Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
03-05-2024 06:56
Static task
static1
Behavioral task
behavioral1
Sample
0fec8241074bc12177e09e456ae9265d_JaffaCakes118.exe
Resource
win7-20240419-en
General
-
Target
0fec8241074bc12177e09e456ae9265d_JaffaCakes118.exe
-
Size
203KB
-
MD5
0fec8241074bc12177e09e456ae9265d
-
SHA1
8d399133e1c3f1b29b2e200ba91c11fd2a187780
-
SHA256
0677fdd75e2314cfda2991b1506af60ed271169ff0a179771d8a8107644cb06a
-
SHA512
a2acfa48f09384100c4bd8bc98e5a73bf7ee7a5360561d405904c579365ad06a9503bb947391b76bba474cfae139b06e1231b67e10d924519f951699962d445e
-
SSDEEP
3072:94ji2dQ6v4uPXDNUj4jKBonzmLXlYVRLh0epEEZqkFBc4+uTqN76o:9ydp4uPZzGonqXGXh0bluBc4GZ5
Malware Config
Extracted
gozi
-
build
215165
Extracted
gozi
3162
menehleibe.com
liemuteste.com
thulligend.com
-
build
215165
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
loader
-
server_id
12
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5E6AF411-091A-11EF-84D8-C2F93164A635} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000056ed4e214298e1497c95201c66be11424784b2d591a2bfb1df3c04245f67eec0000000000e80000000020000200000003ca22b650023a5cd6101e94b12c904f9d11511b1f3427548e43fa646be2297fc20000000ce4a7c05139ce7f7642af8b9b1cc5bd3ee3c2f57b706d49b825d363504aa4c81400000000255553404d42f227af081caab55511ab006b6006df9b0997b659d96f4bae1f28f4ae68782148e0bab7c2e0abfc953a295fbcdcb5c57ee755bc14a705b773528 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70d21633279dda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000cc5a66a4e2efdcf4bbf5e9fb6d5f6b840a2809583318e22f31c23ac622212c62000000000e80000000020000200000006ac286b5545c6fc15431a80b1e17c96052c0921134519fb74d3e78b173d5bd6790000000e5bc2336cdda72530c12327ff839339d4da28e4de02bd6882a91a431e5e0b55d9b53946f1bcc8e42c0c319d8438835537825347bf855a221f30db9ae3be1f1b0ccfd7ef8d0f12829735d2f25d8828b64cbd444d00e8c8045ea257caa1d75cb57f4f2e84798bda2f58a8dc26b70cb29c7f97574c4de2c02fdc9802eda3196efdb70d23a7508969f020d7148fd99fb711f40000000a0074c935f70bb872a81b5ecb3d9e85bbec8196dbd8e138a240c14d5bc9ad47233958207ec952e65ad6e7ca12086c27e7286864fda1b6cdb1fba172f23187e3b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2248 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2248 iexplore.exe 2248 iexplore.exe 2644 IEXPLORE.EXE 2644 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2248 wrote to memory of 2644 2248 iexplore.exe IEXPLORE.EXE PID 2248 wrote to memory of 2644 2248 iexplore.exe IEXPLORE.EXE PID 2248 wrote to memory of 2644 2248 iexplore.exe IEXPLORE.EXE PID 2248 wrote to memory of 2644 2248 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\0fec8241074bc12177e09e456ae9265d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0fec8241074bc12177e09e456ae9265d_JaffaCakes118.exe"1⤵PID:1576
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD52ddab57304056022eec09f6d466d1320
SHA1154458d37e10dbc0bb253a6894f14ebc640cc9b5
SHA25659ace40df214dc9feacc15261b21dc7914d1272f2e77b563edc4fc4cc7f6cc95
SHA5124db27a22ed03ebd8eacda74376d9abcd645862414cb5a7ec540b16fed6df94b9ed9859a50f912bbde80c71ae15a7ba1ccb502334afa811581d21c3a86ca9f8f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5f483a9a56eb63b11dae3c6db9fd846b1
SHA142f768f440af1f4c22bd98c779e2844256357631
SHA256f2e90e3887c311ad1d5d3dafcad769cfa8891ee86040aae9318fcb53ae9967cc
SHA512e7003b30d44d8d0b5b62ed388fd470716191f8c6786a71e9c45ece5c4c63852dc3361a6c17a27b69b8c71796879f97e99572260bb581e01b6ccde1d9d837b802
