Analysis
-
max time kernel
93s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10-09-2024 12:05
Behavioral task
behavioral1
Sample
d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe
-
Size
906KB
-
MD5
d83ec89d150cd9c5c44350ee9892dce2
-
SHA1
e811704c6a02ccedd44c484e26855629834bcd3e
-
SHA256
a9861076a523de84e82c059cc03d1cd7d74bef2f08ebdf6800d8ae70b41ebc8f
-
SHA512
e1edff6e14ad140e551f31301f7d51e70c34bccede52694090cbb20841c867898a98883f2d6671b97181e8ebd84a2bdce1d24b4774d5555863c1ebb2646c90e8
-
SSDEEP
24576:VZ25dInPGE4IVFz7/2i2Osj2+dTX1ITRmmx9+5b:7nnOEDFzf2O22TRm6ab
Malware Config
Extracted
cybergate
v1.07.5
remote
vittimareturn.no-ip.org:81
androidgame.no-ip.org:81
45103OXRQ35N34
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
google
-
install_file
google.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
cybergate
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\google\\google.exe" d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\google\\google.exe" d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{G7JRBY6E-TGLB-NXB8-6235-425L83GV7G43} d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{G7JRBY6E-TGLB-NXB8-6235-425L83GV7G43}\StubPath = "C:\\Windows\\system32\\google\\google.exe Restart" d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Wine d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/2356-0-0x0000000000400000-0x00000000005B8000-memory.dmp themida behavioral2/memory/2356-2-0x0000000000400000-0x00000000005B8000-memory.dmp themida behavioral2/memory/2356-3-0x0000000000400000-0x00000000005B8000-memory.dmp themida behavioral2/memory/2356-4-0x0000000000400000-0x00000000005B8000-memory.dmp themida behavioral2/memory/2356-8-0x0000000000400000-0x00000000005B8000-memory.dmp themida -
resource yara_rule behavioral2/memory/2356-7-0x0000000010410000-0x0000000010475000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\google\\google.exe" d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\google\\google.exe" d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\google\google.exe d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\google\google.exe d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2356 d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 5032 2356 WerFault.exe 82 2296 2356 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2356 d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe 2356 d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe 2356 d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe 2356 d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2356 d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d83ec89d150cd9c5c44350ee9892dce2_JaffaCakes118.exe"1⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Identifies Wine through registry keys
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2356 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 7442⤵
- Program crash
PID:5032
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 7482⤵
- Program crash
PID:2296
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2356 -ip 23561⤵PID:2948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2356 -ip 23561⤵PID:4424
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2