Overview

overview

10

Static

static

3

e3359f7030...18.exe

windows7-x64

10

e3359f7030...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15-09-2024 19:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e3359f70300f89a93786cc756b0748c9_JaffaCakes118.exe

  • Size

    287KB

  • MD5

    e3359f70300f89a93786cc756b0748c9

  • SHA1

    0fd9a483cc76cb8a0b8eccaea8c3e724f96128ee

  • SHA256

    c1155379fc55fc84f0644f0798e3f681d772a6f5c3dbc0955511ac916a6b2eb5

  • SHA512

    31d1f4cda700e0d29f0beb580b7f65b81ba55dd4fe09c0319cca7cf73768e4c33c18635c6277f3f5c96c34cd36f45a7a5e2a954bc9aef0d14cabfd09fb70ae94

  • SSDEEP

    6144:Y1LvcCtWISpny+rKqh0GbFWuTFHaNTvJ6+wL77OcSZ7kO:Y1vc8ZyjrKqhvAuxHsTvQ+oWcg

Score
10/10
ponycredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\e3359f70300f89a93786cc756b0748c9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e3359f70300f89a93786cc756b0748c9_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2408
    • C:\Users\Admin\AppData\Local\Temp\e3359f70300f89a93786cc756b0748c9_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\e3359f70300f89a93786cc756b0748c9_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\D62D2\222BB.exe%C:\Users\Admin\AppData\Roaming\D62D2
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2976
    • C:\Users\Admin\AppData\Local\Temp\e3359f70300f89a93786cc756b0748c9_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\e3359f70300f89a93786cc756b0748c9_JaffaCakes118.exe startC:\Program Files (x86)\D2E0C\lvvm.exe%C:\Program Files (x86)\D2E0C
      2⤵
      • System Location Discovery: System Language Discovery
      PID:788
    • C:\Program Files (x86)\LP\BBAD\667.tmp
      "C:\Program Files (x86)\LP\BBAD\667.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:300
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2308
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

4
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Query Registry

2
T1012

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\D62D2\2E0C.62D
    Filesize

    996B

    MD5

    86dacdc3d38f45287faed85f2973ed6f

    SHA1

    cabbe1dd3dd5334269339cfa28157046c3f7bcbd

    SHA256

    1e719117b05d01fd65a5b3020121a89ec3532b27cfc082d52abb2757750e481f

    SHA512

    ab04ef4c2e4fa10e0a4643c2c7d74ea9a38e12a171ed2297983fbdd7a4db2ec121a4e372ae53150c33ab6ba910f9fa98201cb3d670ef883dd78b181baa91031a

    Download Submit

  • C:\Users\Admin\AppData\Roaming\D62D2\2E0C.62D
    Filesize

    1KB

    MD5

    6f3dba02ec4f78a690bebf523fbe6062

    SHA1

    ed7a65942d6e0a01c845c8b5640bfed8d212b4dd

    SHA256

    af70441859c9c54a0fb44e6d56267b2e6a311caf2998c81a9923e5f81ecd9243

    SHA512

    d487d65cfbe7a7b4e9e984b4273090018dad676e24b53627cc4f544e94fb96879e8009120fc70791aa26936b8b33c9780ebfea57561082eb7ffbf99e54642f42

    Download Submit

  • C:\Users\Admin\AppData\Roaming\D62D2\2E0C.62D
    Filesize

    600B

    MD5

    c410ba8f51b2b08ade263e1917017281

    SHA1

    f2866a6d2123fe1d4d7cbbdaec6ffa60bc6101c3

    SHA256

    8c2a8e7b10c0db0a80cb1b3a5fcf18d9b8a45ebbc19f50cd8212b441938985f9

    SHA512

    c667a925cc4b40bf5325978742b00bb54dd50ba93e51e45f262f8af2a76207ad5cec6f89068657afae3a45bac79f128bc92ef09369dbac58ab3a29253da7ee7e

    Download Submit

  • \Program Files (x86)\LP\BBAD\667.tmp
    Filesize

    101KB

    MD5

    5fcd70329c951ae82a52291e28d3d00e

    SHA1

    601eaa89ba4308affbc28a341b0674f0ecf6df75

    SHA256

    733e1634e0834cc8010a0e6dd4d9d6c687e784e60a0ecb810f6ea8c7e7a5e2c5

    SHA512

    99da51dab7f54442b91b36f2eef0ae4b8ab296d897b5cd02cae7e5856a03f1d0496d36067b635d10a5f5ea2d2fbfda9d8f65f6df3142bcb4f781adfcf60a20b1

    Download Submit

  • memory/300-309-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

    Download

  • memory/788-130-0x0000000000400000-0x000000000046C000-memory.dmp

    Filesize

    432KB

    Download

  • memory/788-133-0x0000000000400000-0x000000000046C000-memory.dmp

    Filesize

    432KB

    Download

  • memory/788-131-0x0000000000400000-0x000000000046C000-memory.dmp

    Filesize

    432KB

    Download

  • memory/2408-128-0x0000000000400000-0x000000000046C000-memory.dmp

    Filesize

    432KB

    Download

  • memory/2408-1-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/2408-14-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/2408-11-0x0000000000400000-0x000000000046C000-memory.dmp

    Filesize

    432KB

    Download

  • memory/2408-308-0x0000000000400000-0x000000000046C000-memory.dmp

    Filesize

    432KB

    Download

  • memory/2408-2-0x0000000000400000-0x000000000046C000-memory.dmp

    Filesize

    432KB

    Download

  • memory/2408-312-0x0000000000400000-0x000000000046C000-memory.dmp

    Filesize

    432KB

    Download

  • memory/2976-13-0x0000000000400000-0x000000000046C000-memory.dmp

    Filesize

    432KB

    Download

  • memory/2976-16-0x0000000000400000-0x000000000046C000-memory.dmp

    Filesize

    432KB

    Download