\cmd.exe
  cmd /C "tasklist.exe /SVC >> C:\Users\Admin\AppData\Local\Temp\E1C2.bin1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3172
- - C:\Windows\system32\tasklist.exe
    tasklist.exe /SVC
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4912
- C:\Windows\SYSTEM32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\E1C2.bin1"
  2⤵
  - Executes a command shell one-liner
  PID:3352
- C:\Windows\SYSTEM32\cmd.exe
  cmd /C "driverquery.exe >> C:\Users\Admin\AppData\Local\Temp\E1C2.bin1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\system32\driverquery.exe
    driverquery.exe
    3⤵
    PID:5896
- C:\Windows\SYSTEM32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\E1C2.bin1"
  2⤵
  - Executes a command shell one-liner
  PID:1460
- C:\Windows\SYSTEM32\cmd.exe
  cmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >> C:\Users\Admin\AppData\Local\Temp\E1C2.bin1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Windows\system32\reg.exe
    reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
    3⤵
    PID:4204
- C:\Windows\SYSTEM32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\E1C2.bin1"
  2⤵
  - Executes a command shell one-liner
  PID:4740
- C:\Windows\SYSTEM32\cmd.exe
  cmd /U /C "type C:\Users\Admin\AppData\Local\Temp\E1C2.bin1 > C:\Users\Admin\AppData\Local\Temp\E1C2.bin & del C:\Users\Admin\AppData\Local\Temp\E1C2.bin1"
  2⤵
  - Executes a command shell one-liner
  PID:4880
- C:\Windows\SYSTEM32\makecab.exe
  makecab.exe /F "C:\Users\Admin\AppData\Local\Temp\1D7D.bin"
  2⤵
  PID:3152

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Process Injection

T1055

Process Hollowing

T1055.012

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Process Injection

T1055

Process Hollowing

T1055.012

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8B4E.bat

Path C:\Users\Admin\AppData\Local\Temp\169C\8B4E.bat
Size 112B
SHA256 99f14ffef816c8ba6d248b2e63248b2994e82317e4f809bcaf99b53d182b3fb3
MD5 423d084686da9d8af1d200028785a61a
SHA1 77753709d2955a6d18343e20aa3cb6c23d4cb22d
SHA512 4ace12ffc1352aa243f9a8e479a6e9f98ee6b8ae6ae6bec031b2bbe8297050c03f14cd21763231177fabde07b7a790ec880f9802201de063c429f53be9f25e51
TLSH
T10AB012F4820C316268605D0CE33DBC52E6DD4E77053D07190071C08FD70A0900C8D1CF
MD5 SHA1 SHA512 TLSH

Submit Download

1D7D.bin

Path C:\Users\Admin\AppData\Local\Temp\1D7D.bin
Size 153B
SHA256 9a22e913aa734de155dea699f58dab0947d476815d0527cf45c498ea55f5e879
MD5 ad6e3b3ce5b90bca60c1110ba62b3add
SHA1 8ab6b16bfffc4de5c52acecb8373973b8723fdd9
SHA512 32b73ea60dc6668309e0606f8188471f71dc9f48b78e26072b9c5d4e5ec31d8eaa567e5cce6cb3289855feec9ce8e383e301c806b370131b5a2ae72245343dea
TLSH
T1A5C08C0C60CD9A2DA005A4930A70198DC07C88192F4C635C8720E9080A7284CA5C2207
MD5 SHA1 SHA512 TLSH

Submit Download

2621.bin

Path C:\Users\Admin\AppData\Local\Temp\2621.bin
Size 12KB
SHA256 88dfa61f262f4fda67c5121c1824b0983fcb78f9de09583ed87d7716d291de18
MD5 dc9845d376bef03416eb0ecf8c1f3ec7
SHA1 34b064b3835e8d506d8e52f6ebcef89433ea0c17
SHA512 b72687d7e617d03ae944ff3d8523262b34a57d406cd655a09d453b92b7c982ae1069922fee411e68f7a738673036b14a86993ccc79ce3a0d557dea77557f1137
SSDEEP 384:IirfhbYVjUfy2Ey3alNvkoweRYOfIOro0k:IiDhFaIazvCw1o0k
TLSH
T1C742C07F05B8B9FA0AF55C9CBB68B7644D119592BC2F0A2C7E0647D0EA144A86E4242B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E1C2.bin1

Path C:\Users\Admin\AppData\Local\Temp\E1C2.bin1
Size 2KB
SHA256 f86a20f7673d64412524b3cc3980b58ef45b299759cb067c61338c459a4c3a1e
MD5 c6fe945774cf7a85b9bccb93fc1ef0b2
SHA1 6ecc596d23472b4c1d919dae856f4f6c4b15d270
SHA512 cbf4ea9bde9c9711afd511d73e830b7fb094cc5c7a1b1b3024c62c67cb9e02aaf5464f05d1002413d54bdbb55b8676e685532f6341a15dc36ae385e41ea5b5da
TLSH
T1DB5196B88254B0603E5EC6652313CB01E4B4A5C7A6B5423930DC42845FBA358E3E5B2E
MD5 SHA1 SHA512 TLSH

Submit Download

E1C2.bin1

Path C:\Users\Admin\AppData\Local\Temp\E1C2.bin1
Size 2KB
SHA256 40e7352225d58ebe3f0b13942950eb626193bac1689461d49d18a1bf858fbbf2
MD5 cd11f8401768e6b87cf7ac356de39434
SHA1 025a50cceee8a54ed5247950f37c082a9991d0fc
SHA512 e9bd78eab3ee343f5f1d8c2b72e4db56cde1bfbd42f3343ec7748ea1ec846855a4d39f8e3038606053829c5279efb71180d693d5b30370c67941004fca10fde7
TLSH
T1855196B88654B0703E5EC6652713CB02E4B4A5C7A6B5423930DC42845FBA358E3E9B2E
MD5 SHA1 SHA512 TLSH

Submit Download

E1C2.bin1

Path C:\Users\Admin\AppData\Local\Temp\E1C2.bin1
Size 2KB
SHA256 f83a60b1e5524b9fe262c50d61437dcfc2fab55441aab6b2e7f05d7b9100847e
MD5 9c8e52cc8c1a16aabe67c06a91b685ea
SHA1 3449a2981a27544512de0c84edf907e7a31e2751
SHA512 7b4c642d383aa5d86ee89bc025db792ab658e5ef77a20574a861c0863f736e8df717947ef078d2378b71e93dc1d58a92ad19e830b271b84e4af72d607ea7a605
TLSH
T1C85198B98B58B0703E9EC6252713CB01E570A4C7A6A5423930DC42444FFA358E3EDA6D
MD5 SHA1 SHA512 TLSH

Submit Download

E1C2.bin1

Path C:\Users\Admin\AppData\Local\Temp\E1C2.bin1
Size 10KB
SHA256 3b9c8e3ccfbc696fea72fc6cfe5c27bf5892c8c904c2ab4631629fa419528515
MD5 f5f9aef31acee32e3e98863ef17747d3
SHA1 b774327da84433705d382957b5547b5725b76c60
SHA512 f0e5d2c2ca1a7c4a6fc373e06dbf7c0cc00267cbf3e35b9276136566a5470fa0c62f46feeadfff23e650fbfa9950bcdb75b3c83c0cfaad939b223bfe64ed0517
SSDEEP 192:WMLR0WetXcM4A1kex3c+k8e0Av0D/wmToHQJM42I28fBhOnDvhtN6WFcpkbu5Odt:VR05tXOA1kex3c+k8e0Av0D/wmToHQJc
TLSH
T1EE224438990F9462AA4EC39D71118112DB97908236275CED319E4A6C6FF672CCFDB738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E1C2.bin1

Path C:\Users\Admin\AppData\Local\Temp\E1C2.bin1
Size 38KB
SHA256 861124bd6f7ff86acd3f506263b3a11a7e38107903936aaee716a61456a794b1
MD5 498f6efce74145b552a36e528702af66
SHA1 8fe87123921d92da74ae78079b0b204de154e34c
SHA512 88b5787b7e168023219c475bc4fee66fcc52ba515f4bda08d6e2f0280b5ef0dfb14a1b2b731d9b9c6fbd3e2f11e1797004f3492e22e7afef630a4807f4616c6b
SSDEEP 768:VR05tXOA1kex3c+k8e0Av0D/wmToHQJM42I285hOn7htN6WFukbu5OdUAcWkpbck:VR0SA1kex3bk8e0Av0D/3ToHQJM42I20
TLSH
T169030B218A458835B747D389EA018802B69D4CD7E6235AB5349F7348B7BB3C8CFD5BE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E1C2.bin1

