Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-04-2024 01:54
Static task
static1
Behavioral task
behavioral1
Sample
f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe
-
Size
264KB
-
MD5
f93f78e3921c97c6ad8f110314aa7113
-
SHA1
6615426cf2097fac0e9fddc6db2a9a08661c56a5
-
SHA256
0234c2bba8c75e3095beb312eaac7391069ad19ec57a4a859995449bba922c2f
-
SHA512
dc3dde113a156a2071827a24ee44163cebf359c2421744265957f8404723aeed91a716f42ac44fdb30ed0c7d15b8afd64b4d2af9d58a2ed11d13e80551de712e
-
SSDEEP
6144:X+/R02x4rGywlwjEAtqxp4FPKn5K3lV3uvj/JNxWpHlZ72HvRWJ:o0brGnDA8RnQ3lVeDJNIpHlZwvRWJ
Malware Config
Extracted
cybergate
2.2
vítima
kgcd72.no-ip.biz:81
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
flash
-
install_file
player.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
título da mensagem
-
password
abcd1234
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\flash\\player.exe" f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\flash\\player.exe" f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500} f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\Windows\\flash\\player.exe Restart" f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral1/memory/1684-40917-0x0000000024050000-0x000000002408C000-memory.dmp upx behavioral1/memory/1684-40957-0x0000000024050000-0x000000002408C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\flash\\player.exe" f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\flash\\player.exe" f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exedescription pid process target process PID 2744 set thread context of 2300 2744 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe -
Drops file in Windows directory 4 IoCs
Processes:
f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exef93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exedescription ioc process File created C:\Windows\flash\player.exe f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe File opened for modification C:\Windows\flash\player.exe f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe File opened for modification C:\Windows\flash\player.exe f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe File opened for modification C:\Windows\flash\ f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exepid process 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exepid process 1684 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 1684 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe Token: SeDebugPrivilege 1684 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exef93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exedescription pid process target process PID 2744 wrote to memory of 2300 2744 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe PID 2744 wrote to memory of 2300 2744 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe PID 2744 wrote to memory of 2300 2744 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe PID 2744 wrote to memory of 2300 2744 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe PID 2744 wrote to memory of 2300 2744 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe PID 2744 wrote to memory of 2300 2744 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe PID 2744 wrote to memory of 2300 2744 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe PID 2744 wrote to memory of 2300 2744 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe PID 2744 wrote to memory of 2300 2744 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe PID 2744 wrote to memory of 2300 2744 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe PID 2744 wrote to memory of 2300 2744 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe PID 2744 wrote to memory of 2300 2744 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe PID 2300 wrote to memory of 1800 2300 f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe"2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe"3⤵
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txtFilesize
137KB
MD5a20c634bf05e2f5f7be878ba989209cb
SHA1b748ac5ca00d82c47ae134416823ff2a1c487bd0
SHA256a0fd16430d7ca5f8908dba9ae6d3433c33e49cf3f45afc327ba34995338e5518
SHA512b338a65fae2f18b2ac38a5aeaf2d894e0fc9ee429517bb7fd517c2d34c1c1d3a4f088f50a36d59009ad310c943b83dd7d92d02c990f0c2fc14397e366af697bc
-
C:\Users\Admin\AppData\Roaming\logs.datFilesize
15B
MD586f3c87caff4d7973404ff22c664505b
SHA1245bc19c345bc8e73645cd35f5af640bc489da19
SHA256e8ab966478c22925527b58b0a7c3d89e430690cbdabb44d501744e0ad0ac9ddb
SHA5120940c4b339640f60f1a21fc9e4e958bf84f0e668f33a9b24d483d1e6bfcf35eca45335afee1d3b7ff6fd091b2e395c151af8af3300e154d3ea3fdb2b73872024
-
C:\Windows\flash\player.exeFilesize
264KB
MD5f93f78e3921c97c6ad8f110314aa7113
SHA16615426cf2097fac0e9fddc6db2a9a08661c56a5
SHA2560234c2bba8c75e3095beb312eaac7391069ad19ec57a4a859995449bba922c2f
SHA512dc3dde113a156a2071827a24ee44163cebf359c2421744265957f8404723aeed91a716f42ac44fdb30ed0c7d15b8afd64b4d2af9d58a2ed11d13e80551de712e
-
memory/1684-40957-0x0000000024050000-0x000000002408C000-memory.dmpFilesize
240KB
-
memory/1684-40917-0x0000000024050000-0x000000002408C000-memory.dmpFilesize
240KB
-
memory/1684-40711-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/1684-40698-0x00000000002D0000-0x00000000002D1000-memory.dmpFilesize
4KB
-
memory/2300-40676-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2300-40921-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2300-40682-0x0000000000320000-0x000000000032F000-memory.dmpFilesize
60KB
-
memory/2744-63-0x0000000000410000-0x0000000000453000-memory.dmpFilesize
268KB
-
memory/2744-59-0x0000000000410000-0x0000000000453000-memory.dmpFilesize
268KB
-
memory/2744-19-0x0000000000410000-0x0000000000453000-memory.dmpFilesize
268KB
-
memory/2744-17-0x0000000000410000-0x0000000000453000-memory.dmpFilesize
268KB
-
memory/2744-15-0x0000000000410000-0x0000000000453000-memory.dmpFilesize
268KB
-
memory/2744-3-0x0000000000410000-0x0000000000453000-memory.dmpFilesize
268KB
-
memory/2744-1-0x0000000000410000-0x0000000000453000-memory.dmpFilesize
268KB
-
memory/2744-40655-0x00000000002D0000-0x00000000002DF000-memory.dmpFilesize
60KB
-
memory/2744-57-0x0000000000410000-0x0000000000453000-memory.dmpFilesize
268KB
-
memory/2744-53-0x0000000000410000-0x0000000000453000-memory.dmpFilesize
268KB
-
memory/2744-61-0x0000000000410000-0x0000000000453000-memory.dmpFilesize
268KB
-
memory/2744-0-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/2744-55-0x0000000000410000-0x0000000000453000-memory.dmpFilesize
268KB
-
memory/2744-21-0x0000000000410000-0x0000000000453000-memory.dmpFilesize
268KB
-
memory/2744-23-0x0000000000410000-0x0000000000453000-memory.dmpFilesize
268KB
-
memory/2744-25-0x0000000000410000-0x0000000000453000-memory.dmpFilesize
268KB
-
memory/2744-7-0x0000000000410000-0x0000000000453000-memory.dmpFilesize
268KB
-
memory/2744-5-0x0000000000410000-0x0000000000453000-memory.dmpFilesize
268KB