Overview

overview

10

Static

static

3

e1bd0a0d20...18.exe

windows7-x64

10

e1bd0a0d20...18.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    140s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15/09/2024, 04:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e1bd0a0d2009f04ff84bf83feafa2acf_JaffaCakes118.exe

  • Size

    265KB

  • MD5

    e1bd0a0d2009f04ff84bf83feafa2acf

  • SHA1

    e666e1638fd70f249a858779ba1770fb0fb6b031

  • SHA256

    0103388e96f2479ba1a2fedd1dc2e40de18add6e4b3fee241b02a8cc3cda9d18

  • SHA512

    5b8583f44c2ff3554daf8ae7673c465f3e53367407a196afa7f66f357a2001db9a244efe3558deed984e3a2e75f2b1e28a03b19a17e663db5e44ff33470e8f23

  • SSDEEP

    6144:4MTvQl40O+zY4joKTO5cLarYGsIuKWf0hbVxfxMVczNZqp25m:jvQuzWox5qssI/WfSVBipMm

Score
10/10
ponycredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\e1bd0a0d2009f04ff84bf83feafa2acf_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e1bd0a0d2009f04ff84bf83feafa2acf_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:628
    • C:\Users\Admin\AppData\Local\Temp\e1bd0a0d2009f04ff84bf83feafa2acf_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\e1bd0a0d2009f04ff84bf83feafa2acf_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\278F3\AC432.exe%C:\Users\Admin\AppData\Roaming\278F3
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1584
    • C:\Users\Admin\AppData\Local\Temp\e1bd0a0d2009f04ff84bf83feafa2acf_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\e1bd0a0d2009f04ff84bf83feafa2acf_JaffaCakes118.exe startC:\Program Files (x86)\F3447\lvvm.exe%C:\Program Files (x86)\F3447
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1924
    • C:\Program Files (x86)\LP\32F2\63B3.tmp
      "C:\Program Files (x86)\LP\32F2\63B3.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:636
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2772
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

4
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Query Registry

2
T1012

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\278F3\3447.78F
    Filesize

    996B

    MD5

    136a1929bd30340e7f9d4c5dccceac36

    SHA1

    6381e8356ff71cf1ba085606029ef25fa94947cc

    SHA256

    079e904bf01b774f3fbf136df3d3b75ebe951d10a440669e9e5e27c39a4eb03f

    SHA512

    be19fd839062dd0a4d3d180eba4d160300c5cd68e79f9ac6c54e7530bc9e4558fbe676b6efe03e2b9070d279df8856790e5be1488294481e33f1deb3d93276a3

    Download Submit

  • C:\Users\Admin\AppData\Roaming\278F3\3447.78F
    Filesize

    600B

    MD5

    e15ad476d783c253671374bc8725eac3

    SHA1

    2e6f07eb7374468860c4e4081b963cba84361a17

    SHA256

    1bd2398c3720a35ce4bd7798117616a42a5fdbc1e0e58da1da30280c3d6a9cc9

    SHA512

    fe81f9b1d4a695404b5e6d8106e9e1e3bbec315152bc283e5b7d730321e76559876c953bb7ee1728489f7c5d07568eb45963099e19e029a94f6b8c1359e8abc6

    Download Submit

  • C:\Users\Admin\AppData\Roaming\278F3\3447.78F
    Filesize

    1KB

    MD5

    83364b912bad5909f0083020d7ea0a3e

    SHA1

    11a400037689217eb7c8f6ff7afd49f459406f2e

    SHA256

    6a26645bcb67f318020657c168b02da5aab7e9e257c2f17de3585a76fbc263bb

    SHA512

    57e7b69613b8e8c7a6625a353094bb202d46494505745fcdec7a3f41ffd819911ff7b0825b4eacdff46d090d94260a2e9649cd4d408e58b21e87f54b61182955

    Download Submit

  • \Program Files (x86)\LP\32F2\63B3.tmp
    Filesize

    96KB

    MD5

    d9ec2cfd319272c1049d6f5c7fbcf347

    SHA1

    b249e163156fa796cfe432aab0bf86ce2d02c5bd

    SHA256

    2826483622a5df655e3984330a011c9ebbada1cadee1b3e374ed1c2207f37196

    SHA512

    4b1d6a68c159f44ec5f1c8669a24f77c53c629f9f85b65ec11842079cef827e6c41943a3a53fbf8ae3b646d1efa8b96498c57e101cf78dea3a9c4c867bb1fcf1

    Download Submit

  • memory/628-127-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/628-17-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

    Download

  • memory/628-0-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/628-13-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/628-3-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/628-2-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

    Download

  • memory/628-309-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/628-313-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/636-310-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/1584-18-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/1584-15-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/1584-128-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/1924-130-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download