Analysis
-
max time kernel
147s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
14-01-2025 21:22
Behavioral task
behavioral1
Sample
JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe
Resource
win7-20240729-en
General
-
Target
JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe
-
Size
8.2MB
-
MD5
45cfd5b04853ee2519df5dbae83fea33
-
SHA1
5ee4e1ebf2723cecbe13afcf4d6636eed0ee0e38
-
SHA256
aacdf6bcb15afa56c07ffcd2e7f8fa9e26d920af1d4614c03edb24c6cb5cb6b8
-
SHA512
5734dcb76f7cf892b03c8540339ccd3f35797d6a66ba76f6b8c34c3f07890a3c75a13b2a8c853cc153439e69b9544566e6d6da19a23fad34df0d0e10d5dde052
-
SSDEEP
196608:QttvC0KNZskfwZ4r2W7Sx/I6Ohmq+j2GabhJv3WIp1i1TM7kV8EXT3bsi4u:QvClNtl2eMaAPohJvpwQ7kVRB
Malware Config
Extracted
cybergate
2.2.2
Victim
f-15aaa.no-ip.biz:288
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
svchost.exe
-
install_file
explore.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
?? ??????? ?????? ?????? ???????
-
message_box_title
??? ?????
-
password
123
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Cybergate family
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Explorer = "C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\explore.exe" JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Explorer = "C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\explore.exe" JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{ILL8053U-B2NN-RP20-2858-1DGV516WIW7F} JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ILL8053U-B2NN-RP20-2858-1DGV516WIW7F}\StubPath = "C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\explore.exe Restart" JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{ILL8053U-B2NN-RP20-2858-1DGV516WIW7F} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ILL8053U-B2NN-RP20-2858-1DGV516WIW7F}\StubPath = "C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\explore.exe" explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\explore.exe" JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\explore.exe" JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe -
resource yara_rule behavioral1/memory/2264-2-0x0000000024010000-0x000000002404D000-memory.dmp upx behavioral1/memory/2456-430-0x0000000024050000-0x000000002408D000-memory.dmp upx behavioral1/memory/2456-725-0x0000000024050000-0x000000002408D000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2628 vlc.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1876 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 2628 vlc.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1876 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe Token: SeDebugPrivilege 1876 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe Token: 33 2628 vlc.exe Token: SeIncBasePriorityPrivilege 2628 vlc.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 2628 vlc.exe 2628 vlc.exe 2628 vlc.exe 2628 vlc.exe 2628 vlc.exe 2628 vlc.exe -
Suspicious use of SendNotifyMessage 5 IoCs
pid Process 2628 vlc.exe 2628 vlc.exe 2628 vlc.exe 2628 vlc.exe 2628 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2628 vlc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21 PID 2264 wrote to memory of 1172 2264 JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe"2⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
PID:2456
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:2260
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_45cfd5b04853ee2519df5dbae83fea33.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1876 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\www.6rb.com_1203.mp3"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2628
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.2MB
MD545cfd5b04853ee2519df5dbae83fea33
SHA15ee4e1ebf2723cecbe13afcf4d6636eed0ee0e38
SHA256aacdf6bcb15afa56c07ffcd2e7f8fa9e26d920af1d4614c03edb24c6cb5cb6b8
SHA5125734dcb76f7cf892b03c8540339ccd3f35797d6a66ba76f6b8c34c3f07890a3c75a13b2a8c853cc153439e69b9544566e6d6da19a23fad34df0d0e10d5dde052
-
Filesize
8.1MB
MD542db08c5356e24d5accba9e10cca42b6
SHA185e21ee5a118cc3e236ba31e8ed97582d4996932
SHA256e7505c834b2001119ac4e684f8beace7390e1b0323626376794c452e0c933298
SHA5122e036b735dc40f34e41cdb2a92c873569f39fcedde24078f4894ff95ce7b38c6fa677d4c75100fd944f1852f40ebff0ad27f1e24237efd4febceedddec8d8557
-
Filesize
8.0MB
MD59277cc955c224814a9c234359aced7b1
SHA18d4c67d8f3685c4ea5531996bdac526dc06edc26
SHA256ae1adc6b3123965472a392260a438c4193b23b2a551397ec2e0e9c924d21c19c
SHA5124b5fbe3e9bb270c9d0668a9fdd0ba73051587c34fc160de852b080362559c955855ae1d4bf9641e929241f62997e5ee09e349e67ead4c0731d639d6f342cf50f
-
Filesize
15B
MD586f3c87caff4d7973404ff22c664505b
SHA1245bc19c345bc8e73645cd35f5af640bc489da19
SHA256e8ab966478c22925527b58b0a7c3d89e430690cbdabb44d501744e0ad0ac9ddb
SHA5120940c4b339640f60f1a21fc9e4e958bf84f0e668f33a9b24d483d1e6bfcf35eca45335afee1d3b7ff6fd091b2e395c151af8af3300e154d3ea3fdb2b73872024