Path C:\Users\Admin\AppData\Local\Temp\E1C2.bin1
Size 83KB
SHA256 1ac8acbd9401ae642b2d9a0842882cfdafb6cf054e16ffa20399d50fce52d60d
MD5 14864ab66e48b3e009ab1f060ae988cb
SHA1 26aec4753bdd43c38482db8027672e3a439bb8d1
SHA512 63a81f5ab75b9433c07cbe7b8efcd29de119fe39af335340efb2746189af2436098730a2f1f525569d3166bbe702fca046f9a79ee45a31d69c1ec3598188455a
SSDEEP 1536:VR0SA1kex3bk8e0Av0D/3ToHQJM42I285hOn7bN6WFukbu5OdUAcWkpbchPxJb8/:ITgJyGsym
TLSH
T16F831F2019578074F27FD30076094901FAFA299BA7534B25708F92416F7B7CBDAF2AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.inf

Path C:\Users\Admin\AppData\Local\Temp\setup.inf
Size 929B
SHA256 e00eacbce96a324f867dd36701d9389fc4c967d2c252bf666b0133de95545e49
MD5 1fe3ddccb4ed1eb4b9704e17c3ae2bb7
SHA1 b2a144666edb7ae71d0e896ebeba56acda904b34
SHA512 581fa4a124ad6af5748e61852f5cfd1e9511a906388e72e28acbebf98281e1bdffe045b7426912f5ec08540fc4a867d99039dcb9d40efec6edc8c5494236fc0c
TLSH
T17511E51611E78D1A243229C21AE0CAC0F460D152A16AAD9D782DF9B99B1FF9B8A580A5
MD5 SHA1 SHA512 TLSH

Submit Download

setup.rpt

Path C:\Users\Admin\AppData\Local\Temp\setup.rpt
Size 283B
SHA256 51b54c8c5cc45400724a4c619035668769bd44845e720cbb21b356178fb02d2e
MD5 cb84cd937402a246f615c246cca8c3b3
SHA1 e2b00961cbf415f972510783301e8a8d095fec0c
SHA512 fd9aba70df0b79292cbe5a0607bdb2344fcdabbe3706b90f3e23a8eb6f0d962283750a17258660d5e12719963f8994637293f78023bd5e3e5b780209800b71d4
TLSH
T1A6D0C94A181A814AAE3AC2C66E59C380B91AA12762148C72F44E49E163673698FE988C
MD5 SHA1 SHA512 TLSH

Submit Download

adsliner.exe

Path C:\Users\Admin\AppData\Roaming\3bc2zFwk\adsliner.exe
Size 739KB
SHA256 1c9a64fff52f3884a88657652d8941c0ea70d61198a4f861c022cb5ba32b4813
MD5 526b8aaa7ee83f6b44dedbdd145ee39d
SHA1 0213ab34e8655539e218e2937572203167e33e96
SHA512 069ca359a76bd84db68e6a888bcd1bd022e41da032c825c1006477c2dad37d6f036d74ac520c417a0ab54c4e39007253bbd132be851b4d51b02e8344bbe48dd8
SSDEEP 12288:BP1oOc1k0zIK3OU5KG4/DgOqWkMEqjc00RehQ:joL90KnqrNEs0
TLSH
T103F4F101BAF1C079E4BE42B10DB9DA6A4278BD310B6489FB73C4761E1A325E06E3575F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3272-22-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/3272-15-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/4532-2-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/4532-11-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/4532-0-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/4964-27-0x0000000000E90000-0x0000000000FBA000-memory.dmp

Download

memory/4964-20-0x0000000000E90000-0x0000000000FBA000-memory.dmp

Download

memory/5876-39-0x0000000006310000-0x000000000643A000-memory.dmp

Download

memory/5876-33-0x0000000006310000-0x000000000643A000-memory.dmp

Download

memory/5876-34-0x0000000006310000-0x000000000643A000-memory.dmp

Download

memory/5876-32-0x0000000006310000-0x000000000643A000-memory.dmp

Download

memory/5876-24-0x0000000006310000-0x000000000643A000-memory.dmp

Download

memory/5876-37-0x0000000006310000-0x000000000643A000-memory.dmp

Download

memory/5876-31-0x0000000006310000-0x000000000643A000-memory.dmp

Download

memory/5876-40-0x0000000006310000-0x000000000643A000-memory.dmp

Download

memory/5876-35-0x0000000006310000-0x000000000643A000-memory.dmp

Download

memory/5876-36-0x0000000006310000-0x000000000643A000-memory.dmp

Download

memory/5876-86-0x0000000006310000-0x000000000643A000-memory.dmp

Download