Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10-09-2024 12:05
Behavioral task
behavioral1
Sample
d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe
-
Size
906KB
-
MD5
d83ec89d150cd9c5c44350ee9892dce2
-
SHA1
e811704c6a02ccedd44c484e26855629834bcd3e
-
SHA256
a9861076a523de84e82c059cc03d1cd7d74bef2f08ebdf6800d8ae70b41ebc8f
-
SHA512
e1edff6e14ad140e551f31301f7d51e70c34bccede52694090cbb20841c867898a98883f2d6671b97181e8ebd84a2bdce1d24b4774d5555863c1ebb2646c90e8
-
SSDEEP
24576:VZ25dInPGE4IVFz7/2i2Osj2+dTX1ITRmmx9+5b:7nnOEDFzf2O22TRm6ab
Malware Config
Extracted
cybergate
v1.07.5
remote
vittimareturn.no-ip.org:81
androidgame.no-ip.org:81
45103OXRQ35N34
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
google
-
install_file
google.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
cybergate
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\google\\google.exe" d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\google\\google.exe" d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{G7JRBY6E-TGLB-NXB8-6235-425L83GV7G43} d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{G7JRBY6E-TGLB-NXB8-6235-425L83GV7G43}\StubPath = "C:\\Windows\\system32\\google\\google.exe Restart" d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2396-0-0x0000000000400000-0x00000000005B8000-memory.dmp themida behavioral1/memory/2396-2-0x0000000000400000-0x00000000005B8000-memory.dmp themida behavioral1/memory/2396-8-0x0000000000400000-0x00000000005B8000-memory.dmp themida behavioral1/memory/2396-6-0x0000000000400000-0x00000000005B8000-memory.dmp themida -
resource yara_rule behavioral1/memory/2396-5-0x0000000010410000-0x0000000010475000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\google\\google.exe" d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\google\\google.exe" d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\google\google.exe d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\google\google.exe d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2396 d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2396 d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe 2396 d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2396 d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe"1⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Identifies Wine through registry keys
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2396