Analysis
-
max time kernel
24s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30-03-2024 00:35
Static task
static1
Behavioral task
behavioral1
Sample
2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe
Resource
win7-20240221-en
Errors
General
-
Target
2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
2f67d4586c475120c2af54610adcacb6
-
SHA1
f3d5eca7efaf3cb432a86a9e12962eb0536dba54
-
SHA256
61dc2a718a35fdb6e6897bfa33638cdfc882fa625b124fa958cd3ced40beec3c
-
SHA512
b156b96457e58e3a16c1d49a7b1868d7329570d1ebae1cdae592329cf487540f6001242eaa65ae351fda5d6b2541d7b63d432ecb352c76a4f8dae4c77c6e91fe
-
SSDEEP
24576:pRmJkcoQricOIQxiZY1iaFbrJi2GCWCW3baTwzAZSJXR:mJZoQrbTFZY1iaFPJi2oRbakVXR
Malware Config
Extracted
cybergate
v1.01.8
remote
freeforfree.ddns.net:999
upgrade
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
updated.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
FUNCIOANL EXECUTOU
-
message_box_title
CyberGate
-
password
cybergate
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\updated.exe" 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\updated.exe" 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{445N60N3-08V0-S2B7-RWIS-4QV11S48Q5X2} 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{445N60N3-08V0-S2B7-RWIS-4QV11S48Q5X2}\StubPath = "C:\\Windows\\system32\\install\\updated.exe Restart" 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral1/memory/1804-542-0x0000000024070000-0x00000000240D0000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\updated.exe" 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\updated.exe" 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Windows\SysWOW64\install\updated.exe autoit_exe -
Drops file in System32 directory 2 IoCs
Processes:
2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\install\updated.exe 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\install\updated.exe 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exedescription pid process target process PID 2000 set thread context of 2644 2000 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exepid process 2000 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exepid process 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exedescription pid process target process PID 2000 wrote to memory of 2644 2000 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe PID 2000 wrote to memory of 2644 2000 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe PID 2000 wrote to memory of 2644 2000 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe PID 2000 wrote to memory of 2644 2000 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe PID 2000 wrote to memory of 2644 2000 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe PID 2000 wrote to memory of 2644 2000 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE PID 2644 wrote to memory of 1224 2644 2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2f67d4586c475120c2af54610adcacb6_JaffaCakes118.exe"3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txtFilesize
221KB
MD5d5d2af24af5ed219035deb8a2c5c1633
SHA1a6894aae19a16eae5ac6cc4c81a32458c92afc03
SHA256aaa41cf8c5d9567df94a6360bef26483c1bd76058c5dceeec7e0e040194a44f9
SHA512a786c27b8723f9550307aa8374788849e077e15f5b9b305750d10b4446ed28a10fa40a05bbb0e313833a89d68baaaecdd1623941285748cd91d093750258ad55
-
C:\Windows\SysWOW64\install\updated.exeFilesize
1.1MB
MD52f67d4586c475120c2af54610adcacb6
SHA1f3d5eca7efaf3cb432a86a9e12962eb0536dba54
SHA25661dc2a718a35fdb6e6897bfa33638cdfc882fa625b124fa958cd3ced40beec3c
SHA512b156b96457e58e3a16c1d49a7b1868d7329570d1ebae1cdae592329cf487540f6001242eaa65ae351fda5d6b2541d7b63d432ecb352c76a4f8dae4c77c6e91fe
-
memory/1224-11-0x0000000002A90000-0x0000000002A91000-memory.dmpFilesize
4KB
-
memory/1804-542-0x0000000024070000-0x00000000240D0000-memory.dmpFilesize
384KB
-
memory/1804-260-0x00000000000A0000-0x00000000000A1000-memory.dmpFilesize
4KB
-
memory/1804-285-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB
-
memory/2644-6-0x00000000000C0000-0x000000000010C000-memory.dmpFilesize
304KB
-
memory/2644-7-0x00000000000C0000-0x000000000010C000-memory.dmpFilesize
304KB
-
memory/2644-5-0x00000000000C0000-0x000000000010C000-memory.dmpFilesize
304KB
-
memory/2644-0-0x00000000000C0000-0x000000000010C000-memory.dmpFilesize
304KB
-
memory/2644-4-0x00000000000C0000-0x000000000010C000-memory.dmpFilesize
304KB
-
memory/2644-2-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/2644-568-0x00000000000C0000-0x000000000010C000-memory.dmpFilesize
304KB