Analysis

  • max time kernel
    142s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07-04-2024 23:25

General

  • Target

    e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe

  • Size

    273KB

  • MD5

    e61afa2a7110f1a61e538b3e20c0708e

  • SHA1

    dc368a0e9dc02a2091d13c6c4c68ec1300df35f4

  • SHA256

    53c36808f6d8c6ed26b2d2494cab0d5976c792d6bae2120c8a27a5149d27e94c

  • SHA512

    fbdc3058838842e8c0d150bd75386571f87ad5dffa047922e057feed85f4b725ae3955fc9d8c75117f1eb1e71745bd1e79ce76ccb486dc0c995af946fb4a7bca

  • SSDEEP

    6144:5Q+7l60LCYhb9XlIToRWyGm1f8czjOXNbYAIzwyPqX:blhXJX6oGm1f3jGbIMIK

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Disables taskbar notifications via registry modification
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 3 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2040
    • C:\Users\Admin\AppData\Local\Temp\e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\CFE00\CA366.exe%C:\Users\Admin\AppData\Roaming\CFE00
      2⤵
        PID:2164
      • C:\Users\Admin\AppData\Local\Temp\e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe startC:\Program Files (x86)\00943\lvvm.exe%C:\Program Files (x86)\00943
        2⤵
          PID:648
        • C:\Program Files (x86)\LP\66EC\9157.tmp
          "C:\Program Files (x86)\LP\66EC\9157.tmp"
          2⤵
          • Executes dropped EXE
          PID:648
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2124
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:892

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\CFE00\0943.FE0

        Filesize

        996B

        MD5

        2cfaa86e22fb567d54508b9ea9114c30

        SHA1

        9cd53db30affbf14ce1afcebff2f1f2adf3ef69a

        SHA256

        8e49317ec427af27f2bdaefd6b9e3ef4dc2452017855b0c885ae42cf1ec9b6b6

        SHA512

        d82e598bdf1deb9eb8ebae0c5db0980702a0f9d35f43d9f8d469356c9187ab751464de157fb927c373fea27c5bb77134c340f648cb20a39844f2c7d1df803c6e

      • C:\Users\Admin\AppData\Roaming\CFE00\0943.FE0

        Filesize

        600B

        MD5

        3a403f1fb6a23a8767b90c20a7db3173

        SHA1

        0f93248add548dae3083d97abcfa8759d59a7a40

        SHA256

        ea5c859318a981d25e40f50c358490d52ddb245dd41aa6c64c5297776140d4a9

        SHA512

        daa17237df1a2480f16af13832b44f6bf499f4c48886e560bc625ced3eeea50127bb85c1131b31f60b832419da61713ce14a6d74b2a3cff252f8f8f4453cd5c1

      • C:\Users\Admin\AppData\Roaming\CFE00\0943.FE0

        Filesize

        1KB

        MD5

        369d1733362e9735650d5c1f7c87177c

        SHA1

        4726d5b675b739ba62a675a39727c8d5cf5e3570

        SHA256

        510a41cf0b84b60a40997d42653b6f51947edfbc0ba254d561a8b8b19131337e

        SHA512

        f795a895f11ca3a628142a94452837d953b6602d78ecfe86e1c56c76fa1e2a2752449f7a4279e69e56477b40680c89ebfc04cb09733ad4c1f14ea424ae2a5904

      • C:\Users\Admin\AppData\Roaming\CFE00\0943.FE0

        Filesize

        300B

        MD5

        71ea220bb596667539770f4978f0d44d

        SHA1

        5e5bbf31e8c54848589af4f6207bfa6d3decd182

        SHA256

        c05d25caf8f42b0fef8110e0eb27269d21666971c6ef21c77d4cd4423e7a858f

        SHA512

        9237857b5fc2d5b7d147cd4d2e761309a3648ddc9958e8bad5467027f6baf5d70dbdc602baa3fa47202929ce7cc114838ed54733d1ee644fc774b86d6e114f26

      • \Program Files (x86)\LP\66EC\9157.tmp

        Filesize

        96KB

        MD5

        74a1e9547eb8c42e9ca482c5c8bdd261

        SHA1

        c56c60e84b4ef45065289636cfdfab21654acdb3

        SHA256

        f4ac8ead1ff2f95c2b50405531d433d7af912b8f848095d3cb00401576ee90fb

        SHA512

        ae90627a5f1485383b6de178aea4b36f9e44891d78fe5a274d1632727dd71906061323725a7c3c106b039cb65e10ea7e9c7d277ce35fb0ac6458fdc3e346ecb9

      • memory/648-126-0x0000000000580000-0x0000000000680000-memory.dmp

        Filesize

        1024KB

      • memory/648-125-0x0000000000400000-0x000000000046A000-memory.dmp

        Filesize

        424KB

      • memory/648-124-0x0000000000400000-0x000000000046A000-memory.dmp

        Filesize

        424KB

      • memory/648-299-0x0000000000400000-0x000000000041C000-memory.dmp

        Filesize

        112KB

      • memory/648-298-0x0000000000580000-0x0000000000680000-memory.dmp

        Filesize

        1024KB

      • memory/648-296-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/648-295-0x0000000000400000-0x000000000041C000-memory.dmp

        Filesize

        112KB

      • memory/892-278-0x0000000004490000-0x0000000004491000-memory.dmp

        Filesize

        4KB

      • memory/892-301-0x0000000004490000-0x0000000004491000-memory.dmp

        Filesize

        4KB

      • memory/2040-2-0x0000000000290000-0x0000000000390000-memory.dmp

        Filesize

        1024KB

      • memory/2040-1-0x0000000000400000-0x000000000046A000-memory.dmp

        Filesize

        424KB

      • memory/2040-181-0x0000000000290000-0x0000000000390000-memory.dmp

        Filesize

        1024KB

      • memory/2040-297-0x0000000000400000-0x000000000046A000-memory.dmp

        Filesize

        424KB

      • memory/2040-14-0x0000000000400000-0x000000000046A000-memory.dmp

        Filesize

        424KB

      • memory/2040-122-0x0000000000400000-0x000000000046A000-memory.dmp

        Filesize

        424KB

      • memory/2040-303-0x0000000000400000-0x000000000046A000-memory.dmp

        Filesize

        424KB

      • memory/2164-13-0x0000000000537000-0x0000000000559000-memory.dmp

        Filesize

        136KB

      • memory/2164-12-0x0000000000400000-0x000000000046A000-memory.dmp

        Filesize

        424KB