Analysis
-
max time kernel
148s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-10-2024 19:05
General
-
Target
36579f993dd7055151c3210052e5a263_JaffaCakes118.exe
-
Size
2.0MB
-
MD5
36579f993dd7055151c3210052e5a263
-
SHA1
fd47caef4d54ccc1f0bc05108c4baebb45323a9b
-
SHA256
d9f732b1bca75cec93432879afd20b133a5182d96715c18a0d289d9cc626c327
-
SHA512
9db7a011e210596175ef268d8d121a6265c8abd805afa7b7ebbf61d4a4a911de1fe1cc6b6a6adf973cf8069584ed27366a0d004bfbab39b5a1ec664a2a385883
-
SSDEEP
49152:m2qcPucLdeWmZAJqNXE4HnD6eFZZPfNQrVDSjGGekUwRpnfwwhx:wcvdlmKJqdHnD3FZYSTekUw/nfwwhx
Malware Config
Extracted
cybergate
2.5
vítima
loko123.no-ip.org:80
Hola
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
título da mensagem
-
password
abcd1234
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
-
Adds policy Run key to start application 2 TTPs 4 IoCs
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\36579f993dd7055151c3210052e5a263_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\36579f993dd7055151c3210052e5a263_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\36579f993dd7055151c3210052e5a263_JaffaCakes118.exe2⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\36579f993dd7055151c3210052e5a263_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\36579f993dd7055151c3210052e5a263_JaffaCakes118.exe"3⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD536579f993dd7055151c3210052e5a263
SHA1fd47caef4d54ccc1f0bc05108c4baebb45323a9b
SHA256d9f732b1bca75cec93432879afd20b133a5182d96715c18a0d289d9cc626c327
SHA5129db7a011e210596175ef268d8d121a6265c8abd805afa7b7ebbf61d4a4a911de1fe1cc6b6a6adf973cf8069584ed27366a0d004bfbab39b5a1ec664a2a385883
-
Filesize
1.5MB
MD538cd0d0885353bdaa8e8e69093f2755a
SHA13b91cce573f8b186a7f21844dbba66308ee5b210
SHA256d4684bc7900fe1e1458bb09f5c59a75934162b3527ea34dc0af639e7ae0bb614
SHA512024bb3f1c20b7d654d359efc4ab1413f9864c841b446a0ab1f6d61626685e5f1faab83ecc12d42c463509744aa5b12a6c0bb782d9ad55c398e142bae2b00f29c
-
Filesize
1.6MB
MD5dc8665167afe57139c77f4ea4a049357
SHA100d4874ee30c56d9eb23b668e6030069d271ea32
SHA256d184d6fe1d1d30adbc8fb5093db6fac5dd80a9c64c891695b3174135425bbaea
SHA51224e97b490cc2913ab5a123f0b5367ca5f73e8a5425fd291fbf2bb56bc06194c2beb8c6e1e5bbdb83733940e54ac38dc1c3a10605901b268db40ff41f12305352
-
Filesize
15B
MD54362e21af8686f5ebba224768d292a5b
SHA1504510a4d10e230dcd1605ab3342525b38a10933
SHA256b1b2cc9a6bf77f9e56955acbbce253c70fc25b92d1e150d9928b9183b19b93b3
SHA512f2ee4b95d5c50b533de93f21f9d73a75ab8c755ab9f343b4848bd92b6827e76dc5e17fe27b0f2ad2049a1ee0fe20d0cb0398b1973277b85e84b6af004e945850
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
264KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
264KB
-
Filesize
268KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
268KB
-
Filesize
268KB
-
Filesize
268KB
-
Filesize
268KB
-
Filesize
268KB
