Overview

overview

10

Static

static

3

f5ff00ed60...18.exe

windows7-x64

10

f5ff00ed60...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-09-2024 12:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f5ff00ed60b7cd2d8cbcde97dac1cbe5_JaffaCakes118.exe

  • Size

    283KB

  • MD5

    f5ff00ed60b7cd2d8cbcde97dac1cbe5

  • SHA1

    93821e136ccaf5bb41857a3946f9d573b29048e5

  • SHA256

    4760939dccb9dd3397bd59bc0127529705856bcbc41fc4e9562f91cf75003ec6

  • SHA512

    c50750d2b6af61895f6947bdece15cd807ca83f532fe90efefe650b8fa09299341d76c4d202e93c1ea74d585aac35c7a1c937f606f067edc4d5f40f7ee018726

  • SSDEEP

    6144:OaTXCv8sAnSmN3j51mRW+hHKCwRpZoManuphWAJVPA0Y8Yk:LzCvZU391mM+ZKFjJanuqOZY

Score
10/10
ponycredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 36 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\f5ff00ed60b7cd2d8cbcde97dac1cbe5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f5ff00ed60b7cd2d8cbcde97dac1cbe5_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4564
    • C:\Users\Admin\AppData\Local\Temp\f5ff00ed60b7cd2d8cbcde97dac1cbe5_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\f5ff00ed60b7cd2d8cbcde97dac1cbe5_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\C57E0\3D648.exe%C:\Users\Admin\AppData\Roaming\C57E0
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4284
    • C:\Users\Admin\AppData\Local\Temp\f5ff00ed60b7cd2d8cbcde97dac1cbe5_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\f5ff00ed60b7cd2d8cbcde97dac1cbe5_JaffaCakes118.exe startC:\Program Files (x86)\E0BD0\lvvm.exe%C:\Program Files (x86)\E0BD0
      2⤵
      • System Location Discovery: System Language Discovery
      PID:216
    • C:\Program Files (x86)\LP\489C\72F.tmp
      "C:\Program Files (x86)\LP\489C\72F.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3608
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3132
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3584
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4772
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

5
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

3
T1012

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\LP\489C\72F.tmp
    Filesize

    99KB

    MD5

    82d50af33ff156670a076dc834a99b4d

    SHA1

    d5e3662e28d51a8366fb214d77585b95984541d1

    SHA256

    7f57b37aa39698068271e64bbb42ff74b1a2b6157d233d8bdef1f683a7230a7d

    SHA512

    527986d4cca9998059e278de71989f3f46851eace0370cb2bfd69dc7292d5a1597a373ff2b350137eeea8dd7dd13a0e8de8b6306795e4b5a6428fab6c1b27563

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133717402699915752.txt
    Filesize

    75KB

    MD5

    8c3863174f8c5e52414bd947278c5929

    SHA1

    d6d40ee5258c6138ee389ec3d90b760b450a6c25

    SHA256

    914a338331a114766020066ccad33e8272b29eed43a4a1ed0052d6528b8e9a82

    SHA512

    ede22a7143411ccf2e1c824894862b9abee4a814f3ba8867b05fdc9d9212fd0d3d063ba871cdae5079fa5c5fd0817ed31a94abf6be7e14d6ad060986dff7b132

    Download Submit

  • C:\Users\Admin\AppData\Roaming\C57E0\0BD0.57E
    Filesize

    1KB

    MD5

    f7262df3f0da246e5354b5fa1e019d81

    SHA1

    a76f1f5a2d72001699ebfabc30ffd09701d24edf

    SHA256

    e83a792f653d58c9b0ad6763176b5ce2a6dc72590d8da0a217ed38935f3a82c8

    SHA512

    9cb580e3dfd087326375089195c5d47858b481e36ef096923dff8940d8a4f41cfa75f59322cfabe45088fd15b1dd45a5e043c11dc1427b7e9320bb2cbc365888

    Download Submit

  • C:\Users\Admin\AppData\Roaming\C57E0\0BD0.57E
    Filesize

    600B

    MD5

    a2f115cd18d39082d516efcc040778a6

    SHA1

    b7a7b142f20e8cd0236fc0a17fe33affe2be6b2a

    SHA256

    4956094030eea8e9c8d1639517b8e6a31de0cc05293adaa55ba110ab88fb9db9

    SHA512

    1a0d640a2775d2bf22a021534e3552cf61977a16de5187293bd633f22b5de6bc96a217f54fc347a0091769124df8a8d7fb393ff7ce36b436b13476ed2997386f

    Download Submit

  • C:\Users\Admin\AppData\Roaming\C57E0\0BD0.57E
    Filesize

    996B

    MD5

    f65e045e7b2d97992a5a3f868511ab59

    SHA1

    265ab252e0436ca63bb527fca310c87579b0e9a7

    SHA256

    ecfc9ddbd323d140a7be01136bb4f0b873fbad9079cbb37c855fa0c83d708fb8

    SHA512

    c58cf51d74e2eec9b51729e06c0177365fb8ed494df23dc41674441945c2fb556cd1f82d6480b867733fbb4ab450c707ea73aecdc82bcd8ee64532cfcf0d4301

    Download Submit

  • memory/216-70-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/3608-320-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/4284-15-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/4284-16-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/4284-13-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/4448-203-0x0000020425470000-0x0000020425490000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4448-171-0x0000020425010000-0x0000020425030000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4448-192-0x0000020424FD0000-0x0000020424FF0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4564-1-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

    Download

  • memory/4564-68-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/4564-11-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/4564-14-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

    Download

  • memory/4564-2-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/4564-351-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/4564-354-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download