Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-06-2024 23:23
Static task
static1
Behavioral task
behavioral1
Sample
002c97086073bcdf6039973287a23635_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
002c97086073bcdf6039973287a23635_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
002c97086073bcdf6039973287a23635_JaffaCakes118.exe
-
Size
1.4MB
-
MD5
002c97086073bcdf6039973287a23635
-
SHA1
47486fca88e6ed5fc99d6841e8ff86b1697d927a
-
SHA256
48e0b6f0c80584a30e3af4a58bbfba0bb4daf2c72cad888b00d8418d78a87ad7
-
SHA512
6ffcd74bc731f9fcce583e46de13078adbc6d17093371ede479077d778fb728a3dbde5007a304df41e012aa4a66c21afc49081bf20675e24933a58e666ced633
-
SSDEEP
24576:romcKjdLdlmcojdLdkZfvKxUpXBU1YlPFyBZfvKxUpXBU1YlPFy+:XcKjdRccojdRgvo2BoUUvo2BoUp
Malware Config
Extracted
cybergate
v1.03.0
w
virus666.no-ip.biz:321
B5361458141YVH
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
servis.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
1
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
Kryptonite.exe111.exe111.exepid process 2012 Kryptonite.exe 2176 111.exe 2648 111.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
111.exedescription pid process target process PID 2176 set thread context of 2648 2176 111.exe 111.exe -
Drops file in Windows directory 2 IoCs
Processes:
002c97086073bcdf6039973287a23635_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\Kryptonite.exe 002c97086073bcdf6039973287a23635_JaffaCakes118.exe File opened for modification C:\Windows\111.exe 002c97086073bcdf6039973287a23635_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
111.exedescription pid process Token: SeDebugPrivilege 2176 111.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
002c97086073bcdf6039973287a23635_JaffaCakes118.exepid process 3028 002c97086073bcdf6039973287a23635_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
002c97086073bcdf6039973287a23635_JaffaCakes118.exe111.exedescription pid process target process PID 3028 wrote to memory of 2012 3028 002c97086073bcdf6039973287a23635_JaffaCakes118.exe Kryptonite.exe PID 3028 wrote to memory of 2012 3028 002c97086073bcdf6039973287a23635_JaffaCakes118.exe Kryptonite.exe PID 3028 wrote to memory of 2012 3028 002c97086073bcdf6039973287a23635_JaffaCakes118.exe Kryptonite.exe PID 3028 wrote to memory of 2012 3028 002c97086073bcdf6039973287a23635_JaffaCakes118.exe Kryptonite.exe PID 3028 wrote to memory of 2176 3028 002c97086073bcdf6039973287a23635_JaffaCakes118.exe 111.exe PID 3028 wrote to memory of 2176 3028 002c97086073bcdf6039973287a23635_JaffaCakes118.exe 111.exe PID 3028 wrote to memory of 2176 3028 002c97086073bcdf6039973287a23635_JaffaCakes118.exe 111.exe PID 3028 wrote to memory of 2176 3028 002c97086073bcdf6039973287a23635_JaffaCakes118.exe 111.exe PID 2176 wrote to memory of 2648 2176 111.exe 111.exe PID 2176 wrote to memory of 2648 2176 111.exe 111.exe PID 2176 wrote to memory of 2648 2176 111.exe 111.exe PID 2176 wrote to memory of 2648 2176 111.exe 111.exe PID 2176 wrote to memory of 2648 2176 111.exe 111.exe PID 2176 wrote to memory of 2648 2176 111.exe 111.exe PID 2176 wrote to memory of 2648 2176 111.exe 111.exe PID 2176 wrote to memory of 2648 2176 111.exe 111.exe PID 2176 wrote to memory of 2648 2176 111.exe 111.exe PID 2176 wrote to memory of 2648 2176 111.exe 111.exe PID 2176 wrote to memory of 2648 2176 111.exe 111.exe PID 2176 wrote to memory of 2648 2176 111.exe 111.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\002c97086073bcdf6039973287a23635_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\002c97086073bcdf6039973287a23635_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Kryptonite.exe"C:\Windows\Kryptonite.exe"2⤵
- Executes dropped EXE
-
C:\Windows\111.exe"C:\Windows\111.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\111.exeC:\Windows\111.exe3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\111.exeFilesize
917KB
MD57dc6cfcfbbc42c597ca18216cad9ffc9
SHA18e7c10b41821a9723a2b0259d1d7c410a0e8d855
SHA256be8ef5a37e1171c02716d0c25ef333a4a8fa3aac95ede79aafc19b4afe4e8729
SHA512b2233bfd048ac3d61ef6c815249d9faad50bd7517d54e82a3256cca5fe22de36f77ab448004a751a08f94c6847a8a1fbceaab30f82fbd585cc2bd243518d5771
-
C:\Windows\Kryptonite.exeFilesize
434KB
MD5544f56f393eb5cd7c218bab8e9bc8bfd
SHA10b2b743f55c70de720a1095b1fbb69fe780058e5
SHA2568cc2225c42941d1546f1f8d8f0f1771ab6928339a9b140ff7c875a177bbb4e3b
SHA5126827dc484a8c6ea65aab65fbc4b58ff3979331d28dca7ff12f908a277934fe2656d00a8a87262534194d90c859896a06f361f2430dba780887fe7d9cd88b42b0
-
memory/2012-14-0x00000000739B1000-0x00000000739B2000-memory.dmpFilesize
4KB
-
memory/2012-17-0x00000000739B0000-0x0000000073F5B000-memory.dmpFilesize
5.7MB
-
memory/2012-18-0x00000000739B0000-0x0000000073F5B000-memory.dmpFilesize
5.7MB
-
memory/2012-32-0x00000000739B0000-0x0000000073F5B000-memory.dmpFilesize
5.7MB
-
memory/2176-31-0x00000000739B0000-0x0000000073F5B000-memory.dmpFilesize
5.7MB
-
memory/2176-16-0x00000000739B0000-0x0000000073F5B000-memory.dmpFilesize
5.7MB
-
memory/2176-15-0x00000000739B0000-0x0000000073F5B000-memory.dmpFilesize
5.7MB
-
memory/2648-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2648-25-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2648-24-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2648-22-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2648-21-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2648-20-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2648-19-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2648-26-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2648-29-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB