Analysis
- max time kernel
147s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 22:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9fd1579cf1541c953eacbaf3cce0de47_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
- Target 9fd1579cf1541c953eacbaf3cce0de47_JaffaCakes118.exe
- Size 1.8MB
- Sample240611-2vvkhavflq
- SHA256 7b2d0ae7c31282f5a52bd8f92c7e0ce46b0ae050b5853c87b57a97e4293a1f38
- MD5 9fd1579cf1541c953eacbaf3cce0de47
- SHA1 9b6c1182422a09257bebe1271961f28fee704898
- SHA512 9230f7f9e68f575df7b8a11dd9209d34c592d947cc99e06065318714f4bd4d8dbf848dd89d62cfeb687927edbe8403ec98e050eebedcd45937f416aae7f8ff67
- SSDEEP 49152:4SuE3+trqPKIO23Hlin6COYolnyJ2WR6wOHste0uIlCj790Lhf4xC0FyQ4L6nd:3L3yqPKIOson6Cslny8WR6wOHstehsC7
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
gozi
Attributes
-
build
214062
Extracted
Family
-
gozi
Botnet
-
3184
C2
-
qfelicialew.city
-
mzg4958lc.com
-
gxuxwnszau.band
Attributes
-
build
214062
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
loader
-
server_id
12
rsa_pubkey.plain
serpent.plain
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009e387b9b7780e241bd4d2d5013251a2f00000000020000000000106600000001000020000000b00aa115a3f8cef394bec576b5d471678d5ee4b76f8004645a9cbebb51068c23000000000e8000000002000020000000627796c1a3dc9ca528d8313a23b04a3b6a2540877b84935e3150c71e44398d0520000000d02e964a6d6447a55ac5475bc5337a74f4a03202db9bf0bca5c3230b7b79f05c40000000c6a626fba8995fe653172eec02383e2754be859f6b0355fadfc0166d7d4a7a87b112dc6c7c5646f08c242a17b07e7e20930ac705c539fee8309ff1d63d22af1f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f015bc8452bcda01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{DC8137F9-2845-11EF-92F1-D6AA8B0874BD} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009e387b9b7780e241bd4d2d5013251a2f000000000200000000001066000000010000200000008229eead9da64aea70a7deec1a369305af3412ed77e62fcc524a6b5868b4ed35000000000e80000000020000200000007653fc0cc10c09eb837fde5051bb3bfbe7d2569c9b83a4a9d3cb44a9a667987d20000000f977b1e4298895d03f078fd8f2d98976d7b3103d6522c0259dcf2df1c8fa15e44000000003f18dcdaa8811294a9010b95c5915b25db90bc6fd821129e7de93cf36a8dc7ac7f525e063bf91619448136b8d159f207eb39c7248e2e59908975d42d9ceae2f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30da8b9252bcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C8BDF807-2845-11EF-92F1-D6AA8B0874BD} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009e387b9b7780e241bd4d2d5013251a2f00000000020000000000106600000001000020000000427182f0637467d146801a23b38682a13d5a5b2707e18ac9c3c15bb13a4b3f9b000000000e800000000200002000000013ea042a9ca9d0d31f24c88987ccb4dd2587ff41aac9f3b7d1fc63a37ef4e9b52000000092f33396c81eaca8385de3ce6b3930f745c3191ef1c5a02a0b7a0510f350ccf240000000d1f3a1cde20726e04b42fce8faebdeda3858383691e5121d2c1930c39ffca72965151218d4b6b278163af7dce19d8932448f6b94f796f4ef257adf8130e54ea9 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10a577a652bcda01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009e387b9b7780e241bd4d2d5013251a2f0000000002000000000010660000000100002000000084adf16a0e6dcedff83db57323c9f7bcb20f31e422ebb0bfaaeeae5a5f14e7ab000000000e8000000002000020000000eb61887a4ee2591b05ac1d67f89d9e040e9490b8b5f8cc337cd41ae9cfc70895200000000a84d664371795aefd1e3e36560ac1e9550a5b0634f73d0ef3c3d21606803b1340000000a7ed5fae9540e8813bd6afe2b7f7af4b927b071972f633f0b5af2139508e48ef554a4a9b7abc1db2e2028e9cea706e356b49e7c1206fa437e060bd42c8dca31d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{A8AF9985-2845-11EF-92F1-D6AA8B0874BD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e041c38452bcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2132 iexplore.exe 4740 iexplore.exe 3108 iexplore.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2132 iexplore.exe 2132 iexplore.exe 4280 IEXPLORE.EXE 4280 IEXPLORE.EXE 4740 iexplore.exe 4740 iexplore.exe 3976 IEXPLORE.EXE 3976 IEXPLORE.EXE 3108 iexplore.exe 3108 iexplore.exe 3876 IEXPLORE.EXE 3876 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2132 wrote to memory of 4280 2132 iexplore.exe 90 PID 2132 wrote to memory of 4280 2132 iexplore.exe 90 PID 2132 wrote to memory of 4280 2132 iexplore.exe 90 PID 4740 wrote to memory of 3976 4740 iexplore.exe 97 PID 4740 wrote to memory of 3976 4740 iexplore.exe 97 PID 4740 wrote to memory of 3976 4740 iexplore.exe 97 PID 3108 wrote to memory of 3876 3108 iexplore.exe 99 PID 3108 wrote to memory of 3876 3108 iexplore.exe 99 PID 3108 wrote to memory of 3876 3108 iexplore.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\9fd1579cf1541c953eacbaf3cce0de47_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9fd1579cf1541c953eacbaf3cce0de47_JaffaCakes118.exe"1⤵PID:4844
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵PID:3616
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2132 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4280
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4740 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3976
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3108 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3876
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\~DF09E445DABEEB83E5.TMP
- Size 16KB
- SHA256 313e8942688b92ace9ad69a6fab16704079fc8e18066f51c39b59ce5a7c64992
- MD5 74c1ec615f3c4a36b2459637deff14ab
- SHA1 c2f04953a9bbb375d1919fd02ee3db31aaa69365
- SHA512 bebd44cfb3365c6bc1ef9c981b00e69efea50868436307987cf56a76cab156072ffa3ac8edec448f39b0dd4e1465ab4469fbc9454cc1183471d4086a904fbd9b
- SSDEEP 12:i9lsatP/1pPpe5XR1rd6Vrwlesm97hHqhGdMFSoflwSX5Wd:i9lx/DRgXDrd6RQeTxhKsdD1
- MD5 SHA1 SHA512 SSDEEP