CreateProcessNotify
Behavioral task
behavioral1
Sample
9ccba17eddabc2891f70462f7b9f69d4_JaffaCakes118.dll
Resource
win7-20240508-en
General
-
Target
9ccba17eddabc2891f70462f7b9f69d4_JaffaCakes118
-
Size
268KB
-
MD5
9ccba17eddabc2891f70462f7b9f69d4
-
SHA1
5bd4c8ea5d92cb2fab2f5228d77250a53eb0eabb
-
SHA256
e1d63b4e65ef61db22b853686b5dfc4f795047b8701df2f97b0ee40f70e4ce76
-
SHA512
fef58591062fb94485bf25a05eb93afe66522dc7f49ff57b92f745bf2a30858655baf798169f04228372c46c11f181a865d9d1d6036c21bf5a6b215b2775c20f
-
SSDEEP
6144:fubsWqPqlal6mPOA7kjR4Z0JUZ581Xvj33IYZuoQs+8pB:fubsPqgl6mPOnRdUZ54/z3IYZuoQs+
Malware Config
Extracted
gozi
-
exe_type
worker
Signatures
-
Gozi family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 9ccba17eddabc2891f70462f7b9f69d4_JaffaCakes118
Files
-
9ccba17eddabc2891f70462f7b9f69d4_JaffaCakes118.dll windows:5 windows x86 arch:x86
8af9847a44f9c4ab8c86c12d4ec5cb92
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntdll
strcpy
NtGetContextThread
ZwQueryInformationProcess
RtlNtStatusToDosError
NtSetContextThread
ZwQueryInformationToken
ZwOpenProcess
ZwClose
ZwOpenProcessToken
_wcsupr
_strupr
strstr
wcscpy
memset
mbstowcs
wcstombs
RtlAdjustPrivilege
sprintf
NtCreateSection
NtUnmapViewOfSection
memcpy
NtMapViewOfSection
_aulldiv
_allmul
RtlUnwind
NtQueryVirtualMemory
kernel32
lstrcmpiW
SwitchToThread
VirtualProtectEx
GetThreadContext
ExpandEnvironmentStringsW
FindNextFileW
FindClose
FindFirstFileW
WriteProcessMemory
GetModuleFileNameA
GetLocalTime
VirtualAllocEx
CreateFileA
lstrlenA
HeapAlloc
HeapFree
WriteFile
lstrcatA
CreateDirectoryA
GetLastError
RemoveDirectoryA
LoadLibraryA
CloseHandle
DeleteFileA
lstrcpyA
HeapReAlloc
InterlockedIncrement
InterlockedDecrement
SetEvent
GetTickCount
HeapDestroy
HeapCreate
GetCurrentThreadId
SetWaitableTimer
GetCurrentProcess
CreateDirectoryW
GetCurrentThread
GetSystemTimeAsFileTime
GetWindowsDirectoryA
Sleep
CopyFileW
CreateEventA
lstrlenW
InterlockedExchange
GetProcAddress
GetModuleHandleA
lstrcatW
DeleteFileW
GetCurrentProcessId
GetTempPathA
SuspendThread
ResumeThread
CreateThread
MapViewOfFile
UnmapViewOfFile
WaitForSingleObject
GetComputerNameW
LeaveCriticalSection
EnterCriticalSection
WaitForMultipleObjects
CreateMutexA
ReleaseMutex
CreateWaitableTimerA
UnregisterWait
LoadLibraryExW
SetLastError
RegisterWaitForSingleObject
GetFileSize
GetDriveTypeW
GetLogicalDriveStringsW
WideCharToMultiByte
GetFileAttributesA
GetFileAttributesW
CreateProcessA
CreateFileW
FindFirstFileA
GetTempFileNameA
CreateFileMappingA
FindNextFileA
OpenFileMappingA
lstrcpyW
lstrcpynA
GlobalLock
GlobalUnlock
lstrcmpiA
Thread32First
Thread32Next
QueueUserAPC
OpenThread
CreateToolhelp32Snapshot
CallNamedPipeA
WaitNamedPipeA
ConnectNamedPipe
ReadFile
GetOverlappedResult
DisconnectNamedPipe
FlushFileBuffers
CreateNamedPipeA
CancelIo
GetSystemTime
lstrcmpW
SleepEx
InitializeCriticalSection
ResetEvent
SetEndOfFile
LocalAlloc
LocalFree
FreeLibrary
RaiseException
FileTimeToSystemTime
ReadProcessMemory
OpenProcess
CreateRemoteThread
SetFilePointer
GetVersion
VirtualProtect
lstrcmpA
DeleteCriticalSection
QueueUserWorkItem
VirtualAlloc
VirtualFree
oleaut32
VariantInit
VariantClear
SysAllocString
SysFreeString
Exports
Exports
Sections
.text Size: 90KB - Virtual size: 90KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