Overview

overview

10

Static

static

3

d13e98daca...18.exe

windows7-x64

10

d13e98daca...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07-09-2024 06:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d13e98dacaf32c0078692be104ae89ab_JaffaCakes118.exe

  • Size

    275KB

  • MD5

    d13e98dacaf32c0078692be104ae89ab

  • SHA1

    93f98d1995625c39d887180e585e50a1a90f8cd9

  • SHA256

    2bc14e7cf691d033e0f7411d146ffbb8a7ed13f193330097f4cffac509cf2047

  • SHA512

    508a6223b047d1d95ddb4c0e8e070c4d30a00c4d37b91e6f01b1b43d92c91b2768e34eef53f4fc117743f61f8383730b38d715008f341afd054fae1bf13a6030

  • SSDEEP

    6144:WG/jt2hYYHUFJNKxA6dOR7CjcA09ehuKd+OjmDO4O+10Ucw:WCQh8ToKXYDfNkOjmDO4Qxw

Score
10/10
ponycredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\d13e98dacaf32c0078692be104ae89ab_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d13e98dacaf32c0078692be104ae89ab_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2972
    • C:\Users\Admin\AppData\Local\Temp\d13e98dacaf32c0078692be104ae89ab_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\d13e98dacaf32c0078692be104ae89ab_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\93109\EC9AF.exe%C:\Users\Admin\AppData\Roaming\93109
      2⤵
      • System Location Discovery: System Language Discovery
      PID:580
    • C:\Users\Admin\AppData\Local\Temp\d13e98dacaf32c0078692be104ae89ab_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\d13e98dacaf32c0078692be104ae89ab_JaffaCakes118.exe startC:\Program Files (x86)\09F14\lvvm.exe%C:\Program Files (x86)\09F14
      2⤵
      • System Location Discovery: System Language Discovery
      PID:584
    • C:\Program Files (x86)\LP\AF09\2EAE.tmp
      "C:\Program Files (x86)\LP\AF09\2EAE.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2900
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2488
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

4
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Query Registry

2
T1012

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\93109\9F14.310
    Filesize

    996B

    MD5

    7e95f5158abbf6481b1af7a23100cbd0

    SHA1

    6e05e94c6666f545d0634d1a7e662fba713ee223

    SHA256

    a1720a9b78674900e996b0b2f1beaa7b3c22e08122e9d45fb1652d66cc019d83

    SHA512

    0b8f8544d57046ef87ea97a685519ecc2da64c47e4ee12371cf9a8a7571dbbe78374da63ce5c365323206e24d65644f630c305827cb6aaf3a6e9daceb42aa2ea

    Download Submit

  • C:\Users\Admin\AppData\Roaming\93109\9F14.310
    Filesize

    1KB

    MD5

    46dacf9a257984230229a2541617002f

    SHA1

    e2fd1c5070cee154ca48777e002eefe87b624172

    SHA256

    eb63e9f4d93af7df01df64b89d88e3ecd2ca552a9bda0c2aa402c5332c5f836a

    SHA512

    5088e86979a48f6b015c25533932e37dc62ace3001ef90b5faee95b4518de8be56b4afc1a28330450502e765906f3f0bb8c1f9937ad7fa30c5fd1fd009eab0d0

    Download Submit

  • C:\Users\Admin\AppData\Roaming\93109\9F14.310
    Filesize

    600B

    MD5

    05e925b6203bf91b69bd671366e6680e

    SHA1

    77e9f7a5bca3188f56dbfa7c4c32432c3c64f297

    SHA256

    b23937a9ff5659d98ef954a5ae840b1ce00c581582679e98c5946a9ef633541a

    SHA512

    c1b3b4d1a57e1acb8b08624d8075d38cbf9c35eda3d4e3c16c4691a767bec132fd915b64cd2ce856fa7dda1d64f72fe66417dda3e2b91094ce41c6de2001212b

    Download Submit

  • C:\Users\Admin\AppData\Roaming\93109\9F14.310
    Filesize

    300B

    MD5

    d3b6177790581741e835d251f55641bd

    SHA1

    14a80b72eeb178a7464651e21ec5b2f67a7f0595

    SHA256

    fa33f0a4e6842c55f50079e186f982a1a0b1bf968246a8ec1e7b5b159aff7765

    SHA512

    c876707b5311ca090f7a8c0b9306e9ded89b68691061841bbbd7ca62913999918aea6c93299acf6cd886f3e803c6c87919393c8fb2a365c32d94b41e04b3d9cb

    Download Submit

  • \Program Files (x86)\LP\AF09\2EAE.tmp
    Filesize

    97KB

    MD5

    35ada42115983644d2693f236ad65c57

    SHA1

    c732b06d0db7c9e18c79c8af9ceb75120988f7f8

    SHA256

    73f21aa459b1f32253cd7a29ddb141108c7948ab398597ed63593dd74cd5f011

    SHA512

    f5a0456d2ae3474780da2ff603d909bb800fd8b8d6188a1381c5b2f04a58da603cef762c7f30813e66a295ecd3bdbd8522ad8e7afceb8ff93449e319cd0955e0

    Download Submit

  • memory/580-54-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/580-51-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/580-53-0x0000000000649000-0x000000000066B000-memory.dmp

    Filesize

    136KB

    Download

  • memory/584-175-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/584-174-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/2900-367-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2972-55-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

    Download

  • memory/2972-172-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/2972-0-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/2972-49-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/2972-3-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/2972-2-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

    Download

  • memory/2972-366-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/2972-370-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download