Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-04-2024 06:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Resource
win7-20240221-en
4 signatures
150 seconds
General
-
Target
02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
-
Size
112KB
-
MD5
02a7e926c827c520122fcf6a4567314c
-
SHA1
3c30ff40ef14baaf3d7ea74cabafdd0ab4d6b162
-
SHA256
6b6f47abe5a8103adf1b12e5f3651ed24b632a64c5c94ce297a6f9ca0710f772
-
SHA512
bdcb94e511b12f5d987cb6c493c74a609c1582020b06545654a6c79a0fd72372d25a716cac4919108639cae484dbb3d39cb2dda39539c309a03f011bf5fed7ad
-
SSDEEP
3072:3XVn8iDW2JpOxR7eAN1NdO/9T2/Qx5lCAeD2EFnBSr1rvSgA//:3l8qW2J8yA/NdO/kox5lCd2EFnBSr1ry
Malware Config
Extracted
Family
gootkit
Botnet
1001
C2
pell-talak.com
gudsline.com
Attributes
-
vendor_id
1001
Signatures
-
Drops file in System32 directory 4 IoCs
Processes:
02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe -
Modifies data under HKEY_USERS 42 IoCs
Processes:
02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exedescription pid process target process PID 1664 wrote to memory of 2632 1664 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe PID 1664 wrote to memory of 2632 1664 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe PID 1664 wrote to memory of 2632 1664 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe PID 1664 wrote to memory of 2632 1664 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe 02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe" kxgtatoyoldeiglhjlvh2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1664-13-0x0000000002A90000-0x0000000002B59000-memory.dmpFilesize
804KB
-
memory/1664-9-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1664-0-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/1664-4-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1664-3-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1664-1-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/1664-10-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/1664-18-0x0000000000470000-0x0000000000475000-memory.dmpFilesize
20KB
-
memory/1664-2-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/1664-16-0x0000000000470000-0x0000000000475000-memory.dmpFilesize
20KB
-
memory/1664-12-0x0000000002720000-0x00000000027BF000-memory.dmpFilesize
636KB
-
memory/1664-15-0x0000000000460000-0x0000000000461000-memory.dmpFilesize
4KB
-
memory/1664-14-0x0000000002B60000-0x0000000002C69000-memory.dmpFilesize
1.0MB
-
memory/1664-11-0x0000000002010000-0x000000000213D000-memory.dmpFilesize
1.2MB
-
memory/1664-17-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2632-5-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2632-19-0x0000000010000000-0x000000001000D000-memory.dmpFilesize
52KB
-
memory/2632-24-0x0000000010000000-0x000000001000D000-memory.dmpFilesize
52KB
-
memory/2632-37-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB