Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
05-05-2024 08:46
Static task
static1
Behavioral task
behavioral1
Sample
16e25114629a9d701ca21f53e840b258_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
16e25114629a9d701ca21f53e840b258_JaffaCakes118.exe
-
Size
203KB
-
MD5
16e25114629a9d701ca21f53e840b258
-
SHA1
391d84b136d606c3ecbe990918107990649e90d8
-
SHA256
f682efc41320920e31caf2f99121844cc4b3c4f5406e0980fa1b0e26f7c0c351
-
SHA512
fbf2f36c3d066bda7204161228f32e11365b4f13c5e466c4d5a4eada3b4e0456f406f5d42998a269e6eb46da93087574b17aa9306b9875d988f999ff9ab84255
-
SSDEEP
3072:9+ji2dQ6v4uPXDNUj4jKBonzmLXlYVRLh0epEEZqkFBc4+uTqN76o:94dp4uPZzGonqXGXh0bluBc4GZ5
Malware Config
Extracted
gozi
-
build
215165
Extracted
gozi
3162
menehleibe.com
liemuteste.com
thulligend.com
-
build
215165
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
loader
-
server_id
12
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000e7214f9ae20c8085ed984b6cb3fbb99a657fe5df3d4cd99a0b9c937a8de1f99a000000000e8000000002000020000000f450aa770518a72dd29dcc81810f86ef57aceb3a48bb8a2ddb34426ab59d3388200000003a4a4acbc81f0a7c171fad488219f8c8a708f42dfe83d8457943b98d56426e1640000000123a8d64de6b48ef0d911eb75e4c47b410e97bf9d7a9d8d301cdb9ee0ab07ec67cc3bcd55bbdada49d876f9e0f88feb9f471eea048c95673376b324f6333ffa7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000d13175b59ad87e875e862a3adaca7d698c51450d2dc02af8b6dd88ab6317d540000000000e80000000020000200000002b44a9d1d88b6afb7fb2774b33acf950fa597a31d990e39b136e5d00885b62559000000061d84a4c9ab6e66b6e6cbd0bccb46ababd8e4efa6c952011fd0a8a2fb8cf776ba2c22456986fe5822c20a1f14af823414baf75f729518653d94a997b1f52c5749c96118e5ea325a8b49de2696f2b7b6b9b4245ed6914f680b091b91f00264408313164cf4943ae8e1f91156f8c4cdea9d3505aa1c2fadcc0cf2dab9de32e374e53df4da72c69ca8c17ed9c6fc028e8e74000000022c7b47767d633a627c089e3a1e414fb32d78952ebed416ce2acdc3bf77e55a17a7916445813dc0b4d111e5c22d68555ed38468cdf6f8a1aca4f5d9fd509ab35 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{00715721-0ABC-11EF-AF55-CE46FB5C4681} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80a61fd5c89eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2764 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2764 iexplore.exe 2764 iexplore.exe 2616 IEXPLORE.EXE 2616 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2764 wrote to memory of 2616 2764 iexplore.exe IEXPLORE.EXE PID 2764 wrote to memory of 2616 2764 iexplore.exe IEXPLORE.EXE PID 2764 wrote to memory of 2616 2764 iexplore.exe IEXPLORE.EXE PID 2764 wrote to memory of 2616 2764 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\16e25114629a9d701ca21f53e840b258_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\16e25114629a9d701ca21f53e840b258_JaffaCakes118.exe"1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2764 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD58f29cfde5bca7b5e1ddb6c1d3be825e5
SHA11082270ad34a1c1224cc2c450f444247af916433
SHA256453de823263a5d16a7bf91ef21eb52658ac8184cf01ed9ca709a4e2792d82d51
SHA512e0a7d668b5ae046f6149ce538b2a0626cbc75a7bcde465efd1c2b340b0292a8ff120ddcf4917fc776350cc3b24e534811b487ff42cb99e2f0e3f949bc2a70154
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD52e579ec0867f9a4b13c7ff4df54e77ca
SHA1a6ef1d49c88357e57cc27679caa86f9c50427611
SHA256f8903ad3d4b4b8978e03e0f9eac96943f2b49fabafc47b0cd56425e010e464e4
