Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
22-06-2024 02:16
Static task
static1
Behavioral task
behavioral1
Sample
00d646a85632fd12c18a5ee7be302804_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
00d646a85632fd12c18a5ee7be302804_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
00d646a85632fd12c18a5ee7be302804_JaffaCakes118.exe
-
Size
433KB
-
MD5
00d646a85632fd12c18a5ee7be302804
-
SHA1
87f808ce7594c9db12ed6149121f7773fa28c189
-
SHA256
10fa579d3f985c21fbf53b89f5b653d0872ce7e23f1347bb345fc501bd1d5fd1
-
SHA512
a53ab44b759955228db50efac85c09d72f2cf19436f3dc26c3e48c0284f44204e5bd6326b8a40445303e28ff9a8c4739ee6b0d1ffe3fdaca80cea9eca885dd67
-
SSDEEP
12288:26eBTcy2z85mH9XsYf+k7mUA+2NFuehtigto:26eBTcy2z8mWOHA3I2xto
Malware Config
Extracted
cybergate
v1.01.0
springdreams
thaichi.no-ip.info:7525
quietstorm
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
cybergate
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
DirectX2010.exepid process 4492 DirectX2010.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
00d646a85632fd12c18a5ee7be302804_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\orbitaluniverse420 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DirectX2010.exe" 00d646a85632fd12c18a5ee7be302804_JaffaCakes118.exe -
Processes:
00d646a85632fd12c18a5ee7be302804_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 00d646a85632fd12c18a5ee7be302804_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
00d646a85632fd12c18a5ee7be302804_JaffaCakes118.exedescription pid process target process PID 3128 set thread context of 4492 3128 00d646a85632fd12c18a5ee7be302804_JaffaCakes118.exe DirectX2010.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
DirectX2010.exepid process 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe 4492 DirectX2010.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
00d646a85632fd12c18a5ee7be302804_JaffaCakes118.exedescription pid process target process PID 3128 wrote to memory of 4492 3128 00d646a85632fd12c18a5ee7be302804_JaffaCakes118.exe DirectX2010.exe PID 3128 wrote to memory of 4492 3128 00d646a85632fd12c18a5ee7be302804_JaffaCakes118.exe DirectX2010.exe PID 3128 wrote to memory of 4492 3128 00d646a85632fd12c18a5ee7be302804_JaffaCakes118.exe DirectX2010.exe PID 3128 wrote to memory of 4492 3128 00d646a85632fd12c18a5ee7be302804_JaffaCakes118.exe DirectX2010.exe PID 3128 wrote to memory of 4492 3128 00d646a85632fd12c18a5ee7be302804_JaffaCakes118.exe DirectX2010.exe PID 3128 wrote to memory of 4492 3128 00d646a85632fd12c18a5ee7be302804_JaffaCakes118.exe DirectX2010.exe PID 3128 wrote to memory of 4492 3128 00d646a85632fd12c18a5ee7be302804_JaffaCakes118.exe DirectX2010.exe PID 3128 wrote to memory of 4492 3128 00d646a85632fd12c18a5ee7be302804_JaffaCakes118.exe DirectX2010.exe PID 3128 wrote to memory of 4492 3128 00d646a85632fd12c18a5ee7be302804_JaffaCakes118.exe DirectX2010.exe PID 3128 wrote to memory of 4492 3128 00d646a85632fd12c18a5ee7be302804_JaffaCakes118.exe DirectX2010.exe PID 3128 wrote to memory of 4492 3128 00d646a85632fd12c18a5ee7be302804_JaffaCakes118.exe DirectX2010.exe PID 3128 wrote to memory of 4492 3128 00d646a85632fd12c18a5ee7be302804_JaffaCakes118.exe DirectX2010.exe PID 3128 wrote to memory of 4492 3128 00d646a85632fd12c18a5ee7be302804_JaffaCakes118.exe DirectX2010.exe PID 3128 wrote to memory of 4492 3128 00d646a85632fd12c18a5ee7be302804_JaffaCakes118.exe DirectX2010.exe PID 3128 wrote to memory of 4492 3128 00d646a85632fd12c18a5ee7be302804_JaffaCakes118.exe DirectX2010.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00d646a85632fd12c18a5ee7be302804_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\00d646a85632fd12c18a5ee7be302804_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DirectX2010.exe"C:\Users\Admin\AppData\Local\Temp\00d646a85632fd12c18a5ee7be302804_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DirectX2010.exeFilesize
433KB
MD500d646a85632fd12c18a5ee7be302804
SHA187f808ce7594c9db12ed6149121f7773fa28c189
SHA25610fa579d3f985c21fbf53b89f5b653d0872ce7e23f1347bb345fc501bd1d5fd1
SHA512a53ab44b759955228db50efac85c09d72f2cf19436f3dc26c3e48c0284f44204e5bd6326b8a40445303e28ff9a8c4739ee6b0d1ffe3fdaca80cea9eca885dd67
-
memory/4492-2-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/4492-5-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/4492-6-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/4492-7-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/4492-10-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB