Analysis
-
max time kernel
4s -
max time network
4s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 07:45
Static task
static1
Behavioral task
behavioral1
Sample
f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe
-
Size
428KB
-
MD5
f54df120c83f5fa1a01919b5b77d04ab
-
SHA1
b411b648acd09b8abe0ed1cf2e65d8c11b77763b
-
SHA256
dd659658316502fac8b34df964117d175bf277b2dc92e93cc7b9b09d9c512453
-
SHA512
32f80f50b4407501114a04d4fe341786d1ed535ed27594e58ff5dda0c0debccad4a55058d433aa729f9a813dbc2419fbf9b4b4a2efb4f4e13dc94b87b424d3fd
-
SSDEEP
12288:wmMDB2MiDXWt6bJ8DjFreYkkHeGtOsd/EE4Ej:wmYli7WkFQxeYR+GtOsdMOj
Malware Config
Extracted
cybergate
2.6
microsoft
loveerrorrr.no-ip.biz:85
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
System23
-
install_file
Microsoft.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Missing files
-
message_box_title
Error!
-
password
abcd1234
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
vbc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run vbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\System23\\Microsoft.exe" vbc.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run vbc.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\System23\\Microsoft.exe" vbc.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
vbc.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2UT2YGY6-507U-JQJ5-42BM-C8DIJK6L870S} vbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2UT2YGY6-507U-JQJ5-42BM-C8DIJK6L870S}\StubPath = "C:\\Windows\\system32\\System23\\Microsoft.exe Restart" vbc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exepid process 3016 f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe -
Loads dropped DLL 4 IoCs
Processes:
f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exepid process 3016 f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe 3016 f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe 3016 f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe 3016 f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral2/memory/4408-39-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral2/memory/4408-43-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral2/memory/4408-44-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral2/memory/4408-45-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral2/memory/4408-49-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral2/memory/4408-109-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/3464-114-0x0000000024080000-0x00000000240E2000-memory.dmp upx -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exevbc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\JPLXaoKMVfaDTlGZTJoxxwCmfmRedtwzrQfYIqsNptISnBnaCY = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe" f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\System23\\Microsoft.exe" vbc.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\System23\\Microsoft.exe" vbc.exe -
Drops file in System32 directory 2 IoCs
Processes:
vbc.exedescription ioc process File created C:\Windows\SysWOW64\System23\Microsoft.exe vbc.exe File opened for modification C:\Windows\SysWOW64\System23\Microsoft.exe vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exedescription pid process target process PID 3016 set thread context of 4408 3016 f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
vbc.exepid process 4408 vbc.exe 4408 vbc.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
vbc.exepid process 4408 vbc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exef54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exevbc.exedescription pid process target process PID 1192 wrote to memory of 3016 1192 f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe PID 1192 wrote to memory of 3016 1192 f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe PID 1192 wrote to memory of 3016 1192 f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe PID 3016 wrote to memory of 4408 3016 f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe vbc.exe PID 3016 wrote to memory of 4408 3016 f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe vbc.exe PID 3016 wrote to memory of 4408 3016 f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe vbc.exe PID 3016 wrote to memory of 4408 3016 f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe vbc.exe PID 3016 wrote to memory of 4408 3016 f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe vbc.exe PID 3016 wrote to memory of 4408 3016 f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe vbc.exe PID 3016 wrote to memory of 4408 3016 f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe vbc.exe PID 3016 wrote to memory of 4408 3016 f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe vbc.exe PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE PID 4408 wrote to memory of 3416 4408 vbc.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe"C:\Users\Admin\Documents\f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe4⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe5⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exe.logFilesize
319B
MD5600936e187ce94453648a9245b2b42a5
SHA13349e5da3f713259244a2cbcb4a9dca777f637ed
SHA2561493eb1dc75a64eb2eb06bc9eb2c864b78fc4a2c674108d5183ac7824013ff2d
SHA512d41203f93ed77430dc570e82dc713f09d21942d75d1f9c3c84135421550ac2fa3845b7e46df70d2c57fe97d3a88e43c672771bb8b6433c44584c4e64646c1964
-
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txtFilesize
240KB
MD5c0b830a9da3bbe801f19410a092a907e
SHA161e2dd83561b564de0f862fe8d82e0fdd4a27ddf
SHA2563523bbd97e6be532ae2eab1e44da529a233c5b0f233bc6d6d88d1e6290ba8188
SHA5129fa63753a60005d75cc6f656fe31b498ca4b6ef213fcadbad8aed5d3238c67e03dd8b98d438caad55d3cc61b99cdb9182f5120991dfae919bbec40a3183760b0
-
C:\Users\Admin\Documents\aclui.dllFilesize
17KB
MD5e99f74ae594c1b373fa0d34193dce208
SHA13933f949724a6702e0038295287a39c53592b11e
SHA2561dbb3b418bd78abb49d583f2b9cea6b20fe9fece0a59c118ddf104a672e29ebd
SHA512355a2a3955e0f50b0c41a24589b9283892689faa61aea6360a1b762f5f2f58166c579b37dc0b003e716c1dc760f1931b73faf6fa3e2b21f8571dbdf5ee37c030
-
C:\Users\Admin\Documents\f54df120c83f5fa1a01919b5b77d04ab_JaffaCakes118.exeFilesize
428KB
MD5f54df120c83f5fa1a01919b5b77d04ab
SHA1b411b648acd09b8abe0ed1cf2e65d8c11b77763b
SHA256dd659658316502fac8b34df964117d175bf277b2dc92e93cc7b9b09d9c512453
SHA51232f80f50b4407501114a04d4fe341786d1ed535ed27594e58ff5dda0c0debccad4a55058d433aa729f9a813dbc2419fbf9b4b4a2efb4f4e13dc94b87b424d3fd
-
C:\Windows\SysWOW64\System23\Microsoft.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
memory/1192-17-0x0000000075350000-0x0000000075901000-memory.dmpFilesize
5.7MB
-
memory/1192-2-0x0000000000A00000-0x0000000000A10000-memory.dmpFilesize
64KB
-
memory/1192-0-0x0000000075350000-0x0000000075901000-memory.dmpFilesize
5.7MB
-
memory/1192-1-0x0000000075350000-0x0000000075901000-memory.dmpFilesize
5.7MB
-
memory/3016-18-0x0000000075350000-0x0000000075901000-memory.dmpFilesize
5.7MB
-
memory/3016-19-0x0000000001190000-0x00000000011A0000-memory.dmpFilesize
64KB
-
memory/3016-30-0x0000000075350000-0x0000000075901000-memory.dmpFilesize
5.7MB
-
memory/3016-41-0x0000000075350000-0x0000000075901000-memory.dmpFilesize
5.7MB
-
memory/3464-53-0x0000000000950000-0x0000000000951000-memory.dmpFilesize
4KB
-
memory/3464-114-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/3464-54-0x0000000000C10000-0x0000000000C11000-memory.dmpFilesize
4KB
-
memory/4408-39-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/4408-49-0x0000000024010000-0x0000000024072000-memory.dmpFilesize
392KB
-
memory/4408-109-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/4408-45-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/4408-44-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/4408-43-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB