Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04-06-2024 11:05
Static task
static1
Behavioral task
behavioral1
Sample
94991507c04f29915d7afeb6a1ce2c0b_JaffaCakes118.exe
Resource
win7-20240419-en
General
-
Target
94991507c04f29915d7afeb6a1ce2c0b_JaffaCakes118.exe
-
Size
429KB
-
MD5
94991507c04f29915d7afeb6a1ce2c0b
-
SHA1
bb71a4a11a793cd6e4554e6cfa415bc93509599d
-
SHA256
0369d29e8f8ac8c5408ade862673a5220f39e9f79cf68ad4d0e692c843e3ff9f
-
SHA512
b1df63faa49c0f5aed4973375e2b70da477126f1b651418be038ba66ddadee7e89cf20db56504e0d8d42a01490cc6312613c72e82056ed1ade4af6693df734b0
-
SSDEEP
12288:gErZ1tp5Be+DDqzzATxOife+iOANdt8DKxvqcldx/oVIY:gE9x5bXE8oif9U8DKRqEdx/x
Malware Config
Extracted
gozi
Extracted
gozi
10030
jscallowallowallowjcli.me
disallowjscuserallow.pw
-
build
215790
-
dga_base_url
z1.zedo.com/robots.txt
-
dga_crc
0x246640bb
-
exe_type
worker
-
server_id
12
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
94991507c04f29915d7afeb6a1ce2c0b_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 94991507c04f29915d7afeb6a1ce2c0b_JaffaCakes118.exe -
Deletes itself 1 IoCs
Processes:
CIWmnect.exepid process 4996 CIWmnect.exe -
Executes dropped EXE 1 IoCs
Processes:
CIWmnect.exepid process 4996 CIWmnect.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
94991507c04f29915d7afeb6a1ce2c0b_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\avifApis = "C:\\Users\\Admin\\AppData\\Roaming\\AzSqcatq\\CIWmnect.exe" 94991507c04f29915d7afeb6a1ce2c0b_JaffaCakes118.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
CIWmnect.exesvchost.exeExplorer.EXEdescription pid process target process PID 4996 set thread context of 4744 4996 CIWmnect.exe svchost.exe PID 4744 set thread context of 3544 4744 svchost.exe Explorer.EXE PID 3544 set thread context of 4072 3544 Explorer.EXE RuntimeBroker.exe PID 3544 set thread context of 3944 3544 Explorer.EXE RuntimeBroker.exe PID 3544 set thread context of 2376 3544 Explorer.EXE RuntimeBroker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 5 IoCs
Processes:
Explorer.EXERuntimeBroker.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\ManagedByApp RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\MostRecentlyUsed RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\CurrentWorkingDirectory RuntimeBroker.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
CIWmnect.exeExplorer.EXEpid process 4996 CIWmnect.exe 4996 CIWmnect.exe 3544 Explorer.EXE 3544 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
CIWmnect.exesvchost.exeExplorer.EXEpid process 4996 CIWmnect.exe 4744 svchost.exe 3544 Explorer.EXE 3544 Explorer.EXE 3544 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
Explorer.EXERuntimeBroker.exedescription pid process Token: SeShutdownPrivilege 3544 Explorer.EXE Token: SeCreatePagefilePrivilege 3544 Explorer.EXE Token: SeShutdownPrivilege 3544 Explorer.EXE Token: SeCreatePagefilePrivilege 3544 Explorer.EXE Token: SeShutdownPrivilege 3544 Explorer.EXE Token: SeCreatePagefilePrivilege 3544 Explorer.EXE Token: SeShutdownPrivilege 4072 RuntimeBroker.exe Token: SeShutdownPrivilege 4072 RuntimeBroker.exe Token: SeShutdownPrivilege 4072 RuntimeBroker.exe Token: SeShutdownPrivilege 4072 RuntimeBroker.exe Token: SeShutdownPrivilege 4072 RuntimeBroker.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 3544 Explorer.EXE 3544 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Explorer.EXEpid process 3544 Explorer.EXE -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
94991507c04f29915d7afeb6a1ce2c0b_JaffaCakes118.execmd.execmd.exeCIWmnect.exesvchost.exeExplorer.EXEdescription pid process target process PID 220 wrote to memory of 1652 220 94991507c04f29915d7afeb6a1ce2c0b_JaffaCakes118.exe cmd.exe PID 220 wrote to memory of 1652 220 94991507c04f29915d7afeb6a1ce2c0b_JaffaCakes118.exe cmd.exe PID 220 wrote to memory of 1652 220 94991507c04f29915d7afeb6a1ce2c0b_JaffaCakes118.exe cmd.exe PID 1652 wrote to memory of 3152 1652 cmd.exe cmd.exe PID 1652 wrote to memory of 3152 1652 cmd.exe cmd.exe PID 1652 wrote to memory of 3152 1652 cmd.exe cmd.exe PID 3152 wrote to memory of 4996 3152 cmd.exe CIWmnect.exe PID 3152 wrote to memory of 4996 3152 cmd.exe CIWmnect.exe PID 3152 wrote to memory of 4996 3152 cmd.exe CIWmnect.exe PID 4996 wrote to memory of 4744 4996 CIWmnect.exe svchost.exe PID 4996 wrote to memory of 4744 4996 CIWmnect.exe svchost.exe PID 4996 wrote to memory of 4744 4996 CIWmnect.exe svchost.exe PID 4996 wrote to memory of 4744 4996 CIWmnect.exe svchost.exe PID 4996 wrote to memory of 4744 4996 CIWmnect.exe svchost.exe PID 4744 wrote to memory of 3544 4744 svchost.exe Explorer.EXE PID 4744 wrote to memory of 3544 4744 svchost.exe Explorer.EXE PID 4744 wrote to memory of 3544 4744 svchost.exe Explorer.EXE PID 3544 wrote to memory of 4072 3544 Explorer.EXE RuntimeBroker.exe PID 3544 wrote to memory of 4072 3544 Explorer.EXE RuntimeBroker.exe PID 3544 wrote to memory of 4072 3544 Explorer.EXE RuntimeBroker.exe PID 3544 wrote to memory of 3944 3544 Explorer.EXE RuntimeBroker.exe PID 3544 wrote to memory of 3944 3544 Explorer.EXE RuntimeBroker.exe PID 3544 wrote to memory of 3944 3544 Explorer.EXE RuntimeBroker.exe PID 3544 wrote to memory of 2376 3544 Explorer.EXE RuntimeBroker.exe PID 3544 wrote to memory of 2376 3544 Explorer.EXE RuntimeBroker.exe PID 3544 wrote to memory of 2376 3544 Explorer.EXE RuntimeBroker.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\94991507c04f29915d7afeb6a1ce2c0b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\94991507c04f29915d7afeb6a1ce2c0b_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A568\52B4.bat" "C:\Users\Admin\AppData\Roaming\AzSqcatq\CIWmnect.exe" "C:\Users\Admin\AppData\Local\Temp\949915~1.EXE""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /C ""C:\Users\Admin\AppData\Roaming\AzSqcatq\CIWmnect.exe" "C:\Users\Admin\AppData\Local\Temp\949915~1.EXE""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AzSqcatq\CIWmnect.exe"C:\Users\Admin\AppData\Roaming\AzSqcatq\CIWmnect.exe" "C:\Users\Admin\AppData\Local\Temp\949915~1.EXE"5⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\A568\52B4.batFilesize
112B
MD5b4ee0cae2366e3712a2622e1bbb02ef8
SHA1d507818784556f3b871e109c494d58dfa9a9ba23
SHA2567123d3dcbddd54c0b0c9725169be50f91b776a2ea7dda3bd3e73c325cd561f8d
SHA512d0975586ae21f54e9e271f74f9eef51f2ffb44498dd157dddd2622b123f932c8636e354679c9dcdc812ce578ab0bd3ba7a6de390442373592f87cb52deee2dc7
-
C:\Users\Admin\AppData\Roaming\AzSqcatq\CIWmnect.exeFilesize
429KB
MD594991507c04f29915d7afeb6a1ce2c0b
SHA1bb71a4a11a793cd6e4554e6cfa415bc93509599d
SHA2560369d29e8f8ac8c5408ade862673a5220f39e9f79cf68ad4d0e692c843e3ff9f
SHA512b1df63faa49c0f5aed4973375e2b70da477126f1b651418be038ba66ddadee7e89cf20db56504e0d8d42a01490cc6312613c72e82056ed1ade4af6693df734b0
-
memory/220-0-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/220-2-0x0000000000990000-0x00000000009F5000-memory.dmpFilesize
404KB
-
memory/220-7-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/2376-52-0x0000024FD65F0000-0x0000024FD66F1000-memory.dmpFilesize
1.0MB
-
memory/2376-56-0x0000024FD65F0000-0x0000024FD66F1000-memory.dmpFilesize
1.0MB
-
memory/3544-50-0x0000000008F60000-0x0000000009061000-memory.dmpFilesize
1.0MB
-
memory/3544-48-0x0000000008F60000-0x0000000009061000-memory.dmpFilesize
1.0MB
-
memory/3544-49-0x0000000008F60000-0x0000000009061000-memory.dmpFilesize
1.0MB
-
memory/3544-32-0x0000000008F60000-0x0000000009061000-memory.dmpFilesize
1.0MB
-
memory/3544-31-0x00000000034A0000-0x00000000034A1000-memory.dmpFilesize
4KB
-
memory/3544-23-0x0000000008F60000-0x0000000009061000-memory.dmpFilesize
1.0MB
-
memory/3544-57-0x0000000008F60000-0x0000000009061000-memory.dmpFilesize
1.0MB
-
memory/3544-51-0x0000000008F60000-0x0000000009061000-memory.dmpFilesize
1.0MB
-
memory/3944-46-0x00000201F6A30000-0x00000201F6B31000-memory.dmpFilesize
1.0MB
-
memory/3944-45-0x00000201F69F0000-0x00000201F69F1000-memory.dmpFilesize
4KB
-
memory/3944-58-0x00000201F6A30000-0x00000201F6B31000-memory.dmpFilesize
1.0MB
-
memory/3944-41-0x00000201F6A30000-0x00000201F6B31000-memory.dmpFilesize
1.0MB
-
memory/3944-47-0x00000201F6A30000-0x00000201F6B31000-memory.dmpFilesize
1.0MB
-
memory/4072-34-0x00000259AFE30000-0x00000259AFF31000-memory.dmpFilesize
1.0MB
-
memory/4072-39-0x00000259AFBF0000-0x00000259AFBF1000-memory.dmpFilesize
4KB
-
memory/4072-40-0x00000259AFE30000-0x00000259AFF31000-memory.dmpFilesize
1.0MB
-
memory/4072-38-0x00000259AFE30000-0x00000259AFF31000-memory.dmpFilesize
1.0MB
-
memory/4744-24-0x0000000000C00000-0x0000000000D01000-memory.dmpFilesize
1.0MB
-
memory/4744-21-0x0000000000D10000-0x0000000000D11000-memory.dmpFilesize
4KB
-
memory/4744-22-0x0000000000C00000-0x0000000000D01000-memory.dmpFilesize
1.0MB
-
memory/4744-16-0x0000000000C00000-0x0000000000D01000-memory.dmpFilesize
1.0MB
-
memory/4996-20-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/4996-12-0x0000000000990000-0x00000000009F5000-memory.dmpFilesize
404KB