Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-04-2024 23:46
Behavioral task
behavioral1
Sample
f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe
-
Size
178KB
-
MD5
f6d5441c8b32fe2a58a8d1a4a9315a50
-
SHA1
bc7adca0427485eb93cc134545599086291cf007
-
SHA256
e212ea2877c9481bac38846784c7cec3e4b97336455ce8db9566a86f49ac55fb
-
SHA512
56407cb4192d38c23c6fb41199deb0f7a729aaf4dc65fc15b593078aca0d6cd4bf5624c4e2c600951d2503f50b40c1f77be1360487cbfc0724ccb5b7c86a3366
-
SSDEEP
3072:KltXqnLYlQ2OJpZeEVLgp9zySBZBMEBYgkwGD9SmRdvtN10W2oYZKbSLY2mc:Kr2YlQ2gjcp9eEFYgkwGRRZtfV2nZKuL
Malware Config
Extracted
cybergate
2.2.2
av
10.255.100.220:81
127.0.0.1:81
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
.//
-
ftp_interval
5
-
ftp_password
$%&key&%$
-
ftp_port
21
-
ftp_server
10.255.100.220
-
ftp_username
keykey
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
rcart.exe
-
install_flag
true
-
keylogger_enable_ftp
true
-
message_box_caption
texto da mensagem
-
message_box_title
tÃtulo da mensagem
-
password
keykey
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\Teste\\install\\rcart.exe" f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\Teste\\install\\rcart.exe" f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exeexplorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{151X6V83-FN86-GVO7-AP7E-13505B4BXW61} f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{151X6V83-FN86-GVO7-AP7E-13505B4BXW61}\StubPath = "c:\\Teste\\install\\rcart.exe Restart" f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{151X6V83-FN86-GVO7-AP7E-13505B4BXW61} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{151X6V83-FN86-GVO7-AP7E-13505B4BXW61}\StubPath = "c:\\Teste\\install\\rcart.exe" explorer.exe -
Processes:
resource yara_rule behavioral1/memory/3020-0-0x0000000000400000-0x000000000043F000-memory.dmp upx \??\c:\Teste\install\rcart.exe upx behavioral1/memory/1220-404-0x0000000024050000-0x000000002408D000-memory.dmp upx behavioral1/memory/3020-424-0x00000000002C0000-0x00000000002FF000-memory.dmp upx behavioral1/memory/2572-426-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/3020-479-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/3020-640-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2572-639-0x00000000240D0000-0x000000002410D000-memory.dmp upx behavioral1/memory/1220-661-0x0000000024050000-0x000000002408D000-memory.dmp upx behavioral1/memory/2572-680-0x00000000240D0000-0x000000002410D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "c:\\Teste\\install\\rcart.exe" f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "c:\\Teste\\install\\rcart.exe" f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exepid process 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exepid process 2572 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 2572 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Token: SeDebugPrivilege 2572 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exepid process 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exedescription pid process target process PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE PID 3020 wrote to memory of 1192 3020 f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe"2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Modifies Installed Components in the registry
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txtFilesize
140KB
MD54a8168fd24065b08c96b1c49f5941205
SHA1ef3ea3f29ac72f0c3b71794ab10813104b436e5a
SHA25677ae048c81e516220ff09064b6c3a31005e773b1f3328ad6d0970964e6a217fe
SHA512c7b9b7344d19d224e22472074543013bbf892af1ad0c05abfc995eae44af0245bbe334afa0295265744d8a0f293527af766a229295c34c4aea88e06cd2d65f13
-
C:\Users\Admin\AppData\Roaming\logs.datFilesize
15B
MD586f3c87caff4d7973404ff22c664505b
SHA1245bc19c345bc8e73645cd35f5af640bc489da19
SHA256e8ab966478c22925527b58b0a7c3d89e430690cbdabb44d501744e0ad0ac9ddb
SHA5120940c4b339640f60f1a21fc9e4e958bf84f0e668f33a9b24d483d1e6bfcf35eca45335afee1d3b7ff6fd091b2e395c151af8af3300e154d3ea3fdb2b73872024
-
\??\c:\Teste\install\rcart.exeFilesize
178KB
MD5f6d5441c8b32fe2a58a8d1a4a9315a50
SHA1bc7adca0427485eb93cc134545599086291cf007
SHA256e212ea2877c9481bac38846784c7cec3e4b97336455ce8db9566a86f49ac55fb
SHA51256407cb4192d38c23c6fb41199deb0f7a729aaf4dc65fc15b593078aca0d6cd4bf5624c4e2c600951d2503f50b40c1f77be1360487cbfc0724ccb5b7c86a3366
-
memory/1192-4-0x0000000002540000-0x0000000002541000-memory.dmpFilesize
4KB
-
memory/1220-404-0x0000000024050000-0x000000002408D000-memory.dmpFilesize
244KB
-
memory/1220-195-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/1220-193-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB
-
memory/1220-661-0x0000000024050000-0x000000002408D000-memory.dmpFilesize
244KB
-
memory/2572-426-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2572-639-0x00000000240D0000-0x000000002410D000-memory.dmpFilesize
244KB
-
memory/2572-680-0x00000000240D0000-0x000000002410D000-memory.dmpFilesize
244KB
-
memory/3020-0-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/3020-424-0x00000000002C0000-0x00000000002FF000-memory.dmpFilesize
252KB
-
memory/3020-479-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/3020-640-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB