Overview

overview

10

Static

static

3

81cf0ab50d...18.exe

windows7-x64

10

81cf0ab50d...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    01-08-2024 21:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    81cf0ab50def006e87814ef075560e79_JaffaCakes118.exe

  • Size

    267KB

  • MD5

    81cf0ab50def006e87814ef075560e79

  • SHA1

    b850e2e8e81738bb0b67958c2d90d4d3f82aead8

  • SHA256

    bbb250b6b82b5da20a11718d45d1dea4e760c2f9acdba594bf3021c1b2bd3676

  • SHA512

    efbc932f672e12e68fda7b953c7a0518c056a398219a1897b020a8b407c4a6b4490b7a5c111b2f8116d6bbb0ef4894e4511fc95455751739dc79e191f9eec6b0

  • SSDEEP

    6144:e9nHPoWtWBVJjMCPnsWmoQKSdEOWlzwaKNmnsimFfmwOEt4fqfI:8AvIcnsWACeaKNPFdOEafb

Score
10/10
ponycredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 17 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\81cf0ab50def006e87814ef075560e79_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\81cf0ab50def006e87814ef075560e79_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2632
    • C:\Users\Admin\AppData\Local\Temp\81cf0ab50def006e87814ef075560e79_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\81cf0ab50def006e87814ef075560e79_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\2A243\CB8E9.exe%C:\Users\Admin\AppData\Roaming\2A243
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2728
    • C:\Users\Admin\AppData\Local\Temp\81cf0ab50def006e87814ef075560e79_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\81cf0ab50def006e87814ef075560e79_JaffaCakes118.exe startC:\Program Files (x86)\438C9\lvvm.exe%C:\Program Files (x86)\438C9
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1920
    • C:\Program Files (x86)\LP\E9E2\60C6.tmp
      "C:\Program Files (x86)\LP\E9E2\60C6.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:920
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1500
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

4
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Query Registry

2
T1012

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\2A243\38C9.A24
    Filesize

    996B

    MD5

    2cde9d816d2fab4d26694aeaf0d9dfb1

    SHA1

    1ec783953a5bee3c3eb0319ff654616ffcc2b678

    SHA256

    250b16d1e351be4a79c39d5ebd4e760325f043e82f3da6a8bfde8d7e38ff45c6

    SHA512

    9b3512abf8be64c682c6d7c18626b89d4b12b2da02e3b22038488de0af49e163b794c13051d56d97cb57a7459d772e3c48e75d5af712ea0c3b7639a2d36740d5

    Download Submit

  • C:\Users\Admin\AppData\Roaming\2A243\38C9.A24
    Filesize

    600B

    MD5

    059ca24ca0ef9c09c0ec07651fa5490a

    SHA1

    62490b1fed0cc11178ccd5a8e1d88f2b04bb7f8f

    SHA256

    86c135d82299a33378759999b1bc7a72eebe20fe4e9f9eb42f19983f412bfdee

    SHA512

    981fa1ab65d46b814e29721569b53146978d6fc0781224ff097e58337565cf5ad9a41c4d508c2f6c275e83e99bc440df7cb674573b790d54135d321d7174bb31

    Download Submit

  • C:\Users\Admin\AppData\Roaming\2A243\38C9.A24
    Filesize

    1KB

    MD5

    9d471090dcf9952a257e60c5836b177b

    SHA1

    d99888fe8896f21143c06b6f17eb5a4cfd73341e

    SHA256

    f68c3e8b43b956cf21301866b40b89f50d4955a19a848f5e01ff522a4336415c

    SHA512

    df94463423f3ea4b5a193e06f631d9d0369e38df30de46cddc394016f622b4a436faf278a35fabad55fec5268662369ad45ea66c03fed78b1bff72c399eae470

    Download Submit

  • \Program Files (x86)\LP\E9E2\60C6.tmp
    Filesize

    96KB

    MD5

    1af9198aefc1a89dce2e8f9227ae8c64

    SHA1

    718e24e7694b5d98a78455bfb8376e849aba5de7

    SHA256

    a0dc0e890177fe303dc2cd1d94f582325b42f48df6ddada24bc5f52dbad14a02

    SHA512

    4bfcc7c92baf26285ba33952bc87eeb994c502828b57feb3d5e90fe3ee53f754242ccfc4be61382bfd436bbb9890f50d83d9f0dce36c8d059a7a9874c0c646c8

    Download Submit

  • memory/920-307-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/1920-120-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/1920-121-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

    Download

  • memory/1920-122-0x00000000002D9000-0x00000000002EB000-memory.dmp

    Filesize

    72KB

    Download

  • memory/2632-123-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

    Download

  • memory/2632-118-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/2632-17-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/2632-0-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/2632-3-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/2632-306-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/2632-2-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

    Download

  • memory/2632-310-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/2728-15-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

    Download

  • memory/2728-16-0x0000000000319000-0x000000000032B000-memory.dmp

    Filesize

    72KB

    Download

  • memory/2728-14-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download