Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-06-2024 03:18
Static task
static1
Behavioral task
behavioral1
Sample
010cce1d89cd52387d838e049492538a_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
010cce1d89cd52387d838e049492538a_JaffaCakes118.exe
-
Size
218KB
-
MD5
010cce1d89cd52387d838e049492538a
-
SHA1
b6742db0d25ba2de4b1d1589f652f8e4ce72b4ea
-
SHA256
19376c5f5870627e45e70a3e273a3d1d2560b360f0ad673d72ff1ec079ef0a30
-
SHA512
1c8ca69b9787be86fee226c17daf4cbef506d354ec3442abc3d04e50ef2fde83fb57e2ca5f75826e6eaa0e14d4b09785b087d09bb7121fcb5cff85707b654ada
-
SSDEEP
6144:LVaT2+MBUnBhscAjrzGF7D68aqHp+6tbeXdQJL9Nw:xadMBI/lRDaA9tSIRNw
Malware Config
Extracted
cybergate
2.2.3
vctima
almoomia10.no-ip.biz:80
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
svchost.exe
-
install_dir
dasbin
-
install_file
mari.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
tÃtulo da mensagem
-
password
6458713
-
regkey_hkcu
ass2
-
regkey_hklm
ass1
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
010cce1d89cd52387d838e049492538a_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\dasbin\\mari.exe" 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\dasbin\\mari.exe" 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Processes:
explorer.exe010cce1d89cd52387d838e049492538a_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{H202FGYA-DE5B-SDYN-403M-8KX62QJMQ171} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{H202FGYA-DE5B-SDYN-403M-8KX62QJMQ171}\StubPath = "C:\\Windows\\system32\\dasbin\\mari.exe" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{H202FGYA-DE5B-SDYN-403M-8KX62QJMQ171} 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{H202FGYA-DE5B-SDYN-403M-8KX62QJMQ171}\StubPath = "C:\\Windows\\system32\\dasbin\\mari.exe Restart" 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral2/memory/2972-1-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/2972-2-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/2972-5-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/2972-11-0x0000000024010000-0x000000002404E000-memory.dmp upx behavioral2/memory/2972-8-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/2972-15-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/2972-16-0x0000000024050000-0x000000002408E000-memory.dmp upx behavioral2/memory/4492-65-0x0000000024050000-0x000000002408E000-memory.dmp upx behavioral2/memory/2972-61-0x0000000024050000-0x000000002408E000-memory.dmp upx behavioral2/memory/2972-7-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/2972-0-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4492-68-0x0000000024050000-0x000000002408E000-memory.dmp upx behavioral2/memory/2972-70-0x00000000008A0000-0x00000000008DE000-memory.dmp upx behavioral2/memory/2972-125-0x0000000000400000-0x000000000043F000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
010cce1d89cd52387d838e049492538a_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ass1 = "C:\\Windows\\system32\\dasbin\\mari.exe" 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ass2 = "C:\\Windows\\system32\\dasbin\\mari.exe" 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe -
Drops file in System32 directory 4 IoCs
Processes:
010cce1d89cd52387d838e049492538a_JaffaCakes118.exe010cce1d89cd52387d838e049492538a_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\dasbin\mari.exe 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dasbin\mari.exe 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dasbin\mari.exe 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dasbin\ 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
010cce1d89cd52387d838e049492538a_JaffaCakes118.exedescription pid process target process PID 4228 set thread context of 2972 4228 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
010cce1d89cd52387d838e049492538a_JaffaCakes118.exepid process 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
010cce1d89cd52387d838e049492538a_JaffaCakes118.exepid process 3340 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
010cce1d89cd52387d838e049492538a_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 3340 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Token: SeDebugPrivilege 3340 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
010cce1d89cd52387d838e049492538a_JaffaCakes118.exepid process 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
010cce1d89cd52387d838e049492538a_JaffaCakes118.exe010cce1d89cd52387d838e049492538a_JaffaCakes118.exedescription pid process target process PID 4228 wrote to memory of 2972 4228 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe PID 4228 wrote to memory of 2972 4228 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe PID 4228 wrote to memory of 2972 4228 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe PID 4228 wrote to memory of 2972 4228 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe PID 4228 wrote to memory of 2972 4228 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe PID 4228 wrote to memory of 2972 4228 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe PID 4228 wrote to memory of 2972 4228 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe PID 4228 wrote to memory of 2972 4228 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE PID 2972 wrote to memory of 3488 2972 010cce1d89cd52387d838e049492538a_JaffaCakes118.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\010cce1d89cd52387d838e049492538a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\010cce1d89cd52387d838e049492538a_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\010cce1d89cd52387d838e049492538a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\010cce1d89cd52387d838e049492538a_JaffaCakes118.exe3⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
-
C:\Users\Admin\AppData\Local\Temp\010cce1d89cd52387d838e049492538a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\010cce1d89cd52387d838e049492538a_JaffaCakes118.exe"4⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txtFilesize
141KB
MD5aee0e396c6c3c87f10c1c5e903a0802e
SHA1bcf6288675f93a1eb3ec195c7427070b5e351f07
SHA25678375ac626c25963f98cf1946e9815921be9297d7b0d6b5cc7e3dbe8cdf831f4
SHA512dde244b38ee8af785bfc6f9b19c5aab9f0eccf5928e454a09d65a6c1bc54d2aa9b4616ac5c89181bd83773886085c601a21af0bf8b39a760bd3f7b8aece48ce9
-
C:\Users\Admin\AppData\Local\Temp\XxX.xXxFilesize
8B
MD5d0fbd79bfa46fc85267f2676c1f56633
SHA184d307cf6a3bc24903e1b2e4a11e3180f4d6ade0
SHA256c64d9c02de6de694507a11dbe99db1dbcd04473eebdbcf81e4dd22fa12401caa
SHA5122185d6560bba3cc2ea41b3e2dde4e0e241c3bcd65be9b9608a6ce6a3625cc63824fb4e1202895c89cb2d3c12076c525fcca85a4970ee997a5da4832678c29b58
-
C:\Users\Admin\AppData\Roaming\logs.datFilesize
15B
MD586f3c87caff4d7973404ff22c664505b
SHA1245bc19c345bc8e73645cd35f5af640bc489da19
SHA256e8ab966478c22925527b58b0a7c3d89e430690cbdabb44d501744e0ad0ac9ddb
SHA5120940c4b339640f60f1a21fc9e4e958bf84f0e668f33a9b24d483d1e6bfcf35eca45335afee1d3b7ff6fd091b2e395c151af8af3300e154d3ea3fdb2b73872024
-
C:\Windows\SysWOW64\dasbin\mari.exeFilesize
218KB
MD5010cce1d89cd52387d838e049492538a
SHA1b6742db0d25ba2de4b1d1589f652f8e4ce72b4ea
SHA25619376c5f5870627e45e70a3e273a3d1d2560b360f0ad673d72ff1ec079ef0a30
SHA5121c8ca69b9787be86fee226c17daf4cbef506d354ec3442abc3d04e50ef2fde83fb57e2ca5f75826e6eaa0e14d4b09785b087d09bb7121fcb5cff85707b654ada
-
memory/2972-7-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2972-70-0x00000000008A0000-0x00000000008DE000-memory.dmpFilesize
248KB
-
memory/2972-2-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2972-5-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2972-16-0x0000000024050000-0x000000002408E000-memory.dmpFilesize
248KB
-
memory/2972-125-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2972-8-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2972-11-0x0000000024010000-0x000000002404E000-memory.dmpFilesize
248KB
-
memory/2972-15-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2972-61-0x0000000024050000-0x000000002408E000-memory.dmpFilesize
248KB
-
memory/2972-1-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2972-0-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/4228-6-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/4492-64-0x0000000003AE0000-0x0000000003AE1000-memory.dmpFilesize
4KB
-
memory/4492-68-0x0000000024050000-0x000000002408E000-memory.dmpFilesize
248KB
-
memory/4492-65-0x0000000024050000-0x000000002408E000-memory.dmpFilesize
248KB
-
memory/4492-17-0x0000000001310000-0x0000000001311000-memory.dmpFilesize
4KB
-
memory/4492-18-0x00000000013D0000-0x00000000013D1000-memory.dmpFilesize
4KB