Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
31-08-2024 20:19
Behavioral task
behavioral1
Sample
cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe
-
Size
822KB
-
MD5
cd8807dbdfa59786457e1dbfcc473746
-
SHA1
4960570494abff02eb1500228fb401e85137ec89
-
SHA256
418d1476e7e4b5c964545709c37253a7e2c0ba0e6dc775771205bd308f55fa11
-
SHA512
5661708014696e344c02a35295e4530b4bf0534de97f5ca5903257d3837194ebe2e6f63043e272bc6744f8a0f983f7eb940436ba1c7bbce9e42fb672bca06d19
-
SSDEEP
24576:SALtwCc26uGi2VCHXSBzTaDMsAQRN5Ryn4qTU:fLWpYgBzsMsAQRN5qVY
Malware Config
Extracted
cybergate
2.7 Final
vítima
moustapha123.no-ip.info:81
***MUTEX***
-
enable_keylogger
false
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
explorer.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
título da mensagem
-
password
abcd1234
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Processes:
cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exeexplorer.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DVJMOY56-FVE6-6831-4448-21U5FX3XE50R}\StubPath = "C:\\Windows\\system32\\install\\explorer.exe Restart" cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{DVJMOY56-FVE6-6831-4448-21U5FX3XE50R} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DVJMOY56-FVE6-6831-4448-21U5FX3XE50R}\StubPath = "C:\\Windows\\system32\\install\\explorer.exe" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{DVJMOY56-FVE6-6831-4448-21U5FX3XE50R} cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule behavioral2/files/0x00090000000233f4-2.dat acprotect -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
explorer.exepid Process 6784 explorer.exe -
Loads dropped DLL 5 IoCs
Processes:
cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exeexplorer.exeexplorer.exepid Process 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 3464 explorer.exe 6784 explorer.exe 6784 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\explorer.exe" cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\explorer.exe" cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
Processes:
cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exedescription ioc Process File created C:\Windows\SysWOW64\install\explorer.exe cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\install\explorer.exe cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe -
Drops file in Program Files directory 20 IoCs
Processes:
explorer.exedescription ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe explorer.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe explorer.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe explorer.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE explorer.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe explorer.exe File opened for modification C:\Program Files\dotnet\dotnet.exe explorer.exe File opened for modification C:\Program Files\7-Zip\7z.exe explorer.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe explorer.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe explorer.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe explorer.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe explorer.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe explorer.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe explorer.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE explorer.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe explorer.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe explorer.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe explorer.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe explorer.exe File opened for modification C:\Program Files\7-Zip\7zG.exe explorer.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 2416 6784 WerFault.exe 92 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exeexplorer.execd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exeexplorer.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Modifies registry class 1 IoCs
Processes:
cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exepid Process 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exepid Process 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exeexplorer.exepid Process 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 3464 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exedescription pid Process procid_target PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56 PID 1832 wrote to memory of 3496 1832 cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe"2⤵
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3464
-
-
C:\Users\Admin\AppData\Local\Temp\cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cd8807dbdfa59786457e1dbfcc473746_JaffaCakes118.exe"3⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1864 -
C:\Windows\SysWOW64\install\explorer.exe"C:\Windows\system32\install\explorer.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:6784 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6784 -s 6205⤵
- Program crash
PID:2416
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 6784 -ip 67841⤵PID:6968
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
588KB
MD50fe77c7df1da831e2f6b04fd38c52ce9
SHA1249e3a852d98ffd025e54628383b5b21ff8da30c
SHA256c5e9937ac07e2527559869c4425f4ec3f1704d4ee47f1d460bae7461606018da
SHA51276ef00cb7c1c93c332ae1bbbb087d8842343a37871d978a28b64589dac58bb30ad4e620e64a7466288a165b784ca9c9b909265879979eee3c771cbb7b70b01e4
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
822KB
MD5cd8807dbdfa59786457e1dbfcc473746
SHA14960570494abff02eb1500228fb401e85137ec89
SHA256418d1476e7e4b5c964545709c37253a7e2c0ba0e6dc775771205bd308f55fa11
SHA5125661708014696e344c02a35295e4530b4bf0534de97f5ca5903257d3837194ebe2e6f63043e272bc6744f8a0f983f7eb940436ba1c7bbce9e42fb672bca06d19