Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11-09-2024 20:29
Static task
static1
Behavioral task
behavioral1
Sample
db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
db295321c287aceba94bdaa3b2141cb6
-
SHA1
18aeb11cf5e1d3579fb30862c56a70ace4b7ac45
-
SHA256
5203699ca3784d105e35cb5ee1092afb366653b4b57717bbc09d77f0e48386f3
-
SHA512
07720a0d47e8c616cee15a3874cdbdf586f24bb072e23f965e0350e4325724a7d841cb2642e5b0d0536ebf531ee912aa5d57d2690074ff38851b25fb4b767d88
-
SSDEEP
24576:pRmJkcoQricOIQxiZY1iaGPoPqZyONw4jDVslGWvn0GZ85:mJZoQrbTFZY1ia6d1jDyIYn0GZ85
Malware Config
Extracted
cybergate
v1.01.8
remote
freeforfree.ddns.net:999
upgrade
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
updated.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
FUNCIOANL EXECUTOU
-
message_box_title
CyberGate
-
password
cybergate
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\updated.exe" db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\updated.exe" db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{445N60N3-08V0-S2B7-RWIS-4QV11S48Q5X2} db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{445N60N3-08V0-S2B7-RWIS-4QV11S48Q5X2}\StubPath = "C:\\Windows\\system32\\install\\updated.exe Restart" db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{445N60N3-08V0-S2B7-RWIS-4QV11S48Q5X2} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{445N60N3-08V0-S2B7-RWIS-4QV11S48Q5X2}\StubPath = "C:\\Windows\\system32\\install\\updated.exe" explorer.exe -
Executes dropped EXE 2 IoCs
pid Process 3952 updated.exe 1816 updated.exe -
resource yara_rule behavioral2/memory/4684-6-0x0000000024010000-0x0000000024070000-memory.dmp upx behavioral2/memory/4684-10-0x0000000024070000-0x00000000240D0000-memory.dmp upx behavioral2/memory/1620-73-0x0000000024070000-0x00000000240D0000-memory.dmp upx behavioral2/memory/3484-139-0x00000000240D0000-0x0000000024130000-memory.dmp upx behavioral2/memory/1620-159-0x0000000024070000-0x00000000240D0000-memory.dmp upx behavioral2/memory/3484-163-0x00000000240D0000-0x0000000024130000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\updated.exe" db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\updated.exe" db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000900000002342b-75.dat autoit_exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\install\updated.exe db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\install\updated.exe db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\install\updated.exe explorer.exe File opened for modification C:\Windows\SysWOW64\install\ explorer.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4336 set thread context of 4684 4336 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 89 PID 3952 set thread context of 1816 3952 updated.exe 99 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language updated.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language updated.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4336 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 4336 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 3952 updated.exe 3952 updated.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3484 explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3484 explorer.exe Token: SeDebugPrivilege 3484 explorer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4336 wrote to memory of 4684 4336 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 89 PID 4336 wrote to memory of 4684 4336 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 89 PID 4336 wrote to memory of 4684 4336 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 89 PID 4336 wrote to memory of 4684 4336 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 89 PID 4336 wrote to memory of 4684 4336 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 89 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56 PID 4684 wrote to memory of 3456 4684 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe"3⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
PID:1620
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3484 -
C:\Windows\SysWOW64\install\updated.exe"C:\Windows\system32\install\updated.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3952 -
C:\Windows\SysWOW64\install\updated.exe"C:\Windows\SysWOW64\install\updated.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1816
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
221KB
MD50746e5babcefa3b07c8f315a42fcdabb
SHA18f6f15241bfe1d9f15f0f86af11e25f92d144cc0
SHA2567ead0f724ec2fd62f1ed50b0856fda637fa8ef2ee5de8eb33fef1df58faa3806
SHA5128025ba2a59c712dadfe932bfcce90a1a111e6b72a7346d0e114001afadb8e85d9374a857be3897f785d4a0dc5967fb2ea2ab675d46a69e79263758b8ee44ea8f
-
Filesize
8B
MD52d7d96e1506a9c6fea76419503f543fa
SHA1e83d93d23c1f4a14293b199f70c266740cc4207a
SHA256ab7c980be74f08772850f4e7d2eeed0cf98952c54f403f9231e7fa1d1811aaa4
SHA512694c1efd63c03f9fcdb2d5fba091ed095b9443a052e8224a49682e6397d37ce99e38901219218053568a4742f47935b50e5a8dc6437297f58173c243c493fc4b
-
Filesize
8B
MD5f9b2e83dec24981e83f8d65db8a9b102
SHA1bf460acba8f7620c29481a97ba43e40a9f50d73a
SHA2569751be5ac7a25caaa41431423f90e2eecc71112329a14fc93a9294125a1b6328
SHA512a12c27f22de3ace3d88d5f6e9f369c9c55bd4ab37dedf39d81a4ae4e86b85dbca0ae2519027077e6b4042ed64c5e7ee394687bc57ac173162cc28e02e15b83d1
-
Filesize
8B
MD554e01f5251006d8fcd218f5994fc2e5b
SHA122f7fdb8fd52271ae806456425118fea50fc5203
SHA2568cc854dfd9f5a483337e56a3ffba6eda2c1264aacd38c1d2373a62056c2f635f
SHA512d11ae1d34a948e2585a7c49e096d141dbe4d8fabbe1237627b623c9c487792844c8bf8d0e2b119079f13e57e301347091119b7e4dfcc5847daa79be4ca26b82c
-
Filesize
8B
MD532ee19a3f1036e7bcaeff1752e8425f9
SHA186850e6558a130bcc44723c378a02c1ee1410b3e
SHA256e14d39fd72edac8c0323978d2119514c3dbbf8e318daa968e106bda638c1aa52
SHA5122a5227ffb6c14c6c2a1c1a9e8f88f258c246d62ce44f7e1d65f5ca578423d73d7fbfa0a487f4b2f9d5da7a66ac4e10b19e383ea29c18557be403e5059abe56df
-
Filesize
15B
MD5bf3dba41023802cf6d3f8c5fd683a0c7
SHA1466530987a347b68ef28faad238d7b50db8656a5
SHA2564a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314
-
Filesize
1.1MB
MD5db295321c287aceba94bdaa3b2141cb6
SHA118aeb11cf5e1d3579fb30862c56a70ace4b7ac45
SHA2565203699ca3784d105e35cb5ee1092afb366653b4b57717bbc09d77f0e48386f3
SHA51207720a0d47e8c616cee15a3874cdbdf586f24bb072e23f965e0350e4325724a7d841cb2642e5b0d0536ebf531ee912aa5d57d2690074ff38851b25fb4b767d88