Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
31-05-2024 02:03
Static task
static1
Behavioral task
behavioral1
Sample
85ae6322075411aa058d86bba298d96f_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
85ae6322075411aa058d86bba298d96f_JaffaCakes118.exe
-
Size
458KB
-
MD5
85ae6322075411aa058d86bba298d96f
-
SHA1
ef53ad12f809d57121638e2bc60cb41020f866c0
-
SHA256
84b36e91505fbdfb8cf9b4f04ae8058bcfdcbcd3bb1c3a8f990f7dfff50175c2
-
SHA512
404d2b6081f871e025a1765d26328641112aee55054e4bed623e1f0b3cbe5811ff9c809c9a3d5abf90634b16333cfcd6476a6b784792093939be7c22d350ae72
-
SSDEEP
12288:kVtmGVrCyb33+udup8l6Gx9nL0ybAAblG0Hd:kVthGs+U88l6GX0ybAAblG09
Malware Config
Extracted
gozi
Extracted
gozi
1000
epowjeynol4k7dze.onion
http://sweetlights.at
http://mushroomstreveler.at
-
build
217027
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
worker
-
server_id
12
Signatures
-
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Explorer.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmnccapi = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Corres\\dpnhutil.exe" Explorer.EXE -
Suspicious use of SetThreadContext 4 IoCs
Processes:
85ae6322075411aa058d86bba298d96f_JaffaCakes118.execontrol.exeExplorer.EXEdescription pid process target process PID 2232 set thread context of 2656 2232 85ae6322075411aa058d86bba298d96f_JaffaCakes118.exe control.exe PID 2656 set thread context of 1208 2656 control.exe Explorer.EXE PID 2656 set thread context of 2672 2656 control.exe rundll32.exe PID 1208 set thread context of 2096 1208 Explorer.EXE cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
85ae6322075411aa058d86bba298d96f_JaffaCakes118.exeExplorer.EXEpid process 2232 85ae6322075411aa058d86bba298d96f_JaffaCakes118.exe 1208 Explorer.EXE -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
85ae6322075411aa058d86bba298d96f_JaffaCakes118.execontrol.exeExplorer.EXEpid process 2232 85ae6322075411aa058d86bba298d96f_JaffaCakes118.exe 2656 control.exe 2656 control.exe 1208 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
85ae6322075411aa058d86bba298d96f_JaffaCakes118.execontrol.exeExplorer.EXEcmd.exedescription pid process target process PID 2232 wrote to memory of 2656 2232 85ae6322075411aa058d86bba298d96f_JaffaCakes118.exe control.exe PID 2232 wrote to memory of 2656 2232 85ae6322075411aa058d86bba298d96f_JaffaCakes118.exe control.exe PID 2232 wrote to memory of 2656 2232 85ae6322075411aa058d86bba298d96f_JaffaCakes118.exe control.exe PID 2232 wrote to memory of 2656 2232 85ae6322075411aa058d86bba298d96f_JaffaCakes118.exe control.exe PID 2232 wrote to memory of 2656 2232 85ae6322075411aa058d86bba298d96f_JaffaCakes118.exe control.exe PID 2232 wrote to memory of 2656 2232 85ae6322075411aa058d86bba298d96f_JaffaCakes118.exe control.exe PID 2232 wrote to memory of 2656 2232 85ae6322075411aa058d86bba298d96f_JaffaCakes118.exe control.exe PID 2656 wrote to memory of 1208 2656 control.exe Explorer.EXE PID 2656 wrote to memory of 1208 2656 control.exe Explorer.EXE PID 2656 wrote to memory of 1208 2656 control.exe Explorer.EXE PID 2656 wrote to memory of 2672 2656 control.exe rundll32.exe PID 2656 wrote to memory of 2672 2656 control.exe rundll32.exe PID 2656 wrote to memory of 2672 2656 control.exe rundll32.exe PID 2656 wrote to memory of 2672 2656 control.exe rundll32.exe PID 2656 wrote to memory of 2672 2656 control.exe rundll32.exe PID 2656 wrote to memory of 2672 2656 control.exe rundll32.exe PID 1208 wrote to memory of 3044 1208 Explorer.EXE cmd.exe PID 1208 wrote to memory of 3044 1208 Explorer.EXE cmd.exe PID 1208 wrote to memory of 3044 1208 Explorer.EXE cmd.exe PID 3044 wrote to memory of 1616 3044 cmd.exe nslookup.exe PID 3044 wrote to memory of 1616 3044 cmd.exe nslookup.exe PID 3044 wrote to memory of 1616 3044 cmd.exe nslookup.exe PID 1208 wrote to memory of 3056 1208 Explorer.EXE cmd.exe PID 1208 wrote to memory of 3056 1208 Explorer.EXE cmd.exe PID 1208 wrote to memory of 3056 1208 Explorer.EXE cmd.exe PID 1208 wrote to memory of 2096 1208 Explorer.EXE cmd.exe PID 1208 wrote to memory of 2096 1208 Explorer.EXE cmd.exe PID 1208 wrote to memory of 2096 1208 Explorer.EXE cmd.exe PID 1208 wrote to memory of 2096 1208 Explorer.EXE cmd.exe PID 1208 wrote to memory of 2096 1208 Explorer.EXE cmd.exe PID 1208 wrote to memory of 2096 1208 Explorer.EXE cmd.exe PID 1208 wrote to memory of 2096 1208 Explorer.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\85ae6322075411aa058d86bba298d96f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\85ae6322075411aa058d86bba298d96f_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\control.exeC:\Windows\system32\control.exe /?3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL /?4⤵
