Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22/09/2024, 02:28
General
-
Target
f119cfe2437e5e2cd663095695d445d6_JaffaCakes118.exe
-
Size
1.9MB
-
MD5
f119cfe2437e5e2cd663095695d445d6
-
SHA1
0f75d60069e5a47bca8ebfe6822bdecc79803a6e
-
SHA256
491447129af236e0ddb718e0b40e40ef2b2904efad2895a85aed3f2ab8b0e440
-
SHA512
3795822f2fe87fc483899b9c0c9ca390d09d6cbd1bfae2f07eceb8e7c1c7195e922909eebd20ea7fa08618b5f3a1f5db97b51ea8460acc87852af36c50198b89
-
SSDEEP
49152:w/DsUN6okJ1FhHUmbA2PSrJpyRLlim3UoiMQ:IkLFuIA2x/T3UoDQ
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Drops file in Drivers directory 1 IoCs
-
Executes dropped EXE 7 IoCs
-
Loads dropped DLL 14 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 2 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 10 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 21 IoCs
-
Suspicious use of FindShellTrayWindow 33 IoCs
-
Suspicious use of SendNotifyMessage 26 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 28 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f119cfe2437e5e2cd663095695d445d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f119cfe2437e5e2cd663095695d445d6_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dwme.exe"C:\Users\Admin\AppData\Local\Temp\dwme.exe"2⤵
- Modifies security service
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\dwme.exeC:\Users\Admin\AppData\Local\Temp\dwme.exe startC:\Users\Admin\AppData\Roaming\8B185\8D33C.exe%C:\Users\Admin\AppData\Roaming\8B1853⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\LP\3CD8\6680.tmp"C:\Program Files (x86)\LP\3CD8\6680.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\dwme.exeC:\Users\Admin\AppData\Local\Temp\dwme.exe startC:\Program Files (x86)\854FE\lvvm.exe%C:\Program Files (x86)\854FE3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\dwme.exeC:\Users\Admin\AppData\Roaming\dwme.exe auto2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Cloud AV 2012v121.exeC:\Windows\system32\Cloud AV 2012v121.exe 5985C:\Users\Admin\AppData\Local\Temp\f119cfe2437e5e2cd663095695d445d6_JaffaCakes118.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\samH5sWJ7E8\Cloud AV 2012v121.exeC:\Users\Admin\AppData\Roaming\samH5sWJ7E8\Cloud AV 2012v121.exe 5985C:\Windows\SysWOW64\Cloud AV 2012v121.exe3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
300B
MD54d4b5fbce473bf9c79da7db611a9b03d
SHA11298b10ef099f4dab5d5c7d8bfe08e7eb13092d2
SHA25670bd9fd638a342e826c9c05b471948051000efa834a432a9e29db8e13a21b988
SHA51291ba1494da8258804cf196c2c990676b7ec01f4f04a5e6740186e7011201092ce2c528a4ab8577fe9334dc65622cddaaecf5caca22aff047fcec754d3619b871
-
Filesize
597B
MD51e491c36e87d989fdbc5c5a70013dd98
SHA1d64ba044bbe2959a546148fe400e5ed93a9cbc50
SHA256729e585bac4bd61ed2a350e08fde9f2f3dd5ba7254ecb40b8c58e1a7a1fae873
SHA512d7f105f32a49af8c4f6205ad0f9f493d366dc4bbaf7a9db5e18794ab247eda156d836c0c7fc0d1a27c322f93e36b08c574dece4a330778ccd7eef187045e5a2a
-
Filesize
993B
MD56f57286085d3b344203b1c9ea0ad78a6
SHA12f3aa1143d5a3c0ecf7b4377e2a80a3fdee63851
SHA2564ea550d907de4dd28d06263f9eb937c18900a33778ad7061d564a35d55c0b2a7
SHA5124f1678969f9f14535fc471246589ee5a26a5d9e3b95bc90325cc3406cfd670792986c73f38d1a0dd7dd8eff32e2e78be4804ca5555b45711f844aa48d2b9016d
-
Filesize
1KB
MD56fba9eee2f7d05ab704c9e217c068e16
SHA12a2caa8659d72a5cdbe25bb524097941e7e92df7
SHA256218fb6a392dfb1e709debd2090def445fff99da92e6fb288a4e516352348a147
SHA5129c17b3fa472ba9ca4f32ec3cf603fd157f63977b0b6c7097461b8c69789c16a9029f29d1576170fc30f554b951293110ed0078ff15a30037bacc7860bbde0f09
-
Filesize
1KB
MD5ff686779629f62bcf6333d63ba8537bc
SHA125dd28a3310517183802d3b4de899d476b47285f
SHA25632ffcce2c70ea2068e0247e29e341c315633768e12c782cf10496a5b31bd61b9
SHA512271f3e6a55ca8c22c9798ff86ad7aebf0ce445b6721c00102c17b9ba4cd606884bd1686870feb4175c69fc028c2e26065de0d877a129bdd530279cdbf05f0683
-
Filesize
1KB
MD5086d3c0252d6b3f252e4f2bff0c61662
SHA14f3e7c817c576d2523f50b19057ff3f505295bb7
SHA256ed3d8fe07b96ec1b0c7600edf37c341a2599d9ae9d7847cbb0bf85d0abca34bc
SHA5123fbe8fdba1728d0094e32b28ce88c36602a273dc4afa36b087c50fe8a7068ef72e2704f5aab7364df7e95cb28a010c2585d0ba82c6fb5f1d50f26a9c9c66edfd
-
Filesize
612B
MD5d9cb76685e3118b941c9446389e17ec9
SHA143322501e7dd8e769f89028fccc4cb865d052982
SHA2568928a7b47654b58703768daa7764e09d87ca495c2d9c87067db34f3108e24e14
SHA512d4aef0578aeba2349a69c246988733665f300ea896f6525da07a568d05f1c8bf7284a7e0661239ec4d9dea939999ba7f6c12d8394ce91cc46dbde4f1266f20d7
-
Filesize
12KB
MD5bb87f71a6e7f979fcb716926d452b6a8
SHA1f41e3389760eaea099720e980e599a160f0413b9
SHA25614c9c49d8ead9ab59a56c328008f59c20b32c3ad22c00e02d34e16ad7086fe84
SHA512e1d14363274e367ea600afc357d012233fc68f0636e8d05b29992e762d31e9a55b4fa38b08613c2ca528d7fb0f547774a3a3dc79aada32c2c7359c3edcdb549d
-
Filesize
1KB
MD5a310d745cf448bc25c0183d806dbc560
SHA1af2fb66194b3c95c2a17d35262141b985e8f4bb4
SHA2569bea592d1d2163e25b18ebe578f4eda57923051635084cf5289a3b9f8da5b235
SHA5128d4fe050e3ccb77ff67a6fc143adad36b4774431f2f718685598f3a3dfe41f49dffdb4f1b7309575a6776d50d6e1f4154d726d5826f713d2ef11364f01fe361d
-
Filesize
1KB
MD5178a15e28d2bafd740bf9ed302bc8b4a
SHA1d4266a9ae2b2751e925a4e8ec0d1982ea73a3d81
SHA256d56a11c188e6707753561a6265f2393cebb07f6d41f48b37b5a06926f8287edb
SHA5120671c4125cd22e029c5c9def043d3901245d59b4697ad3523203850fb2bd43678843ac17d909a3a827d91295ffa56fff714f2980fc05f47180f41026eeb499e3
-
Filesize
1KB
MD5a6182bd318788b9fa346a7aba797f3da
SHA1284e208f5ef8587784290faecbe2a83b9d53789a
SHA2560a71351b7a79f6d213b17451ef44374e9eb679492fc6904684a713a1b80cb8dd
SHA512ca896c0a69ca2c763c348cc47cdffee14b8577b7e63e8cb02140d304a11ce9fbab35f706ca84f0f35d5ef6604d08d17867a6054463a382b325630feb071bd49d
-
Filesize
100KB
MD5712b790234a6b80a3dc179d07b4c631d
SHA1a64060d004591899343721e4e10a62805b848954
SHA256344dd99a3ae192c9f7d5fbaa1774ea1346aa1f7a71b86e06362cb7cc75184d81
SHA512847c3a679622bad14e57e3c093f3396282fb68883caaadc51f28ab54f49b0b233d5f3d2e852f87f17b8bbca8fed43378a8c03ab97f1c095defa9ade3b9b40cb8
-
Filesize
280KB
MD5d093887f230cd4ebd19f9fc4fcb4f0b6
SHA128777f82755c9983fc40d8c025147ae0311faa42
SHA2560a66e12cac7b5f76253ad318e3ea3e0e9ef43d3b146ca8af57b4b4c45efeae85
SHA512fe3380c347d3b5354e41f422ca7faf143fff6e3269d4f3634f53c9f8eb0933a7851e097f87eedffd2d7d35bc5e33531a50aadeea368996ebc759145fe4795538
-
Filesize
1.9MB
MD5f119cfe2437e5e2cd663095695d445d6
SHA10f75d60069e5a47bca8ebfe6822bdecc79803a6e
SHA256491447129af236e0ddb718e0b40e40ef2b2904efad2895a85aed3f2ab8b0e440
SHA5123795822f2fe87fc483899b9c0c9ca390d09d6cbd1bfae2f07eceb8e7c1c7195e922909eebd20ea7fa08618b5f3a1f5db97b51ea8460acc87852af36c50198b89
-
Filesize
428KB
-
Filesize
5.1MB
-
Filesize
4.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
112KB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
4.1MB
-
Filesize
428KB
-
Filesize
5.1MB
-
Filesize
4.1MB