Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
16-09-2024 19:28
General
-
Target
e573edd661f190e44055c26c6acb03c1_JaffaCakes118.exe
-
Size
270KB
-
MD5
e573edd661f190e44055c26c6acb03c1
-
SHA1
f3534ee299dcab25bcf46bb6f205e1ebe277eede
-
SHA256
9655d0e503bcf9a331e4725e68a1bc4218d55249c618abcf9c77f7980805f12f
-
SHA512
3b543b719f93259d0aff558d6594986f4ac63be65fbcdd6e39154146245203a2382f370ee4903af95b893c3c376601123fb3443e8b9401b0abbfa5a35bf089a9
-
SSDEEP
3072:A4Dv1tZ3wHdm1cCYfbuTapNHfWvffhQ9UxQaAnBeFeCl8lUBWU6Nm+SLwL2W2oMR:9nWmbYKGmiUxQ7Be0g8N7pSLY2TBAmN
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 3 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of FindShellTrayWindow 28 IoCs
-
Suspicious use of SendNotifyMessage 17 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e573edd661f190e44055c26c6acb03c1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e573edd661f190e44055c26c6acb03c1_JaffaCakes118.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e573edd661f190e44055c26c6acb03c1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\e573edd661f190e44055c26c6acb03c1_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\5178A\14ED3.exe%C:\Users\Admin\AppData\Roaming\5178A2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\e573edd661f190e44055c26c6acb03c1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\e573edd661f190e44055c26c6acb03c1_JaffaCakes118.exe startC:\Program Files (x86)\8ADF6\lvvm.exe%C:\Program Files (x86)\8ADF62⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Internet Explorer\D3A5\625B.tmp"C:\Program Files (x86)\Internet Explorer\D3A5\625B.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53184a0bdf3c92f7adf2b004c1e85487d
SHA158ae41dc8aeffa7597c2cdb893eadd2150f336b7
SHA2569ab5e2f7b1e79398da681fe065edf2023a2e0336e1de3cf152de6047357d61c8
SHA51283ac3daf6ca06d7dc7dff154d8dec78405350c241e699de467a8d05f0b779051d50b279e8152cb57d0eed08834a10354d963d712393d0cd1aba20bb3e52ca379
-
Filesize
600B
MD5b33a699b80cd138415f810dae88e57cc
SHA1a9d028f5f206329c65a6d26ce9597c5d0e11cae0
SHA25638ff1ffc053eb8325efc33a3c700823a9ae5c9fc101ecdfec60a473241f1ce33
SHA5122f5f1d32f3bd3eaef50a3a88503b99661afbe5f10de3c85a5947b8b3b593e33d6ba70114221fdf4b6208671e51d337985961f8a7e863f5cf2e3465d044daa8c6
-
Filesize
996B
MD5d4c3a2b1b7599d66ea9cac12a7943835
SHA13f437a44d4aefb83d5f0416b9326151dbe665edd
SHA256841e4018bb2ef04aa8b25a509f523cfcd1fa641d683637939881508c82e679a1
SHA5124a09b5ff65f19c448addf58da394c000a4e892994d9f6ea13021ede83a442055606b6dc43e929ee4f6e90fb89360518cdfe2f223d69b54cbf1c7e76ec5874757
-
Filesize
102KB
MD598983d9e6d149afd05c73f9fc444f4a9
SHA1249cb0c59c29e0ae8940ce6928cb7e6a1d0e5bb9
SHA25684a1c17937e04bd5090897594950e1aef33acfbbbd675fc7e319d000dfb3110a
SHA512d94ac1f1b118ae5779458392b31375b064894807e0fc6a3fb9cbc67fb8897ba591054235bf6b52dfd21dd964bb3fe6449bfc6049ccb5466046bfe95361d33fbb
-
Filesize
404KB
-
Filesize
116KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB