Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09-05-2024 16:28
Static task
static1
Behavioral task
behavioral1
Sample
2ad9ac02ddbd161671b8f49d07d4a029_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
2ad9ac02ddbd161671b8f49d07d4a029_JaffaCakes118.exe
-
Size
203KB
-
MD5
2ad9ac02ddbd161671b8f49d07d4a029
-
SHA1
4771302dd9f46ecce1cd6f8b8fa6e489c38f858e
-
SHA256
62def0e10623e269ef0b5e4e02dad924498747ae3213269ee21d505fd19c44fc
-
SHA512
1df7a8d4d0488f3864eb62785f0cf5ea6dd45a0dcdc6a16def09ca681d1701e64ba668a907a1c2b7bcae5cea1956e05d464b2d06204c1f31b98cbbdabca6f61d
-
SSDEEP
3072:9/ji2dQ6v4uPXDNUj4jKBonzmLXlYVRLh0epEEZqkFBc4+uTqN76o:9Ddp4uPZzGonqXGXh0bluBc4GZ5
Malware Config
Extracted
gozi
-
build
215165
Extracted
gozi
3162
menehleibe.com
liemuteste.com
thulligend.com
-
build
215165
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
loader
-
server_id
12
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f042ad042ea2da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000cccf3b670abf1c154b56d810899fdb9ee03122f8c5b79a4ba83b2d0cd1b3e8f3000000000e8000000002000020000000f78c720e05569231db6b3b64089adb2ac726d801f93098f733dff7989cfeb35c900000006ab9e8985030d9ba22f2e60528246731936e52fc51066f7cd9a6a2ec4434613f6a9b84fceef883fee8291eeef30f4f8f490b7016d2dae4124df919c7601317fdd56e474fdd9ffdc66cdfdfec8a17ae820e7b82fbae0c6d8922ddbde012e718426ea6f121369ef7f26b87cba6c542bbfa05341589795a487db312ddb3bc8b0bcbde7cdd581d4f9f511501e1ee9916b274400000006a4d9047c01fa8a4234308756b02ab4c835d81550259cd64d01f610c488b0238bef9cc6e1f8b332fbb5ac532db443b73ee208789d37ed311cfb96dc736912806 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2FDDBF91-0E21-11EF-B1D1-D2EFD46A7D0E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000007350096dec7c2d85780ba13e0cf735870bfdb62d067591ada1d7f2a490c0e147000000000e8000000002000020000000351e49ba8b260a0b035b4f790735aa441c77155f11e6128229b2c9815e532a2a200000007b2fb398faedf90a494a00276dfa11abb20c99bcaf97472f10c6030eea5448be400000004e6edf187e4bef05f99ca5efb8792069cbf1a5d650912e0aa09dd368d579c027c4cf121a5c31ba75afb865aad907477d5086548884005b29a91877c8b6f8ca49 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2872 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2872 iexplore.exe 2872 iexplore.exe 2484 IEXPLORE.EXE 2484 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2872 wrote to memory of 2484 2872 iexplore.exe IEXPLORE.EXE PID 2872 wrote to memory of 2484 2872 iexplore.exe IEXPLORE.EXE PID 2872 wrote to memory of 2484 2872 iexplore.exe IEXPLORE.EXE PID 2872 wrote to memory of 2484 2872 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ad9ac02ddbd161671b8f49d07d4a029_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2ad9ac02ddbd161671b8f49d07d4a029_JaffaCakes118.exe"1⤵PID:2864
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2484
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD54c5871f39bd142a95b0073a55ea03e33
SHA1fdc21c61d6830ff30966f99e27186525a84c9966
SHA256670a60c2dee2e986c80a2ece596ffe4634a2ea3c48788c9693230e03b0ee9176
SHA512b26df51224e05248616d9875ef8408aacf8a87f02d9dbc394b05fe5961c946aab7a7941b04798843e3d58b1090ef4c9d0395767e89883d7243997f4a27df6dd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5cb930afd88d204b33451de3274c56b88
SHA1ac0208aa2349308b85abd84d89d3063842b7fd43
SHA25674e8108539cc1f2164416d2da7b5b80d05b4253228b92a0b4e91df8360469b4d