-
C:\Windows\system32\cmd.execmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\2E04.bi1"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\nslookup.exenslookup myip.opendns.com resolver1.opendns.com3⤵
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\2E04.bi1"2⤵
-
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2E04.bi1Filesize
111B
MD517900f543f673fc2e57bb0116a6af5af
SHA14738418078e5213f660191c7fbfc5bc0beb5a6eb
SHA2563d644ae23d5a90d7b4caf7dcfededf77593dcf8fe55052fd945768ca94a426a3
SHA512847ee496601bc4eda51933a0353a63fa13b53dbe419b2d2a5c7325ab7bcefddcc25c83680cc3f2a38a015e3e8cd4940c38d2a52702a2da60f510ebdeab80dbc1
-
C:\Users\Admin\AppData\Local\Temp\2E04.bi1Filesize
122B
MD586ae6b510c19228190f4b797503ce192
SHA10a6c67bc4f36fcdaa7a553f9ff9ae439f13b32d1
SHA256be8c30a0e245b6d86db1e7bdf04b8cfa3117846d5b88f6d476066041eaea1c3a
SHA512bec76ed958ccf192f26b2eb9250f02ce2cf04318cc4f51d30cbbd24b96de172f4f26bbac018938ebd2f7c38f70e70def8d8f6b0e9b473b3a32bbe252449e3dd5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Corres\dpnhutil.exeFilesize
458KB
MD585ae6322075411aa058d86bba298d96f
SHA1ef53ad12f809d57121638e2bc60cb41020f866c0
SHA25684b36e91505fbdfb8cf9b4f04ae8058bcfdcbcd3bb1c3a8f990f7dfff50175c2
SHA512404d2b6081f871e025a1765d26328641112aee55054e4bed623e1f0b3cbe5811ff9c809c9a3d5abf90634b16333cfcd6476a6b784792093939be7c22d350ae72
-
memory/1208-63-0x00000000047B0000-0x0000000004861000-memory.dmpFilesize
708KB
-
memory/1208-30-0x00000000047B0000-0x0000000004861000-memory.dmpFilesize
708KB
-
memory/1208-56-0x00000000047B0000-0x0000000004861000-memory.dmpFilesize
708KB
-
memory/1208-40-0x00000000047B0000-0x0000000004861000-memory.dmpFilesize
708KB
-
memory/1208-62-0x00000000047B0000-0x0000000004861000-memory.dmpFilesize
708KB
-
memory/1208-60-0x00000000047B0000-0x0000000004861000-memory.dmpFilesize
708KB
-
memory/1208-29-0x00000000047B0000-0x0000000004861000-memory.dmpFilesize
708KB
-
memory/1208-23-0x00000000047B0000-0x0000000004861000-memory.dmpFilesize
708KB
-
memory/1208-33-0x00000000047B0000-0x0000000004861000-memory.dmpFilesize
708KB
-
memory/1208-32-0x00000000047B0000-0x0000000004861000-memory.dmpFilesize
708KB
-
memory/1208-31-0x00000000047B0000-0x0000000004861000-memory.dmpFilesize
708KB
-
memory/1208-34-0x00000000047B0000-0x0000000004861000-memory.dmpFilesize
708KB
-
memory/1208-39-0x00000000047B0000-0x0000000004861000-memory.dmpFilesize
708KB
-
memory/1208-38-0x0000000002580000-0x0000000002581000-memory.dmpFilesize
4KB
-
memory/1208-37-0x00000000047B0000-0x0000000004861000-memory.dmpFilesize
708KB
-
memory/2096-57-0x00000000002E0000-0x0000000000384000-memory.dmpFilesize
656KB
-
memory/2232-2-0x0000000000480000-0x00000000004C9000-memory.dmpFilesize
292KB
-
memory/2232-5-0x0000000000540000-0x000000000058A000-memory.dmpFilesize
296KB
-
memory/2232-1-0x0000000000270000-0x0000000000370000-memory.dmpFilesize
1024KB
-
memory/2232-4-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/2232-12-0x0000000000540000-0x000000000058A000-memory.dmpFilesize
296KB
-
memory/2232-3-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/2656-21-0x00000000000F0000-0x00000000000F1000-memory.dmpFilesize
4KB
-
memory/2656-50-0x00000000001F0000-0x00000000002A1000-memory.dmpFilesize
708KB
-
memory/2656-25-0x00000000001F0000-0x00000000002A1000-memory.dmpFilesize
708KB
-
memory/2656-22-0x00000000001F0000-0x00000000002A1000-memory.dmpFilesize
708KB
-
memory/2656-15-0x00000000001F0000-0x00000000002A1000-memory.dmpFilesize
708KB
-
memory/2656-14-0x000007FFFFFD3000-0x000007FFFFFD4000-memory.dmpFilesize
4KB
-
memory/2672-48-0x00000000001E0000-0x0000000000291000-memory.dmpFilesize
708KB
-
memory/2672-49-0x00000000001E0000-0x0000000000291000-memory.dmpFilesize
708KB
-
memory/2672-42-0x00000000001E0000-0x0000000000291000-memory.dmpFilesize
708KB
-
memory/2672-47-0x0000000000180000-0x0000000000181000-memory.dmpFilesize
4KB
-
memory/2672-41-0x000007FFFFFD7000-0x000007FFFFFD8000-memory.dmpFilesize
4KB