Analysis
-
max time kernel
141s -
max time network
96s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
24-09-2024 15:21
General
-
Target
f3ef5eea90dde322647d620272eebaf9_JaffaCakes118.exe
-
Size
286KB
-
MD5
f3ef5eea90dde322647d620272eebaf9
-
SHA1
79333b7506c35903179db9868ac5a6c2468c1377
-
SHA256
5b27a99a00717e3889423cd76f738f3f1e91c6ddffd6dfdcbf8f18ce1b295d6e
-
SHA512
e1454174b8e4b1c22e8578545a067dd3f3f347895469528c85af9948820ed5df99bacec48ba91eb56c597618e28b933939f286281f46c75fd7d951ebb3b09991
-
SSDEEP
6144:mnXCrLUwNcvmPSnBIvivyTz7JA1LQGtqro8THwCvLQOWV42WwqnW2aaOKj:nSXBIqvyTzYt+oG/ZS42NqnILKj
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 19 IoCs
-
Suspicious use of FindShellTrayWindow 28 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3ef5eea90dde322647d620272eebaf9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f3ef5eea90dde322647d620272eebaf9_JaffaCakes118.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f3ef5eea90dde322647d620272eebaf9_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f3ef5eea90dde322647d620272eebaf9_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\DE272\DC526.exe%C:\Users\Admin\AppData\Roaming\DE2722⤵
-
-
C:\Users\Admin\AppData\Local\Temp\f3ef5eea90dde322647d620272eebaf9_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f3ef5eea90dde322647d620272eebaf9_JaffaCakes118.exe startC:\Program Files (x86)\72D9E\lvvm.exe%C:\Program Files (x86)\72D9E2⤵
-
-
C:\Program Files (x86)\LP\26FD\2674.tmp"C:\Program Files (x86)\LP\26FD\2674.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5a41⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
996B
MD545ee789b301ad796501b8234b09d969d
SHA10b2436a144f580d3933ff5daeed490ef5ae4acaa
SHA2560e50faa5fcca36d9cc270b34c5c437b8ee9e05b132cb42d38c4813750d674fbc
SHA512a7a6a95505b088bf2dd9d3ce68885ceb266cdc0351ca6a8c10d43a573eda2d7f700688cae0e7af723b66fc4ce81982ab0aa2dddb24149e672bec265cf43982a1
-
Filesize
1KB
MD5c2cd72ba0ec23937f1a87f2d97a37b8c
SHA1f6f8c07aa1b1ddf9ee60097abc343c9bfc307899
SHA256d00b033ed73419da74e42c6d4484192346c5d1b6b963b6f77e75c31f23678144
SHA512273fd129f02405b78f3c9be5429709fe52011a8cc273a25df566fb7b753c983aa86265e61cdb3ebad89a65db47fb3adde75e9745874a3d8d0ea05f86ee25ef9f
-
Filesize
600B
MD59d6fe4bb1f310589130c855af574dceb
SHA14843576ff5d1d4b56c12b1ef16b45d78e885af29
SHA256262b836300945f8065bed579a62d69bd22dd86847a51c0407bd84a06ef257216
SHA5120ad36c75b507362368fbde9cf57dd9c7bfacd2c263a0028c14d4ea2a45014a5829b040e37efaa6df1dd65cbedb3b38dc05d520a18d887a739b2d300970bb382d
-
Filesize
300B
MD51d5a301806006ffe3b2ed0dc5dd76e48
SHA125910c454b8dc30ea651de49f781528ba67e86ee
SHA256747dd734454288a170bdf459865eef86a69edc7e909c8a1f5be9efef43957409
SHA5129d31806b44cfb898f9314f5772721fd28d85406a8ac1567de576e8a0bd75eb7c5c7d501cc189a205fd72ed01e9ab1ed81a16b92c2f7bf675497daa646ae73ae8
-
Filesize
102KB
MD59636b8b316a3bc776f9a98ea09da5caf
SHA1050f0bc24149a2e208fdec8e0d7bdb08133ff958
SHA2562de935d69a83a276edbd20ee616e8ece2a2ec3aa75daebd91de5891a099e3a4f
SHA512472bc6565f724a356938412a0dac7c443c2e45b71101831542b6723f6bcee9d3d54afc40adec603db829d736c828d60c08b0a3a78e1f691bdbff8445c424e8a0
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
416KB
-
Filesize
428KB
-
Filesize
416KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
116KB
-
Filesize
116KB