Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
31/08/2024, 17:35
General
-
Target
cd459b5d7ce33980aa895c511dfbc715_JaffaCakes118.exe
-
Size
282KB
-
MD5
cd459b5d7ce33980aa895c511dfbc715
-
SHA1
c797f1b77ed83e4dd0f6572a4a1f6f4cd26d9d70
-
SHA256
6bd7c4de6608a66b29d48912a5a38a1dcf523f4b24f531ec6ca2520193171beb
-
SHA512
1102c48caaaeaf5ec3bd85d6e824ab89c62244916427a72f7b3d9420ba7db42879087b336d98de7e6525d15b551b4f391ac29115b63741b0256eb3f6d5284ae6
-
SSDEEP
6144:Izf/4vSu9hHaZBynO1qQZq2kwJD7DOZa6emP/CvL:Izf/c9hHXQY2kqD7DOw6eeaT
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 15 IoCs
-
Suspicious use of FindShellTrayWindow 28 IoCs
-
Suspicious use of SendNotifyMessage 22 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd459b5d7ce33980aa895c511dfbc715_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cd459b5d7ce33980aa895c511dfbc715_JaffaCakes118.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\cd459b5d7ce33980aa895c511dfbc715_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\cd459b5d7ce33980aa895c511dfbc715_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\B1FA3\3B37D.exe%C:\Users\Admin\AppData\Roaming\B1FA32⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\cd459b5d7ce33980aa895c511dfbc715_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\cd459b5d7ce33980aa895c511dfbc715_JaffaCakes118.exe startC:\Program Files (x86)\A35AE\lvvm.exe%C:\Program Files (x86)\A35AE2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\LP\7D6B\2971.tmp"C:\Program Files (x86)\LP\7D6B\2971.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
996B
MD54241eed5e3727bb8be9266603292b295
SHA1caf075eed0fb30278199f1749ee429646ad1c3f3
SHA256e86abfbc24e507406d25075fa38c5ff34caf8373147053caf33bdfe514b76256
SHA512beddfb00da635545eee6b368b52e7a0f9578feaba1bc086e38a55fb4be972831670916a34ed8273a4594dd3d57328369fb8be099dd77da38ae111cac6b10da70
-
Filesize
600B
MD58d1abb16a20d68ebbe7ab9bb295f000c
SHA1b53d563e364e31db03839efdc83e1ec2ac75644d
SHA2562cc98452309d4c4bc119aa4f28545223ca327922c786fc50a39923f0c16537b9
SHA512aac6bd96e812180e408abb5b358fbe19fe74ef72edc3e03e48d2f43c971e0294b5579bdb046334c9c6a884a5a6ba87ef1fcef406e45b3672a20e0e3343bab310
-
Filesize
1KB
MD5b8ad07b05f1eb28f20f227c93269362b
SHA1a5d0dab7f7c95691930283ce8c450804ca74ecf1
SHA2563294dee1dffc18a41386f4c596abf660ee324ba7a8a6bdd44da35a336ce51cd3
SHA512e0b401a68dce30dff329110b1e45e1b2a1028f04a657aa8c087632920466abd7050df71dcbafa4e78f33ce9a00d9ef5a18766b7f10399ba7da73c5e7e0c87ad1
-
Filesize
100KB
MD5f6b59ae007f25be4bbc0d78790009c1f
SHA14224ca50f71600bd3973bd5b7400d6feb3bbfe23
SHA256ce2f2ae20dcacc1d713f241a3d230e708786eab37f4477fe53c39bea935ad8c5
SHA512c5250c43efd9f914277ec16ca973686fa44d03afccb1ba3982f61ef3b9b709ade34e526b108dbab163b078dadef8afe0a62a45d90573d583f0aa92e0e8d74c98
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
416KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
416KB
-
Filesize
428KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
428KB
-
Filesize
428KB