Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
23-07-2024 12:54
Static task
static1
Behavioral task
behavioral1
Sample
67acd7f3dc47920609a860f51fa80585_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
67acd7f3dc47920609a860f51fa80585_JaffaCakes118.exe
-
Size
872KB
-
MD5
67acd7f3dc47920609a860f51fa80585
-
SHA1
09cafd23dc43a8aad33d8bec70da9243736e9d26
-
SHA256
f26c5e1fe485d48ad0a7de4e9598c2678cb633524208b315a7ba6d10334db01d
-
SHA512
ff2d7c98443f0a7b2564e5f0488be3b796fe1d16fff4f2b31f0f59b8f5f8ea005cfde5018a9168abddc1c7989945c1230b49bf7db70146e6f98b855aff37d56a
-
SSDEEP
12288:m2MmhmeUF8mpUY0Dxrg69wje84BbxS4PTaPoPQRzC9tVaiu6Ynw+jDGddSK2bpQh:mNM9iEfo2dwwiG/v40YS
Malware Config
Extracted
cybergate
v1.07.5
Cyber
mrfishy.zapto.org:82
B64RW1O333VTF2
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
WinDir
-
install_file
sys32.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
123456
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
67acd7f3dc47920609a860f51fa80585_JaffaCakes118.exedescription pid process target process PID 2508 set thread context of 2756 2508 67acd7f3dc47920609a860f51fa80585_JaffaCakes118.exe svchost.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2768 2756 WerFault.exe svchost.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
67acd7f3dc47920609a860f51fa80585_JaffaCakes118.exesvchost.exedescription pid process target process PID 2508 wrote to memory of 2756 2508 67acd7f3dc47920609a860f51fa80585_JaffaCakes118.exe svchost.exe PID 2508 wrote to memory of 2756 2508 67acd7f3dc47920609a860f51fa80585_JaffaCakes118.exe svchost.exe PID 2508 wrote to memory of 2756 2508 67acd7f3dc47920609a860f51fa80585_JaffaCakes118.exe svchost.exe PID 2508 wrote to memory of 2756 2508 67acd7f3dc47920609a860f51fa80585_JaffaCakes118.exe svchost.exe PID 2508 wrote to memory of 2756 2508 67acd7f3dc47920609a860f51fa80585_JaffaCakes118.exe svchost.exe PID 2508 wrote to memory of 2756 2508 67acd7f3dc47920609a860f51fa80585_JaffaCakes118.exe svchost.exe PID 2508 wrote to memory of 2756 2508 67acd7f3dc47920609a860f51fa80585_JaffaCakes118.exe svchost.exe PID 2508 wrote to memory of 2756 2508 67acd7f3dc47920609a860f51fa80585_JaffaCakes118.exe svchost.exe PID 2508 wrote to memory of 2756 2508 67acd7f3dc47920609a860f51fa80585_JaffaCakes118.exe svchost.exe PID 2508 wrote to memory of 2756 2508 67acd7f3dc47920609a860f51fa80585_JaffaCakes118.exe svchost.exe PID 2508 wrote to memory of 2756 2508 67acd7f3dc47920609a860f51fa80585_JaffaCakes118.exe svchost.exe PID 2508 wrote to memory of 2756 2508 67acd7f3dc47920609a860f51fa80585_JaffaCakes118.exe svchost.exe PID 2508 wrote to memory of 2756 2508 67acd7f3dc47920609a860f51fa80585_JaffaCakes118.exe svchost.exe PID 2508 wrote to memory of 2756 2508 67acd7f3dc47920609a860f51fa80585_JaffaCakes118.exe svchost.exe PID 2756 wrote to memory of 2768 2756 svchost.exe WerFault.exe PID 2756 wrote to memory of 2768 2756 svchost.exe WerFault.exe PID 2756 wrote to memory of 2768 2756 svchost.exe WerFault.exe PID 2756 wrote to memory of 2768 2756 svchost.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\67acd7f3dc47920609a860f51fa80585_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\67acd7f3dc47920609a860f51fa80585_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 523⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2508-0-0x0000000074001000-0x0000000074002000-memory.dmpFilesize
4KB
-
memory/2508-1-0x0000000074000000-0x00000000745AB000-memory.dmpFilesize
5.7MB
-
memory/2508-2-0x0000000074000000-0x00000000745AB000-memory.dmpFilesize
5.7MB
-
memory/2508-4-0x0000000074000000-0x00000000745AB000-memory.dmpFilesize
5.7MB
-
memory/2756-3-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2756-5-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB