gozi | 042d17bec0bdc75cdb620ba62bc72140c9486c9c1eeb35edec24972498c5dc45

Analysis

max time kernel
140s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
21-06-2024 14:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe
Size

107KB
MD5

0c2b04e4091af239fb80d7b2aab6f0c9
SHA1

dc52874aacf3be3b463cac375bd471e13ff260ed
SHA256

042d17bec0bdc75cdb620ba62bc72140c9486c9c1eeb35edec24972498c5dc45
SHA512

1a9762d4703e23e6f31bb4b163197470c7cb308ea7b16b77a0fd58563a796d8d099c2f0d294fe396ddf3be1213e6df60add4f78a25cd5ec73aea0597f4144918
SSDEEP

3072:HRO6Hu0ILzqLrMTWeZvTE1yWZf/QsMwf:HRNHu0mqLrLexWx/J

Score

10^/10

gozi banker discovery isfb persistence ransomware trojan upx

Malware Config

Extracted

Family

gozi

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation 0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe
Loads dropped DLL 2 IoCs

Processes:

0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe

pid process

684 0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe
684 0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

C:\Windows\SysWOW64\blphc5uaj0ecoj.scr upx
behavioral2/memory/684-17-0x0000000002EA0000-0x0000000002F54000-memory.dmp upx

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe

pid	process
684	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe
684	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe

resource	yara_rule
C:\Windows\SysWOW64\blphc5uaj0ecoj.scr	upx
behavioral2/memory/684-17-0x0000000002EA0000-0x0000000002F54000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lphc5uaj0ecoj = "C:\\Windows\\system32\\lphc5uaj0ecoj.exe"	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

Processes:

0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\SysWOW64\phc5uaj0ecoj.bmp	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\blphc5uaj0ecoj.scr	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\system32\\phc5uaj0ecoj.bmp"	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000002b58b4804f1d39ed0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800002b58b4800000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809002b58b480000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d2b58b480000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000002b58b48000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe

Modifies Control Panel 8 IoCs

evasion

Processes:

0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\Desktop\TileWallpaper = "0"	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\Desktop\OriginalWallpaper = "C:\\Windows\\system32\\phc5uaj0ecoj.bmp"	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\system32\\phc5uaj0ecoj.bmp"	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\blphc5uaj0ecoj.scr"	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\Desktop\ScreenSaveActive = "1"	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\Colors\Background = "0 0 255"	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\Desktop\WallpaperStyle = "0"	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe

Modifies registry class 1 IoCs

Processes:

0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings 0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe

pid process

684 0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe
684 0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe

pid process

684 0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe

pid	process
684	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe
684	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe

pid	process
684	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

vssvc.exesrtasks.exe

description	pid	process
Token: SeBackupPrivilege	4084	vssvc.exe
Token: SeRestorePrivilege	4084	vssvc.exe
Token: SeAuditPrivilege	4084	vssvc.exe
Token: SeBackupPrivilege	2148	srtasks.exe
Token: SeRestorePrivilege	2148	srtasks.exe
Token: SeSecurityPrivilege	2148	srtasks.exe
Token: SeTakeOwnershipPrivilege	2148	srtasks.exe
Token: SeBackupPrivilege	2148	srtasks.exe
Token: SeRestorePrivilege	2148	srtasks.exe
Token: SeSecurityPrivilege	2148	srtasks.exe
Token: SeTakeOwnershipPrivilege	2148	srtasks.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe

description	pid	process	target process
PID 684 wrote to memory of 2308	684	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe	WScript.exe
PID 684 wrote to memory of 2308	684	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe	WScript.exe
PID 684 wrote to memory of 2308	684	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe	WScript.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Checks processor information in registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:684

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\.ttD179.tmp.vbs"
2⤵
PID:2308

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4084

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4288,i,12594301322143882025,16832588342008839449,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:8
1⤵
PID:4136

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:3
1⤵
PID:1504

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\.ttD179.tmp.vbs
Filesize
1002B

MD5
9df700c8f6fd43fac0a89aef04214bbd

SHA1
6ec8bc6d4041ccf19757757c0da6592469f71c57

SHA256
9ab6f2c3cc3965cd05f81d859bdfac3b25a5e70178f61ea677d31987c4e142fd

SHA512
8bbcd322f3998c0f7d81884737ca313c1353ac7e3899f168fc8d44eafbe064193353b8b16f92113288ff2102c47623b542861440c414b8acf36d75c4ad645d4d

Download Submit
C:\Windows\SysWOW64\blphc5uaj0ecoj.scr
Filesize
59KB

MD5
538f9ead95eba12134d95b4fe7082331

SHA1
527c50b92b5cededdd5b7e3edda71cb13d108dac

SHA256
a416bab39037854c14540edaaf80cff7b5f2e9db31eee235527574e8dedd54e6

SHA512
4631ff7cf868348585ee0e26591b95be3ee8b232c7980f5013f4464f285b0fbdef41794c44cb8653d6fb6dc815c0c0a9f4af780bfeb9b23d2f4c3bdc62bf4581

Download Submit
memory/684-1-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/684-2-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/684-3-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/684-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/684-5-0x0000000000401000-0x000000000040A000-memory.dmp

Filesize
36KB

Download
memory/684-4-0x00000000007A0000-0x00000000007D0000-memory.dmp

Filesize
192KB

Download
memory/684-17-0x0000000002EA0000-0x0000000002F54000-memory.dmp

Filesize
720KB

Download
memory/684-18-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download