SHA5124d652c5bf07ba085410fef807f920e0d269e233d17e4e3816cf6fe41ec42936987be3e205d93e1e73a1d89fb8dfe581fa9bc4115fccf89ea15f0e1feb59d73be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD52cc00c75184910d97d6236287def091c
SHA1fba3dd5736eb289163a77672a56bcc6168518335
SHA256bd038617e14e615d92bc72d5d4b4adc22e9834deb3aa785d5a8efc2576d28e79
SHA512a6bf7605999ff009359b3d02cf8b4e4d89f665a287ff26106c62b747381e3412786367a8eb8346640268cdd00c434f27535666bd000cfc71ec9bdb5baa9bfa72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD504881079c511e5f1dfc25b88202f16be
SHA125bd7eda97db19caa9bc9fcd4f1a30ce9950d739
SHA25609d47b167a94b3d466f364dbcd773835859f6de318370a9fa4ca1ddf63cc8fe8
SHA51284701fec392739fe3f671f8e27793699cecd6cf356f0a3f3678826a03adcc2b8654a155ed0487713d7234ac441169780a5f69b36e549add36dd358399b9849bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD539cc38bea2e048588b7b786189bc93d1
SHA10d887969567a0586cd8232cd53755ae79edab0f5
SHA256a43438db170747544dea4b4cb85821c511206a3444dc87c658124e54fc4758bb
SHA512ce5a2e26c0146bbd39a4c0a478d8a2462699f9f613b5e6fde8175714438f0e7f978e5f1ef5fa64b3be6e0a54e83ec3867831f47fe75180ac4e7260f3ddfcd1ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD52acfbb80ab737857f94147f8121b00ce
SHA101c0f7884797f6c719ff5c08aba98ffa3bf18287
SHA2562367da6f462fa0b47f2c98ccda6c29616ad2e3b3d1fdc2a651d822003b400745
SHA512ce95c7b67b25136455653d4436fb032438c2ef0a891287acca1d2ebb846591c438e1e1aa1773e08b5b1d1381cc84dcea537e56b08fc3a65d85b6c06b506139f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD51d729933769f33afba370c6b75c01c70
SHA145f88e177cefccbd29f8ea056799c785d013c744
SHA2568e752b6f4e961b179dedce946ad3a9f68d75bb567bdfce691d3dba21964b5806
SHA5120ea56d729455e8cd6353d0b034a4f13f52d8c3786b17265b839dde0deaa1402ed609450199c59df17fa321b3c4e554061a7787e54a12e5d92cbeab93f3bd23bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD54f911dc03d71153fa7333cf1084ab9fd
SHA137094332e40a7c96b5ea67a7531362854c72306b
SHA25672e04e882e936a1edce5ac3073cb0e619b124e08acac9929abb2ae3f40c27d28
SHA512548fe089b5dfd06ff2fc939a3e2802eb5a43cc3e83492c68a40e1fb07329d865db57866fede208b88f279f05bc3d502f3cdf393615804b87012e72624b0f0e9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD573a2f2abb28973e7d19c032cc5bf2739
SHA180d49bd480da6d70b3febe27d41d574e9cf28840
SHA25628b427aefb5e0a2805cc29a3721dea1eaec00f0493aea49013a7d17139e6fd06
SHA51249655be00f39a5830cd76a7c26bd018710f681c694e3e6d2572bf95f6845fe3ffd16981e459f9c04ecdbad3e40481b2e5b435c9f75a56dc3699813f4dc0539b0
-
C:\Users\Admin\AppData\Local\Temp\Cab93D8.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Cab9497.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Tar93DB.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
C:\Users\Admin\AppData\Local\Temp\Tar94AB.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
memory/2864-0-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2864-13-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/2864-8-0x00000000003C0000-0x00000000003C2000-memory.dmpFilesize
8KB
-
memory/2864-4-0x0000000000270000-0x000000000028B000-memory.dmpFilesize
108KB
-
memory/2864-2-0x0000000000435000-0x000000000043A000-memory.dmpFilesize
20KB
-
memory/2864-3-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2864-1-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB