Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
04-06-2024 07:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe
-
Size
190KB
-
MD5
93feb4f8eb80e9f02595ccfd85a51b69
-
SHA1
5ab52eb607575c44a64afbbac0f2ca12af696500
-
SHA256
502d9d30c00e3fefd740634b408fe446dcfc703e5029dd7bc53d00bd051262a2
-
SHA512
8894414f408cc1ca2405dbcbbf860fdcb67cb377f7bde9c75cc5385a2f7a9f7ec498054b83b206c89e1443b5588d333094cc2506390ee080b6209c9d4e5d8217
-
SSDEEP
3072:0MdMOtaCoecOd4IFEt0qM2e/0sb6Mzqjq6dGZEmAh6AbP4FQNHZ:0/vyc+4IeFMqsuMSdGlAwAbwC
Malware Config
Extracted
Family
gootkit
Botnet
2856
C2
it.its1ofakind.net
zgzimtkwotm2.top
Attributes
-
vendor_id
2856
Signatures
-
Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3" 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4328 wrote to memory of 3116 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 82 PID 4328 wrote to memory of 3116 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 82 PID 4328 wrote to memory of 3116 4328 93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe"1⤵
- Modifies Internet Explorer Protected Mode
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\93feb4f8eb80e9f02595ccfd85a51b69_JaffaCakes118.exe --vwxyz2⤵PID:3116
-