SHA512ccc8d56f0f87f25844dbebdf79cb576caaa1c2767fd07506650290a5c48babf147e58416e7207775e13f981485b542dbbfcc0ef5dfa49e35056733696720446b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5e3d665c6805bf143d568102a8b2b73b4
SHA1b985e089a26198cc7838aba9fe05ecfcb2e19474
SHA256265f8c1b3d3180b8c2cd89af7ce45f2ada47278ae305b301e6ddf557388eb8fa
SHA51272d4ffd39a02ca9336f3dc8eded80e034b894367602c643421c111492c91b829134774847e2049353c5178ffe1ff3c2258ccf0baa6658dc95b9bf10ac9ae2406
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d09a9ab44c41e091840ce785ceac96b9
SHA1a9ad3818dc33dc8705aa44fe6b3bd04ced0edf71
SHA256869f01e8d960f98ecbf9be0f34265a6d5c728987b849b3e2c5eb29ee98888054
SHA512985dc4032bac16295aabf263b8d259db8b212c4e25b0774f513d037c735561824805fbf4e71377fa23f1526ede5b8a52bd8560091fac0f948580b715974dd28b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD536e34cfa4456b535bc54a633c29d011d
SHA116269833cbbc024538ce8def273bf6eecc82de3f
SHA256df25ff5da4cd9a93be8e244ff8a40ddbdb9e498b4d3a9d8117af281398ea2516
SHA51217accff171c4b80899f9608bf5ba1ba0ea55782c76d566185fdffb23d1489fdaae8af1016352776ce779cf921a68730b71550e8a9dfe9476ff9c67b3795c8d63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD56110bdf3451ce3175b0e69027770ddb4
SHA137cdc524136adcf938ff3ca91bae7da5b7b95201
SHA25622623fefc527a631ba2b5e3015544f09a22aeb61317a8be06938a00a134820ce
SHA512f893018e2425fbe09cb6bfb3eaddc45ef58bb59e02575466da0dd20bb9ba7aa59b7a3d0ab88ceb64ff23e4e6c5ed94a8e53af9c1d691e58c1d1dcf2bd36a33a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5468de7961adcf925aa9627fdbf6fa366
SHA150f0d6642034bb110c5ca9f5622dcd79ed763f84
SHA256da4e4c1a13abc6900e698b9133ad6e72e6edc62b9fe84f31c57763d498c054ae
SHA512b339c11dbb76277ce1eb9703799f35e307e1cc0a35d6b4a7959bf31cf49cf88cd04872f9fa0312cb4247cea466601f650e886b375e2333660ab0a02160782e26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5f75e7db43e2f6b337c2a8726347471c4
SHA1cae4883d08d20c407f685f12f943728de10fba59
SHA25622668d3b2b968113575b5fcaac28cbb47c792fcb90e3f91b23d01075a2c0e4ba
SHA512f5b7e3b8fc67f6addc038129c60573ecd9fc244b1c32e339d56aa3f0d37bd1df4f4cd31f636671ab3183dc95ff0c857ab4180388735859d09244acd312666a34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5fc2042434f8029b5cee8bdf400b0a502
SHA1a853a426b22b7643aa4e6036a57be362bbb3e8d8
SHA256e7ce6de5aff9c821c82a3ba97a5923b7630007264c51ad6ff7cf502660fea23c
SHA512fdbe40f4e63458fc9d29263575c5898d1c3558656fa457f725df6e39be637f4e38a121fa2108139730e8f2c8ab4d793b98990f50d2e9ee9ef868130c3c5bcfb0
-
C:\Users\Admin\AppData\Local\Temp\Cab80B6.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Cab8174.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Tar80C8.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
C:\Users\Admin\AppData\Local\Temp\Tar8199.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
memory/2984-0-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2984-11-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2984-12-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/2984-8-0x00000000002A0000-0x00000000002A2000-memory.dmpFilesize
8KB
-
memory/2984-4-0x0000000000270000-0x000000000028B000-memory.dmpFilesize
108KB
-
memory/2984-2-0x0000000000435000-0x000000000043A000-memory.dmpFilesize
20KB
-
memory/2984-3-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2984-1-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB