Malware Analysis Report

2024-10-16 02:26

Sample ID 240702-njg85stfrr
Target 1f26e5f9b44c28b37b6cd13283838366_JaffaCakes118
SHA256 1225de9af9f6b29985e9304fa1056b8c7da036215a5e054c0ff6d7129c91a59f
Tags
isfb gozi banker persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1225de9af9f6b29985e9304fa1056b8c7da036215a5e054c0ff6d7129c91a59f

Threat Level: Known bad

The file 1f26e5f9b44c28b37b6cd13283838366_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

isfb gozi banker persistence trojan

Gozi family

Gozi

Server Software Component: Terminal Services DLL

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Gathers network information

Suspicious use of FindShellTrayWindow

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Runs net.exe

Suspicious use of WriteProcessMemory

Checks processor information in registry

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-02 11:25

Signatures

Gozi family

gozi

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-02 11:25

Reported

2024-07-02 11:28

Platform

win7-20240611-en

Max time kernel

129s

Max time network

133s

Command Line

C:\Windows\Explorer.EXE

Signatures

Gozi

banker trojan gozi

Server Software Component: Terminal Services DLL

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibilityex.dll" C:\Windows\SysWOW64\reg.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\net.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\sysprep\Panther\diagwrn.xml C:\Windows\system32\sysprep\sysprep.exe N/A
File created C:\Windows\SysWOW64\FastUserSwitchingCompatibilityex.dll C:\Users\Admin\AppData\Local\Temp\net.exe N/A
File created C:\Windows\SysWOW64\system_t.dll C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\system_t.dll C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Windows\SysWOW64\enumfs.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\dnlist.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\system32\sysprep\Panther\setuperr.log C:\Windows\system32\sysprep\sysprep.exe N/A
File opened for modification C:\Windows\system32\sysprep\Panther\diagerr.xml C:\Windows\system32\sysprep\sysprep.exe N/A
File opened for modification C:\Windows\system32\sysprep\Panther\setupact.log C:\Windows\system32\sysprep\sysprep.exe N/A
File created C:\Windows\SysWOW64\net.bat C:\Users\Admin\AppData\Local\Temp\net.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\nettraveler[1].htm C:\Windows\SysWOW64\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\system\config_t.dat C:\Users\Admin\AppData\Local\Temp\net.exe N/A
File opened for modification C:\Windows\system\config_t.dat C:\Users\Admin\AppData\Local\Temp\net.exe N/A
File opened for modification C:\Windows\system\config_t.dat C:\Windows\SysWOW64\svchost.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\SysWOW64\svchost.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F6BF5F85-1140-4F75-9343-6FEE53099C02}\WpadNetworkName = "Network 3" C:\Windows\SysWOW64\svchost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-e3-83-0f-ea-0b\WpadDecisionTime = 30487db772ccda01 C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F6BF5F85-1140-4F75-9343-6FEE53099C02}\WpadDecisionReason = "1" C:\Windows\SysWOW64\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F6BF5F85-1140-4F75-9343-6FEE53099C02}\WpadDecision = "0" C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F6BF5F85-1140-4F75-9343-6FEE53099C02} C:\Windows\SysWOW64\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-e3-83-0f-ea-0b\WpadDecisionReason = "1" C:\Windows\SysWOW64\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-e3-83-0f-ea-0b\WpadDecision = "0" C:\Windows\SysWOW64\svchost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\SysWOW64\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Windows\SysWOW64\svchost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\SysWOW64\svchost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\SysWOW64\svchost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F6BF5F85-1140-4F75-9343-6FEE53099C02}\WpadDecisionTime = 30487db772ccda01 C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-e3-83-0f-ea-0b C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F6BF5F85-1140-4F75-9343-6FEE53099C02}\86-e3-83-0f-ea-0b C:\Windows\SysWOW64\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" C:\Windows\SysWOW64\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SysWOW64\svchost.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1704 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\1f26e5f9b44c28b37b6cd13283838366_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\temp.exe
PID 1704 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\1f26e5f9b44c28b37b6cd13283838366_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\temp.exe
PID 1704 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\1f26e5f9b44c28b37b6cd13283838366_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\temp.exe
PID 1704 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\1f26e5f9b44c28b37b6cd13283838366_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\temp.exe
PID 2548 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 2548 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 2548 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 2548 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 2548 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 2548 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 2548 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 2548 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 2548 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 2548 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 2548 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 2548 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 2548 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 2548 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 2548 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 2548 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 2548 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 2548 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 2548 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 2548 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 1284 wrote to memory of 2492 N/A C:\Windows\Explorer.EXE C:\Windows\system32\sysprep\sysprep.exe
PID 1284 wrote to memory of 2492 N/A C:\Windows\Explorer.EXE C:\Windows\system32\sysprep\sysprep.exe
PID 1284 wrote to memory of 2492 N/A C:\Windows\Explorer.EXE C:\Windows\system32\sysprep\sysprep.exe
PID 2492 wrote to memory of 2904 N/A C:\Windows\system32\sysprep\sysprep.exe C:\Users\Admin\AppData\Local\Temp\net.exe
PID 2492 wrote to memory of 2904 N/A C:\Windows\system32\sysprep\sysprep.exe C:\Users\Admin\AppData\Local\Temp\net.exe
PID 2492 wrote to memory of 2904 N/A C:\Windows\system32\sysprep\sysprep.exe C:\Users\Admin\AppData\Local\Temp\net.exe
PID 2492 wrote to memory of 2904 N/A C:\Windows\system32\sysprep\sysprep.exe C:\Users\Admin\AppData\Local\Temp\net.exe
PID 2904 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\net.exe C:\Windows\SysWOW64\cmd.exe
PID 2904 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\net.exe C:\Windows\SysWOW64\cmd.exe
PID 2904 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\net.exe C:\Windows\SysWOW64\cmd.exe
PID 2904 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\net.exe C:\Windows\SysWOW64\cmd.exe
PID 2472 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2472 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2472 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2472 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3012 wrote to memory of 1660 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\ipconfig.exe
PID 3012 wrote to memory of 1660 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\ipconfig.exe
PID 3012 wrote to memory of 1660 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\ipconfig.exe
PID 3012 wrote to memory of 1660 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\ipconfig.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\1f26e5f9b44c28b37b6cd13283838366_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1f26e5f9b44c28b37b6cd13283838366_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\temp.exe

"C:\Users\Admin\AppData\Local\Temp\temp.exe"

C:\Windows\system32\sysprep\sysprep.exe

"C:\Windows\system32\sysprep\sysprep.exe" "C:\Users\Admin\AppData\Local\Temp\net.exe" "C:\Windows\system32" ""

C:\Users\Admin\AppData\Local\Temp\net.exe

"C:\Users\Admin\AppData\Local\Temp\net.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c net.bat

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FastUserSwitchingCompatibility\Parameters" /v ServiceDll /t REG_EXPAND_SZ /d C:\Windows\system32\FastUserSwitchingCompatibilityex.dll

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k netsvcs

C:\Windows\SysWOW64\ipconfig.exe

ipconfig /all

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.gami1.com udp
LT 84.32.84.32:80 www.gami1.com tcp
LT 84.32.84.32:80 www.gami1.com tcp
LT 84.32.84.32:80 www.gami1.com tcp
LT 84.32.84.32:80 www.gami1.com tcp
LT 84.32.84.32:80 www.gami1.com tcp
LT 84.32.84.32:80 www.gami1.com tcp
LT 84.32.84.32:80 www.gami1.com tcp
LT 84.32.84.32:80 www.gami1.com tcp
LT 84.32.84.32:80 www.gami1.com tcp
LT 84.32.84.32:80 www.gami1.com tcp
LT 84.32.84.32:80 www.gami1.com tcp
LT 84.32.84.32:80 www.gami1.com tcp
LT 84.32.84.32:80 www.gami1.com tcp

Files

\Users\Admin\AppData\Local\Temp\temp.exe

MD5 425609a2c35081730982a01d72a76cbe
SHA1 64f95fe985a7ef7ee4f396e36279aa31498ac3cc
SHA256 e03145fefe7fef82c2a476d7dec03305d7da79cd3c8fe1578177580175febbd3
SHA512 6ede1415ac51d588a71bfb5697a599eb777e9530240b7a3524626d2a230bb51017c9b3d05923c5cb41800cca9818f2d99484310390a0425ef8e48984c4c9cfd4

memory/1284-28-0x0000000003A00000-0x0000000003A01000-memory.dmp

memory/1284-13-0x0000000002A00000-0x0000000002A01000-memory.dmp

memory/1284-7-0x00000000029B0000-0x00000000029B1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\net.exe

MD5 57f2374d9f2a787339b0c6a5b1008a72
SHA1 d34418fb66e48bd3b563c0f6c81e7f1c17d7f5d3
SHA256 9637b2dcd5f9d5fdc0f1c1104f73f3dbdcfd803cac47196cc94c768c21fa2ae4
SHA512 bacf6b7142d2525d017a4a38c83875540e670a39c357d5c946ca04731557968dd2272fa7b6ba4635c3ced823c99d650da5438f2db292f6c8eebe8ce236e6432b

C:\Windows\SysWOW64\net.bat

MD5 dde99ab936da8cbda74ea779ef0b2e67
SHA1 1e27e432e0b7c81b990b92595daebdf0539efea4
SHA256 ab6da77270cb63c49d1d12e854850e882d03f41ce48782e98c81bcede0c9ad80
SHA512 62a124172d34dc56d00328b45ac13a029c847c2b7e2843ec38270a7c4d813b68b7d66b9a8ef80b8adfa7b1a894f36b5f8c6365fa5551c35939c0b76cd4439437

\??\c:\windows\SysWOW64\fastuserswitchingcompatibilityex.dll

MD5 ba20c70e538db853613bd65a7caf1d91
SHA1 96c935e51e3fed095f7158901ff10ebe32794c8b
SHA256 520b773ce8d6855abc992c1499609ca5e8c45446b10b8c2a804ecb1c967bda08
SHA512 7d3110f7ebe6b5c3099b7c919c2141db4b4684ba0193c21bdf5ceae6dd5f191fd2f653768253f40db367f0d44f965587564f4ad52490dcb6761df431f6498230

C:\Windows\system\config_t.dat

MD5 2708043b77d6ea590696856b9f44aa4e
SHA1 aca48ecf7347fe444a2b7d2c11680a6918e67c7a
SHA256 998ec5c11540cca088e079c8afda1d9222ed343dd0e6294817a187dd57185e9d
SHA512 b14053d01726da26eaaeccbbe666e0f472c68f8cc38aff404ac0b659caa427f7c50f6efbc67fdc4d0c593273457632477eb393780cd6b720564dfda9307d4c49

C:\Windows\SysWOW64\system_t.dll

MD5 bf2c97c558dbcab12ce8b742b10a3897
SHA1 ddf034f79325ce70ebb189666a47a8d5c319fb78
SHA256 c1b96a24078a285657a55a5242a4535e6a2661741bfc160a761d31aac2837aac
SHA512 ab5a445afc08ac62ea55aeaf25fffaf6b015157af911c9761fe90acb0d9d131c0b54bfc46a4d5d94ca843b71fcb6de625f8f3dca60a12a8b92e895120a08ca98

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\nettraveler[1].htm

MD5 545bfde42a67146caa2d16606ae834f1
SHA1 90195c18c8c29d4598cdef34931a9df42add0545
SHA256 d9cccfddb6f9d5d28ba693232256ffc49f637e3f74f3909836b1c62c617c5013
SHA512 966b20d82435baf20689067a89dce6164657eca28abf7c63de2dcfed72793bbad16b79885d9d0371a713210f1d41da58ba4cc35d78e6a0329c0942c47bff0d02

C:\Windows\SysWOW64\dnlist.ini

MD5 30b5f3ca639ddfa69575968b4032a8cf
SHA1 7d0b96c596bc7fb81dd52f62aac4709025e0dd3c
SHA256 27c94ea9dc125000c55e3c8be0067aece091046b3b000304e75a013dda982c0b
SHA512 a7d9ea4b99b755ecd8498fb2ba910e52f7cd70f02625ef9628c57612bdf0f9488647aa66e10cb4aaaaf1ad1531fba8e28bc7c1c41933dd11a7171cf567e181ad

C:\Windows\SysWOW64\enumfs.ini

MD5 3cdd5067e3df908bdb48c205463efdae
SHA1 985fa99672add2707667bc93062c05373ba2ebfe
SHA256 2e3380864f1a2c16825abc682ad65ff680d3630c0ff52f8d5fb28a0e0b66bbc8
SHA512 bdcb9889b3616ce8614dad9ed9fe9312664ff2fbeeacceaef84e9de295dadaab80b8b71adae01883846fab9cd8acbc156095953af2d4ec8510a57857676be1c4

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-02 11:25

Reported

2024-07-02 11:28

Platform

win10v2004-20240611-en

Max time kernel

147s

Max time network

139s

Command Line

C:\Windows\Explorer.EXE

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1f26e5f9b44c28b37b6cd13283838366_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\sysprep\Panther\diagwrn.xml C:\Windows\system32\sysprep\sysprep.exe N/A
File opened for modification C:\Windows\system32\sysprep\Panther\setupact.log C:\Windows\system32\sysprep\sysprep.exe N/A
File opened for modification C:\Windows\system32\sysprep\Panther\setuperr.log C:\Windows\system32\sysprep\sysprep.exe N/A
File opened for modification C:\Windows\system32\sysprep\Panther\diagerr.xml C:\Windows\system32\sysprep\sysprep.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\1f26e5f9b44c28b37b6cd13283838366_JaffaCakes118.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3332 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\1f26e5f9b44c28b37b6cd13283838366_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\temp.exe
PID 3332 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\1f26e5f9b44c28b37b6cd13283838366_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\temp.exe
PID 3204 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 3204 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 3204 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 3204 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 3204 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 3204 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 3204 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 3204 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 3204 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 3204 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 3204 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 3204 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 3204 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 3204 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 3204 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 3204 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 3204 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 3204 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 3204 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 3204 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 4036 N/A C:\Windows\Explorer.EXE C:\Windows\system32\sysprep\sysprep.exe
PID 3468 wrote to memory of 4036 N/A C:\Windows\Explorer.EXE C:\Windows\system32\sysprep\sysprep.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\1f26e5f9b44c28b37b6cd13283838366_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1f26e5f9b44c28b37b6cd13283838366_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\temp.exe

"C:\Users\Admin\AppData\Local\Temp\temp.exe"

C:\Windows\system32\sysprep\sysprep.exe

"C:\Windows\system32\sysprep\sysprep.exe" "C:\Users\Admin\AppData\Local\Temp\net.exe" "C:\Windows\system32" ""

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 16.53.126.40.in-addr.arpa udp
BE 88.221.83.243:443 www.bing.com tcp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 243.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\temp.exe

MD5 425609a2c35081730982a01d72a76cbe
SHA1 64f95fe985a7ef7ee4f396e36279aa31498ac3cc
SHA256 e03145fefe7fef82c2a476d7dec03305d7da79cd3c8fe1578177580175febbd3
SHA512 6ede1415ac51d588a71bfb5697a599eb777e9530240b7a3524626d2a230bb51017c9b3d05923c5cb41800cca9818f2d99484310390a0425ef8e48984c4c9cfd4

memory/3468-62-0x0000000002CB0000-0x0000000002CB1000-memory.dmp

memory/3468-61-0x0000000002AE0000-0x0000000002AE1000-memory.dmp