Overview

overview

10

Static

static

3

7549fe42cf...18.exe

windows7-x64

10

7549fe42cf...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    102s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    26-07-2024 18:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7549fe42cffb0adeb13cc91b2540d6b1_JaffaCakes118.exe

  • Size

    272KB

  • MD5

    7549fe42cffb0adeb13cc91b2540d6b1

  • SHA1

    1b73c5253ff1a49ac78d60858df5d1c749b650df

  • SHA256

    2b81ed549fbe39010b355378886480a3481fdda28ab4807e63ccffe0395434f1

  • SHA512

    732a65e6b8854309e0ad56b9be61887905467f5be3a26736fd9bb60710da25e6eb27cc8400c156fa893c48f25bd5834d705b9a08d0847fb4c41569add7769d91

  • SSDEEP

    6144:s8U2YYy2qPNNOJLNPsfJW/Q4DL+G13+0gyuyifHZizZbBhgDDAXSyjOZ:FX5yHNNOJLNURWlSG1u0tuyyipDgDkdo

Score
10/10
ponycredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\7549fe42cffb0adeb13cc91b2540d6b1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7549fe42cffb0adeb13cc91b2540d6b1_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2896
    • C:\Users\Admin\AppData\Local\Temp\7549fe42cffb0adeb13cc91b2540d6b1_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\7549fe42cffb0adeb13cc91b2540d6b1_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\78796\D4C80.exe%C:\Users\Admin\AppData\Roaming\78796
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1352
    • C:\Users\Admin\AppData\Local\Temp\7549fe42cffb0adeb13cc91b2540d6b1_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\7549fe42cffb0adeb13cc91b2540d6b1_JaffaCakes118.exe startC:\Program Files (x86)\960EB\lvvm.exe%C:\Program Files (x86)\960EB
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1572
    • C:\Program Files (x86)\LP\8087\253C.tmp
      "C:\Program Files (x86)\LP\8087\253C.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1060
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2984
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2316
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x558
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

4
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Query Registry

2
T1012

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\78796\60EB.879
    Filesize

    996B

    MD5

    f15d54c4b9a0344c60644da6bbe4d447

    SHA1

    fc229881562eb97ff80012e0cc2eafdd50e59aca

    SHA256

    ee2641536c5420412d969d6f8d6d03dd31b61bdeeaa61a200fce8017e6f6eec7

    SHA512

    f5a201b7913529aa60d00882f8c468b9378b5a2a73a3e84ee1825f0e062197cb956813fe6e2651f6d68ebddd6589ffbfb028eeae9ea7b442516e9e043837ca0f

    Download Submit

  • C:\Users\Admin\AppData\Roaming\78796\60EB.879
    Filesize

    600B

    MD5

    c8d11a0bbc3af63b614eb5ce31f98c09

    SHA1

    7039f64c6b7e81fa52c2695e7d57480f66e79407

    SHA256

    6c0554879e822ac8cbbc52c31ac71368117f9c1ea3fff6398606f62606d407fe

    SHA512

    049163f9e69454a0451e657c10c9cda61afd2f811122737c28ed173a28e4a153a85c00c35900e8ed19827abc49a57a2e0e143360accb7ca38b4460e1cd24a742

    Download Submit

  • C:\Users\Admin\AppData\Roaming\78796\60EB.879
    Filesize

    1KB

    MD5

    3cc1bd08d45c3173cd567a1ea76886f8

    SHA1

    7ee90208867ab8f579d62b8c0f56cdc42e8e5fa8

    SHA256

    392937d9db9fafa18c23f667c958bba54282c7c3bec955a2eea4231db79bdd49

    SHA512

    e2c058c9171b2f16b58ad7cddc5c91f2c054b0baf418013904d01d26e3dcb1c46c211a71a293c5094cf1eb57ee3c12c73f3f32daf7089e4ccff70019460f83db

    Download Submit

  • \Program Files (x86)\LP\8087\253C.tmp
    Filesize

    96KB

    MD5

    3e46f83109b96666a6e103dc91e37761

    SHA1

    e0c1c8f9912707fb79edbe14feb9e27a0b3b3214

    SHA256

    b300587e7b45f428cdbfdff40072a4fd40ccb0411821eff3c2d78bad6a2fcf6c

    SHA512

    71e19e0d9ae5e7d2502e0a6affbbe9a36fa594a4dc3f6343b29aeb7f041b624e11a82f86c1cfe185d7faa8abd3666419e0f10176fa35696031a0dffe6c91adbb

    Download Submit

  • memory/1060-312-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/1352-16-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/1352-17-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/1572-194-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/2896-15-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/2896-134-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

    Download

  • memory/2896-0-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/2896-195-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/2896-4-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/2896-3-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/2896-311-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/2896-2-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

    Download

  • memory/2896-316-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download