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5793917fddf66c3eef8008a706c04eec7
SHA1c323359f995134e93bcca5e048bd7aede6f0acaf
SHA2560269f74929aff9b9a4e07cb5c9855d1f801f4f1d74f8da407deed58ef5a7bc04
SHA512faf76ff05a1af7339d1ad9876e629457db06ff00676cf7f6568422172ec096c41e1413abae59fd46eafcbca9cce7990519265d2b0cc862ffde3b67d17a63d4a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD500d4121e55cb0043205c32340cd75d4e
SHA1938df7841b76f78080ee767982df1686fcc68d39
SHA2567264c02ac9ed9ba38e84cb8c77d0a88ad5fdb42a9a3a8c30a8b5f3454daa4a2e
SHA512f4871c537db64b7403f9dd62904d174a72bc7806733d15578117e40c10bf0c7a6532b92af86283f02aff08b051ecc5c55ea4eb646e22a955228080f40e2a3a1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD55d2371ff13f6dc430126eaa3713f4a94
SHA1a783cd57ad2ba9db68528dc2f47c440d81614977
SHA256595f8e2cb4106c34f9736174467bf6897c74be4600cce8b4a2866ae3d0d8c923
SHA512a722c53139d6f3d96054e0c0a34dc1633efc3025e10cafd596c1ce053b7f75962e5922c0e7c081b45ef64ce0f3c4f2b9f9d07020cf10bdca1450a67d752e464b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD51d7250e8b87586dc4d1923bb2f5742d9
SHA144c1f50abff39f665e1b7c0708ba9b336f7c9ddd
SHA2561e70ec0a9f47832cdbf18e9651763938d0190cd495226b01dacfe43edb957176
SHA5128ce10a06c9881b7073daf796dea8e07cd745b693b038436bb458453939bc43221083b91448a5d8c5e1d6355a14b0c6788781325475acb8ad22404ec177e9e81a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d0f908243f281eb941b71a8ed586fc19
SHA1220e3f7365c95bd6fa8d5d48330dd7ac96fe6df7
SHA256378eea3c82abc70d16a112161f67d46b8d7ea1d9f6cbe286198711be322abeec
SHA5122a7e509e4a70e50780b4bc2035b460a7f282df2ae0dcd417435083a0c47b005d9ab41d017abedf27e8dd281f791c473d9d5ea5254452d2b5573c4e4f8988a61f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD51956c432365570b1744d5b1039a73c72
SHA13e756c5f94ca9b4776f620ac2217270f03d2b296
SHA2568a27ddba546eba4a86a9a8fa3330b6aab19a73b422caa3187f1ff7f5318c68bd
SHA5125d62018b8c3dfd89ed433265b045cf2e5ff2d7d220b7f569d8651047abfecef1526403dd5411a91db31d594376beee38594ff7adb8b1902f77d7926cb13a0019
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD55c5d41c71b42be9d65d0d2b5e9bd768a
SHA18e52bea17973e8deb763122701706b6ec5d88673
SHA25666c0ae9249701c4ed151893e701ac60f8daa63ece3671cee6543db52ac98b706
SHA5120c0c0bf94d541ea5d5db9d84262baa869ad78d7528cfd7a20480cd43b34f8db2c3b0b4a24a5e870ab904decf4bb9df9cade903f653065dc4ccfb36b2c0d2efb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d7e9913268239d5c54a5e03bddb9eebe
SHA1b8bdc93df6061b98fc40025d93c27f8661bbb7ca
SHA256623a1e93696e0c9bb09bbda8ea2be2d24accdea8762ea8d6c168a6b745cabb8f
SHA512d6102a5401344b5b724b45f7d918434a4e666d0389f42621ebba777b5b831716f4442b344c338f6407cc6c533e6eef1c037bd2ef4985b67ba0ce8422f4f0e1db
-
C:\Users\Admin\AppData\Local\Temp\Cab7CDF.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Tar8ED9.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
memory/1576-0-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/1576-19-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/1576-8-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/1576-4-0x0000000000270000-0x000000000028B000-memory.dmpFilesize
108KB
-
memory/1576-2-0x0000000000435000-0x000000000043A000-memory.dmpFilesize
20KB
-
memory/1576-3-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/1576-1-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB