Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
31-05-2024 13:03
Static task
static1
Behavioral task
behavioral1
Sample
86c3cdfe9de317a5cb77ff378de4312aJaffaCakes118.exe
Resource
win7-20240419-en
General
-
Target
86c3cdfe9de317a5cb77ff378de4312aJaffaCakes118.exe
-
Size
203KB
-
MD5
86c3cdfe9de317a5cb77ff378de4312a
-
SHA1
4095d6167b43ab660101346b067e46fff728f45f
-
SHA256
649ad032ec2dbe0ce2eec2de332e5a555e02bdf08607e58663af21722eb00919
-
SHA512
5963c0f901e61367116086d4ee91c2fcbb85c934750e676760bd715260d5e11f9478a4c6ded9f1be59dbd2c06d7e748bec3b1ec12c2a205da42ec2590ff4b37d
-
SSDEEP
3072:9bji2dQ6v4uPXDNUj4jKBonzmLXlYVRLh0epEEZqkFBc4+uTqN76o:9vdp4uPZzGonqXGXh0bluBc4GZ5
Malware Config
Extracted
gozi
-
build
215165
Extracted
gozi
3162
menehleibe.com
liemuteste.com
thulligend.com
-
build
215165
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
loader
-
server_id
12
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0b4f2015bb3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000c1bf0de6a7a7f299c1440d7579ee6811e23a136c9333b49433e988bf8bf436c8000000000e800000000200002000000034522ea05cfcf1478e6a27cb97c7381291ceb725f3d18072e1991f085840001820000000fc8b57e48ba0d26d3c09a144fcc6deda45170b23955c14a70b15cb24fc24386b400000005464bf28005931bb520a9b81cfa5cc03ce4088882de726cd37c787bfda9a2c28a79354df566b49587de5c12d6991e7946669545b3ddd5eacd8d447baa2091cbd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2D52C521-1F4E-11EF-AB95-422D877631E1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000006855a9c832ef0f95596f6c8485ef2c9d4ab9c1d3cc48b727614979bbeb63575b000000000e80000000020000200000003a448ed324c8f67fcf13fd594c7cc4dc5e2051d2fa1d305e3a13c328a70f068e9000000085bf1d55fb39a3bdc89d8559c860627de46a9fe1d472ea7485a891ae160dde1518887fdf2bf3e5cb85910116df02bda50fabb26d7b470f36afd2cbe6721237a35508b56df0f9fc1dcbd8d90cf296416f16d9cccdd4713f4e112f06b017edb1ba3d802c8a7f2efa7c1434218dbe87e97a30755a7786962456a3f59bc114709a9bd651322870b016bbeff35210596a77444000000064e654daef84c15bcf5f20e34177df32d3566e3d54a4f5686a5505b991a519c7f2a6b143309fb4cbe26ec7f684bc35fe57a57500938c7e375737952150e87148 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2684 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2684 iexplore.exe 2684 iexplore.exe 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2684 wrote to memory of 2508 2684 iexplore.exe IEXPLORE.EXE PID 2684 wrote to memory of 2508 2684 iexplore.exe IEXPLORE.EXE PID 2684 wrote to memory of 2508 2684 iexplore.exe IEXPLORE.EXE PID 2684 wrote to memory of 2508 2684 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\86c3cdfe9de317a5cb77ff378de4312aJaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\86c3cdfe9de317a5cb77ff378de4312aJaffaCakes118.exe"1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2684 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5bce7ac56dcd720d74a7e1bf7db777e2f
SHA19e522635f31cd3d0833985fd6c03f72ad92ecf69
SHA256b73f227ea3c6cee06514c9ffd5ed088f20415716dd48dd733db3182a980a3fcc
SHA512b78b8584b223cec2661e3230f1ea8f36a54f5107696d35e4ac1372ca3113f2bbf81267fb4f1123ec4d49eb7464d803f805908ce96f7c893c30458ee56d07cbb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD57a3046355a70390255bbedf88940760a
SHA1dde761a389ab1ac47b6113c1bb99a6576acf72d3
SHA256930cdb82a8e33113888caba4c932c145f9c3080788e1f48895b5ee6a2c58509d
SHA512549a52c887acabf65ab0ce0bee53474c155ac3824d29a22fd3167fb8ff04245606f21b81ea5a386b19691aa8d07a629a8f80d8913a3891c6dbe6cc255ac6f88a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD599b3d6ac7ec9ebe3243b91344e4f5713
SHA173ab3033a9dcb9057efbaceb0e3e6d8b97016054
SHA2569cd3c6397753b89d91dac44598104b1b6ceb6e1e5c35c6edd4f2778618470ef5
SHA512c68fd0c823856775704579ea0576c0574ffbbe97f0b2e22d69f70780dbb2600a690de25a1387f0b8b96288cc073589a37d4522ea3ca9a320451e20e95b977019
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD562617eb89c92d808532eedc6b33a995a
SHA193b4493fc94366a6f0ef35aeff53c31a6fe6c027
SHA256cf054480f68ffeb928dc396cfa53e9813137889622bbcfa6038e7f77c8d7a414
SHA5129b3c60922ae381d95874012320669afd04721575798d9aee799056b1416687ac044388da63111a51961781225ba3a3301788c144fdabf3bbcfb621a7a7d58825
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5f1e45aaf25a91a84e79413891ebabd6a
SHA18ed4b2975d6fc6626eb8abcae391670711acf94c
SHA2563bceb1d59baaf0f4badbd48311cad71c889eff0a07e6c0ddba94eb1d934bd4b6
SHA51266403b2423f791d0b24698609f624f717bb3c67ab894fc81dbd93248f9b37287561b7981d2dff00f35bdc8f6dc78c595f95dce219e657536c4ddf3cc05091ac1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD55a58af5b3ae1bca6e16d83c7184ad1ae
SHA1b804fb85bc83a6e67a97b613667141730685175f
SHA256bb840387ebd25cf25ea777482d8e0d43e9a3e7bd44bd33ad28009869a64066ed
SHA51289d9bace8191ccc320db819e43494c2496fcc288cd5e2ea9a565e1e1edf1247dbe7d0f2bf49a76a47c540de92d68532de57ddbf0bd0f19c36d05fa5f3e64ca78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD50b00ade613715b9b5f9c25d84243872e
SHA1c3fc607bc98633b98dea3e7f055a56edb829996d
SHA256692385f4d31d8ef863690e1405ae15175d94c85dd06e79294dd6069b6cf48c62
SHA51281ffe8a08cf02b83667a4efc2c251841b44ff2206bd6b0d654a2f9c229b16ae384824b4d96f0ea3c8f46482e80571b133d468bd85e2a4a79d583743993d57284
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD521be9d8cac48f70ace015ed6146f20c3
SHA1a0724e5c7ff951f1469b0142976346ae5aa9406c
SHA2561faae2edf3525523673f0ed0dd40fa18d944590aa04990f7aaf412cc29bd7719
SHA5127241431784a0a5249f10c6e04619ebd846648383ebed1ccae169af2c4b1576354881abe1a141f0a2bf9bd6771a70e41c4aa1d7a6c80baf133752b7e3c7ea36bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD547d1fe024cd2cdf12d7f488906572d61
SHA1ac3e3850124ca06e11b5eb37ce1180e5f7aed61b
SHA2562700cb0b4725702b7fa7951b046b840037248e7e4db88229b4016108484e4cd9
SHA5125879c0d882202366e3c311d0f7b18e59222708b6bcafce8bc723d9c78afe36a758a34bbdf596a3e649d71c5b5d51097429c759e6ff5cbe07d79a5f500dc3219a
-
C:\Users\Admin\AppData\Local\Temp\Cab7A4F.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Tar7A62.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Local\Temp\Tar7AC5.tmpFilesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
memory/1180-0-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/1180-18-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/1180-8-0x00000000002A0000-0x00000000002A2000-memory.dmpFilesize
8KB
-
memory/1180-4-0x0000000000270000-0x000000000028B000-memory.dmpFilesize
108KB
-
memory/1180-2-0x0000000000435000-0x000000000043A000-memory.dmpFilesize
20KB
-
memory/1180-3-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/1180-1-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB