Overview

overview

10

Static

static

3

cb5d6ef568...18.exe

windows7-x64

10

cb5d6ef568...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    30/08/2024, 18:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cb5d6ef568b603b1a46a21477c9f8671_JaffaCakes118.exe

  • Size

    278KB

  • MD5

    cb5d6ef568b603b1a46a21477c9f8671

  • SHA1

    06cb8faa597e432dae7ae041c3baadb34cd22e3f

  • SHA256

    4cad14ac9d473e9099c8128c55a9ad42378c94fc665a13c1f82f3d6743857179

  • SHA512

    4dcf7be04ab34cf8a5a2e08274ccebf2f1452c69ce4db6a17163a5934c260654e7230186a128cfdddadec4e895cdb79bf6eb47f552ea677a838e49513e68b4d9

  • SSDEEP

    6144:GgkMJB9j4KNW/3RjR/7OUdExTgH22iYHkJgbbgawpl:GgkMN4x5jNOUdUTgH2qIasaGl

Score
10/10
ponycredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\cb5d6ef568b603b1a46a21477c9f8671_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\cb5d6ef568b603b1a46a21477c9f8671_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3016
    • C:\Users\Admin\AppData\Local\Temp\cb5d6ef568b603b1a46a21477c9f8671_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\cb5d6ef568b603b1a46a21477c9f8671_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\A19FC\CEF43.exe%C:\Users\Admin\AppData\Roaming\A19FC
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1512
    • C:\Users\Admin\AppData\Local\Temp\cb5d6ef568b603b1a46a21477c9f8671_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\cb5d6ef568b603b1a46a21477c9f8671_JaffaCakes118.exe startC:\Program Files (x86)\FC674\lvvm.exe%C:\Program Files (x86)\FC674
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2856
    • C:\Program Files (x86)\LP\43FA\CC44.tmp
      "C:\Program Files (x86)\LP\43FA\CC44.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2992
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2880
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

4
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Query Registry

2
T1012

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\A19FC\C674.19F
    Filesize

    1KB

    MD5

    16b7a26371c22e093fa6ea67b3c7e1a6

    SHA1

    00e0d0a0b5cc033f154deab7dc301a76d4109c65

    SHA256

    e2316c9ea86281eab4a78c62b9ec09889496bcd313b9837f1ecb6be18cf9c2c6

    SHA512

    b9467ef2aeae327f6fa3c47e85ed8e207faa9a96848e6228024369551ab7ffbf99e3c207cf2049ce8d6d4fb44c1993ce3d512dcd81da878c10ab589e8f649bb7

    Download Submit

  • C:\Users\Admin\AppData\Roaming\A19FC\C674.19F
    Filesize

    1KB

    MD5

    fe92960e44529f53553817c1ad457df2

    SHA1

    d54388629f04fe4317af7edcaca58e27b1298657

    SHA256

    e02b6808ba39d6f055971ce58296b0dc2f23102c9c077bbd0c5ce5d7fda82a4f

    SHA512

    ef3b7d6ccc0c0fe98e72a3a41021c67126c76cf13ccba56db3938503e1f99dfcb4e73ad8ddee485487c0fa40b2742ee916c888b09323342040f45a5a9cd3beee

    Download Submit

  • C:\Users\Admin\AppData\Roaming\A19FC\C674.19F
    Filesize

    600B

    MD5

    34146c157008a710dac179514f3b1c93

    SHA1

    969e3449e0de22686c309a367bad11775670b4fe

    SHA256

    d9c7e765879a6679d8291acaf71459944ffe60ad81bbcb7310eca6bdb92a4b71

    SHA512

    573ebe694b515d575d8f7a9864280212f3319f7c6808e9cb94eda7f860c96c58cbe75f1b57cbefeef190a6c27eb79cb920fff423c1d600cfd7566cec620478e0

    Download Submit

  • C:\Users\Admin\AppData\Roaming\A19FC\C674.19F
    Filesize

    996B

    MD5

    d391e64f8713af4a0539f63f71d0343a

    SHA1

    2da7a91052bdecf1616fd7ba67fcb4720ece67f1

    SHA256

    3dbbcebe56070a21345b9e4d6eb302ef6c3605437dac27ba1560ba2dc9ebc4cb

    SHA512

    bfd3e74a781d4d9f392193150beba669e8fe98e0519386255811a9b05ec2fcecf134e6a828231cd57f44136af85937d8501363cdac768f7075f2887b834b0bf5

    Download Submit

  • \Program Files (x86)\LP\43FA\CC44.tmp
    Filesize

    97KB

    MD5

    78193d48f57272fd9ea2e44ed86d608c

    SHA1

    1e70368bb5a0932f868fdddb22fd23dd2e7dedeb

    SHA256

    c09d0876bbf956eb381d92a3e9dd61d49a4d65c1d2b65d3d42cb795256804aae

    SHA512

    4f55914fe2d3780f174843b9f3666a10f63caae9634af925da3dc6aea5a3f6ab9e6ebf693698b781931ce794919558c59f7bfa22be94dc8b556784d948fa14c1

    Download Submit

  • memory/1512-16-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/1512-14-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/1512-12-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2856-80-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2856-78-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2992-194-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/3016-17-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/3016-81-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/3016-1-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

    Download

  • memory/3016-13-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

    Download

  • memory/3016-159-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/3016-2-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/3016-198-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download