Overview

overview

10

Static

static

3

c97199eee9...18.exe

windows7-x64

10

c97199eee9...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    29/08/2024, 19:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c97199eee9bf111f889e9fc46b077c5e_JaffaCakes118.exe

  • Size

    277KB

  • MD5

    c97199eee9bf111f889e9fc46b077c5e

  • SHA1

    273a1982d08de7f5eacb88e130b81bfbf6d913ba

  • SHA256

    e90426b1e9eff36d6c02c83855cfd8ff1d7e0a2770a14288fa0b2ede60a016cd

  • SHA512

    6e294e524a5d8083ef8b807982d1e29016d630af7c9b17eca68ede2a9dc271f9638e8424bcc92bd7679d21c4cd6f9f3850a36576afcb297bf8e431b4e4d70d41

  • SSDEEP

    6144:HIfR8LCsAZOJyaTBGqn/2Jf97SZMR08ExIL4IaoBLgoyneoSm2:Hp5Aam3naIL4zoBsoypSP

Score
10/10
ponycredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\c97199eee9bf111f889e9fc46b077c5e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c97199eee9bf111f889e9fc46b077c5e_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2080
    • C:\Users\Admin\AppData\Local\Temp\c97199eee9bf111f889e9fc46b077c5e_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\c97199eee9bf111f889e9fc46b077c5e_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\4A98E\5B602.exe%C:\Users\Admin\AppData\Roaming\4A98E
      2⤵
        PID:2912
      • C:\Users\Admin\AppData\Local\Temp\c97199eee9bf111f889e9fc46b077c5e_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\c97199eee9bf111f889e9fc46b077c5e_JaffaCakes118.exe startC:\Program Files (x86)\8EE70\lvvm.exe%C:\Program Files (x86)\8EE70
        2⤵
          PID:2432
        • C:\Program Files (x86)\LP\0234\E14.tmp
          "C:\Program Files (x86)\LP\0234\E14.tmp"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1832
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2164
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:608
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x5c8
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:876

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      2
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Privilege Escalation

      Boot or Logon Autostart Execution

      2
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Defense Evasion

      Modify Registry

      4
      T1112

      Credential Access

      Credentials from Password Stores

      1
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Unsecured Credentials

      3
      T1552

      Credentials In Files

      3
      T1552.001

      Discovery

      Query Registry

      2
      T1012

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Collection

      Data from Local System

      2
      T1005

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\4A98E\EE70.A98
        Filesize

        996B

        MD5

        47ae916a3566f07a8342fb07b6467484

        SHA1

        e9590c70c4bf9db4241f47340e6c3218125430ed

        SHA256

        bb89522c919f02edd44817d1fcdb885829bbc529da4ec90276fec32ebbf17e22

        SHA512

        b223b517bdfaee16066915b6d0892599a481f85b370738e9ea251b2019c0dc1097ebe91b627a659f1b00c712cd5f35bfa8d86984764a5e37ff9c3e370f8319d5

        Download Submit

      • C:\Users\Admin\AppData\Roaming\4A98E\EE70.A98
        Filesize

        600B

        MD5

        a4d38f6e95f06800523523a543d9bc8d

        SHA1

        127244e51ee99983410e749f92cb3fe0edbd5ebb

        SHA256

        cae8e6fc8b42bf528929752d853786124e3faf3b71298c2c71836e44c3e6f6f2

        SHA512

        33449f1792fcdb5c786333088688901433cd8a045e9832783f3581972932e88845beeb8c22d465118b673c7e0cde2f5d5a5f2210dac55fbf0cc24adf87667b40

        Download Submit

      • C:\Users\Admin\AppData\Roaming\4A98E\EE70.A98
        Filesize

        1KB

        MD5

        7a8c85fdf399472fc6becf0068caaeac

        SHA1

        f25d231985c96dbe2a882d65531281766a026721

        SHA256

        29af6f46fd12b876448acd859025a7b4482708e8c71fc43766679c3e8072a96b

        SHA512

        39e2c9744237beac486127ce9c97930fea20f6d605e74dfef0a92220d03462a83a5de55a042177d674ec689bc99475f271e462affcbd82188b592f8f8074542b

        Download Submit

      • \Program Files (x86)\LP\0234\E14.tmp
        Filesize

        97KB

        MD5

        533fd6cb8e5e3eaec6fa2f338987220c

        SHA1

        8cdd5850fb86e9701dd70735acbd48c61170a1cf

        SHA256

        1fc892067b9ace59de0609c4a3d9c9f90954515d3a204543b1899126b8dcf32a

        SHA512

        25311cd36c70798d55be1335f2390bb1e805453a443517d9c561a5716e1a9aad0da68a6499049425e1bf89774864e854271b302e27dc0e3a97fe0915515a7899

        Download Submit

      • memory/1832-311-0x0000000000400000-0x000000000041C000-memory.dmp

        Filesize

        112KB

        Download

      • memory/1832-310-0x0000000000400000-0x000000000041C000-memory.dmp

        Filesize

        112KB

        Download

      • memory/2080-14-0x0000000000400000-0x0000000000467000-memory.dmp

        Filesize

        412KB

        Download

      • memory/2080-15-0x0000000000400000-0x000000000046A000-memory.dmp

        Filesize

        424KB

        Download

      • memory/2080-193-0x0000000000400000-0x000000000046A000-memory.dmp

        Filesize

        424KB

        Download

      • memory/2080-0-0x0000000000400000-0x000000000046A000-memory.dmp

        Filesize

        424KB

        Download

      • memory/2080-4-0x0000000000400000-0x000000000046A000-memory.dmp

        Filesize

        424KB

        Download

      • memory/2080-308-0x0000000000400000-0x000000000046A000-memory.dmp

        Filesize

        424KB

        Download

      • memory/2080-3-0x0000000000400000-0x000000000046A000-memory.dmp

        Filesize

        424KB

        Download

      • memory/2080-2-0x0000000000400000-0x0000000000467000-memory.dmp

        Filesize

        412KB

        Download

      • memory/2080-315-0x0000000000400000-0x000000000046A000-memory.dmp

        Filesize

        424KB

        Download

      • memory/2432-191-0x0000000000530000-0x0000000000630000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/2432-192-0x0000000000400000-0x000000000046A000-memory.dmp

        Filesize

        424KB

        Download

      • memory/2912-19-0x0000000000400000-0x000000000046A000-memory.dmp

        Filesize

        424KB

        Download

      • memory/2912-17-0x0000000000400000-0x000000000046A000-memory.dmp

        Filesize

        424KB

        Download