Overview

overview

10

Static

static

3

d9586406de...18.exe

windows7-x64

10

d9586406de...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    11-09-2024 01:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d9586406dee45b8f79bda48461b8861c_JaffaCakes118.exe

  • Size

    287KB

  • MD5

    d9586406dee45b8f79bda48461b8861c

  • SHA1

    f020301f7099fa1b51b2d4c4051b5cb1a9981908

  • SHA256

    7cf930cd248c22f1b5a4d75989d8ffbf2adec663b63fc0027269feb0284b0a9f

  • SHA512

    eadda28d365ee61a0023e065824a5cab793b63ebf579feb105af2339f137331d38478c05bf925c66cff018e675d3aa061dcf8caccc231934b3ebd6d1a2d062a6

  • SSDEEP

    6144:b3Ryke2wfmdAaOg1E1gWLg4zp+XIgrZQ3QbRMDxQCnbMS7xHCTf:bkkHAf1tpPwFRMDxQsjxCz

Score
10/10
ponycredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\d9586406dee45b8f79bda48461b8861c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d9586406dee45b8f79bda48461b8861c_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1244
    • C:\Users\Admin\AppData\Local\Temp\d9586406dee45b8f79bda48461b8861c_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\d9586406dee45b8f79bda48461b8861c_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\25186\D0DDB.exe%C:\Users\Admin\AppData\Roaming\25186
      2⤵
        PID:840
      • C:\Users\Admin\AppData\Local\Temp\d9586406dee45b8f79bda48461b8861c_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\d9586406dee45b8f79bda48461b8861c_JaffaCakes118.exe startC:\Program Files (x86)\86D12\lvvm.exe%C:\Program Files (x86)\86D12
        2⤵
          PID:1640
        • C:\Program Files (x86)\LP\DB42\3BB9.tmp
          "C:\Program Files (x86)\LP\DB42\3BB9.tmp"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1740
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2512
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:904

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      2
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Privilege Escalation

      Boot or Logon Autostart Execution

      2
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Defense Evasion

      Modify Registry

      4
      T1112

      Credential Access

      Credentials from Password Stores

      1
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Unsecured Credentials

      3
      T1552

      Credentials In Files

      3
      T1552.001

      Discovery

      Query Registry

      2
      T1012

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Collection

      Data from Local System

      2
      T1005

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\25186\6D12.518
        Filesize

        996B

        MD5

        a1898c5c25c790884f6fa895f10f6406

        SHA1

        4fbd8a97468fa247b4413c5d1d900f2608a4009a

        SHA256

        5a1ad1aa0dbeec0f5ead1cb36113553b711b620c4ba5dbe57a58d5ce00944953

        SHA512

        100c6a3b76c6fd8b53f9f5512d5c46617c0074f79a076847d517ee0c48b1c9410a956dae91b9bfd97a77f04d58ab77297e6bab1a0c1528c71d7378fd1f311bb8

        Download Submit

      • C:\Users\Admin\AppData\Roaming\25186\6D12.518
        Filesize

        600B

        MD5

        417a93f9540638f9aff6c033f543ec3b

        SHA1

        003915256bf313672aa382db8831d7ba4860b6d3

        SHA256

        e77b3746ea75fe8d5201f12134cc708bd0b22e6eb91dc0fbb9119796c5e344ba

        SHA512

        42bccf421bb68bb4ff8f7db98ab1f21d1b17125940a628014999794eec93577debc09b326722608413486a266fbbc0ff864061e2eeaeff96913d827ebdba6ce0

        Download Submit

      • C:\Users\Admin\AppData\Roaming\25186\6D12.518
        Filesize

        1KB

        MD5

        b0478b55a687d1cefbd28270d1c0880d

        SHA1

        b558d5969cdfe22f09d5985678a633e824c5d77d

        SHA256

        3de3410e70ad54f998d3f6dcc749e48fed98791984495ca71292defd83268e03

        SHA512

        ae240219733e22934f0806fd5e3f2d3b66d21c798382a403c621115f5589dd025c7e9a1eac1e4bd421d256ba1639778b2f04d6b4ea684902022db352fe45e8c7

        Download Submit

      • \Program Files (x86)\LP\DB42\3BB9.tmp
        Filesize

        102KB

        MD5

        6d7f922d6214ef1996346395afd017be

        SHA1

        5594d286e8b8e46008426e15ffd53e86f4143d15

        SHA256

        4e58ef597c40404d3286c87cc13ea0563f4d08dacb4b40ea3d8b6744221898ae

        SHA512

        9dc8ac8d33268face5a007dce5cf5c7c1b749f1a656fdc70276ad431392978f47fbbae0e1d625040acc01641d9f7b5341d7b28b68169f39a1df789ea12654626

        Download Submit

      • memory/840-15-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/840-14-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/840-16-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/1244-13-0x0000000000400000-0x0000000000468000-memory.dmp

        Filesize

        416KB

        Download

      • memory/1244-1-0x0000000000400000-0x0000000000468000-memory.dmp

        Filesize

        416KB

        Download

      • memory/1244-132-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/1244-11-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/1244-2-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/1244-322-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/1244-326-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/1640-134-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/1640-135-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/1740-323-0x0000000000400000-0x000000000041C000-memory.dmp

        Filesize

        112KB

        Download