Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-05-2024 02:40
Static task
static1
Behavioral task
behavioral1
Sample
4437181d49e96f3274f19f142a5718a1_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
4437181d49e96f3274f19f142a5718a1_JaffaCakes118.exe
-
Size
203KB
-
MD5
4437181d49e96f3274f19f142a5718a1
-
SHA1
4c95f579dccc69282090f4ddc89cd73c7aa22b47
-
SHA256
419550a6e4d323506dac1a43c9cf40cf019b3965354e711f253afef12fd57fa6
-
SHA512
53c41e6be9c13df149b8ea19864e32945c96cf1d1adf4cc32a33e7af81699595f4072bc3a538ff686d06697f5f6071101b91891db052b2f0feb400138b501564
-
SSDEEP
3072:9Vji2dQ6v4uPXDNUj4jKBonzmLXlYVRLh0epEEZqkFBc4+uTqN76o:95dp4uPZzGonqXGXh0bluBc4GZ5
Malware Config
Extracted
gozi
-
build
215165
Extracted
gozi
3162
menehleibe.com
liemuteste.com
thulligend.com
-
build
215165
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
loader
-
server_id
12
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000948910295d9bb0e21943b08250dc555b89fd69bd2596947a8403e3be7e6551fd000000000e8000000002000020000000b11279394ae8077cbd13a7ca102d175fab5e4dda1836d05385eead1d0ee47881900000000cc88e474bf03190b7f8bfe32add25425e99a6e5bce182fe634eb69df63da60277f532508a1da15a77b5939a2647f5ea0096f5133507a03e730d06762f3d70533eab09ca5f3d3536754fa842e9c90d9bad43b82fff75b1618b2d41a4398f3a4640c888d8d098a5c7978a6af94278180656ec3a7a1b23fe9e95acab7ff2e5896bb6e31c197e9d5b1e691986a4e08b017e400000008b3d27b0eafb5c22c879d8f53a7f9666fe7a6cf9c6685879ab92938f198b126c3e24fba963dd95d160fc924910901c534ad064904c11145b9876f5f08a5c437e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 305d225271a6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7D5070A1-1264-11EF-A564-5267BFD3BAD1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000a8e8c42c02edf4a253e0c61fef1109b19205781ba1ec34f9ca5909a85988e61e000000000e800000000200002000000091409a5603729ca777eb0f4bf3d57d97321860d0301562e94c3c0aa3cd3a90a820000000d178c0e4c3e74abb06a00b808366eebefdfbbbb5750d506b9f5f0269ba5ebd1b40000000a86231f9427c8dd6b83460acd118f826f829a8b3fa1153064d5ee11bc929defb7ffb8fc44645d4c6edc0174c6ff80736eeff46f1731bac5025dc356a1260cc94 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2032 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2032 iexplore.exe 2032 iexplore.exe 2488 IEXPLORE.EXE 2488 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2032 wrote to memory of 2488 2032 iexplore.exe IEXPLORE.EXE PID 2032 wrote to memory of 2488 2032 iexplore.exe IEXPLORE.EXE PID 2032 wrote to memory of 2488 2032 iexplore.exe IEXPLORE.EXE PID 2032 wrote to memory of 2488 2032 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\4437181d49e96f3274f19f142a5718a1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4437181d49e96f3274f19f142a5718a1_JaffaCakes118.exe"1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d4c76fedb09e265e75391802dcef2109
SHA1f8ade869874351a9615bb8829973ead9a864a889
SHA25676e5322a68313a2297916f2a363ccff1434b09633223138230622ea1223a9dab
SHA5121032c929c7ce40a071840106f16151add641277fa8b39ba87b2e5a55ddc53b311dc10d499c1f011d538bcba4a99acac61f5c1edb52b978dba81eff63621237a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d82e422e70fcea31a7adb361d724a5c4
SHA1bb13018df86902d4b92fd02b55687017b2bd46a5
SHA25665fd2ae8638c3dfe07a0dd919afa6ae5e5c53eb0ceff5daa59aa1df29a22364e
SHA512ecb675fb56decee96565b00b2b5fdc021690762b0eca9d3c6dd375e60f9bd5b5963c218d7533bd26b1d7345d7201496c06f0249c375bbe5862b7dc3236d43413
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD54400ecafbe8c1ad331062c885656f835
SHA156f02960154ce7937a0bc534299db1df9579b673
SHA2567f20e2cbfec0b9d89c34775b8fb8cdaf66f933d76c821e4140a080152146fa8a
SHA512524e891b6ecde45c3927b707c9fb038462cad0519bdc37bcf3581fbc97f0a3a7500087ddb256325a4f8a776a2fbbd7012dadf589fb1de569cfd7d0416b0a7de9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD50726d72d3296b30664e2afe445e92eed
SHA1e7cd165dca49eecf97250d60299a9b2731104003
SHA25622267ee279c7385123ee835c12aa988c4efa54b6123ca4163d4e94ab8211ba7a
SHA512b1c23ad0640e4e3eb3363007df65b9c0c8216e9e154477f650aa7cbdf5297d804dde1e4b3f239e5cef3f6a799bb57a48e953385acf32aea3f21d2f7760c3aa39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5ee3eb180e08aecc47adabc9562955b3f
SHA124c6b01aa58280190186d2cc998aa7725554a413
SHA256f55b43d1c12aafa2386cbc3fef607f39553fd0cb0b853723a6e223d682ef13dc
SHA512d05fd7fa65fb1b67d73dda10eb3bfe574a1bc64be4b5e9cc37e4c631d11a644b551178713c65b72dfa68b0e06bd3c77a19234e19799da020e96c886c97589ee9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5cbb2e08644f03f2fc52a63f26150f1c2
SHA13264cdbdeb4b7700d61c032e89454adb0a107efa
SHA25671726ea9df6868e49bb5932e89b5f99b373d863b07dda2bf8ab556ab31e6cbff
SHA51268a27165f1418ebdf64eb224d2677ecca083cda39dd86a1e9d39b16c8d88dadcf87e697318dd334401cb357e039f31206576928025eea96d81f0ea32bf5bcacc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD56eeb4df9645f6f9062eea1dea123f0bf
SHA1a4e575bdee644bbc53d92089c6139bba5a885844
SHA2560ec354101e5ce8a8605f9e64479a95960d100978c7f3829d98bd907f03da3db8
SHA512e42e26a410b6d3b1093dd5894389975bc8c679eb04055f823169b12a21d4816b271e3620159c1924ade33d8d8f46542892b2a66cd0f708dd25b4d08bc3616590
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5bef3a1b2e7bab97c7abbc9868e52a3c9
SHA1fc8ae5a66f1f3558ce591034ece6a94c19db99cf
SHA256ca6ddc44fdfa74e910e87e894eb1251fe63e00522a576417ad6ed7f2881dfd43
SHA5127034932491c5da4dc1796db6a1e17d3e0ff2384321ac6c92f16bca7f4c090c676561cad6cfbe63484ff32c3af47e4a570ec2e36af4da94015339baefc7013684
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5906e0285aa14518b403959b5c89e9725
SHA1e0e25641075e3abaaab0d7602ab680779e5bf334
SHA256ad210a361f45b8555e2baf4c7810a813038d6b12e3c239f2e8c4b794caf7c7e5
SHA5125ec99b367c92ce2e6d547cae16d605ac7c5e5d0c1c27dab7b6c679bc7b0b5c71b909566265104a8cd0da7641b78bbe79b1eb6d783d4a909e676d9df9d7751a82
-
C:\Users\Admin\AppData\Local\Temp\CabA120.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\TarA133.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
C:\Users\Admin\AppData\Local\Temp\TarA1E5.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
memory/2000-0-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2000-20-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/2000-8-0x0000000000360000-0x0000000000362000-memory.dmpFilesize
8KB
-
memory/2000-4-0x0000000000270000-0x000000000028B000-memory.dmpFilesize
108KB
-
memory/2000-2-0x0000000000435000-0x000000000043A000-memory.dmpFilesize
20KB
-
memory/2000-3-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2000-1-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB