Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
26-09-2024 21:50
General
-
Target
f938e959219c31684d3dce43b5b1ba56_JaffaCakes118.exe
-
Size
263KB
-
MD5
f938e959219c31684d3dce43b5b1ba56
-
SHA1
007a6c0170f470a9ee16fea0877625e37a39629e
-
SHA256
0c5f32a95c7f8f1a7fd586e128a073ddd01ce1ad5ef938776dddadb38aab1883
-
SHA512
3faf9e299a2e8f676fb6f3167f6641849a53fdd5f0c09b861ead568d1c0167d409e6888b20f1cd87348a5eb1df6244a4ad7bbaf628b14b98e1cc05ae50eb7053
-
SSDEEP
6144:ynKdDGq1zHqUL95lwH4ANvAtEeNsOSL/IUXJ/1xtdfuIt4QEXKVf:yKr1zHV95lwH4g1eGOSzhXd1VmavOKVf
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 15 IoCs
-
Suspicious use of FindShellTrayWindow 28 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f938e959219c31684d3dce43b5b1ba56_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f938e959219c31684d3dce43b5b1ba56_JaffaCakes118.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f938e959219c31684d3dce43b5b1ba56_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f938e959219c31684d3dce43b5b1ba56_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\B262B\DBD8E.exe%C:\Users\Admin\AppData\Roaming\B262B2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\f938e959219c31684d3dce43b5b1ba56_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f938e959219c31684d3dce43b5b1ba56_JaffaCakes118.exe startC:\Program Files (x86)\2B225\lvvm.exe%C:\Program Files (x86)\2B2252⤵
-
-
C:\Program Files (x86)\LP\8E3B\30F0.tmp"C:\Program Files (x86)\LP\8E3B\30F0.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
996B
MD5281d5872ea429aeb89b330093341943c
SHA1c2b64e09c12514a5acff00a39a07bcdd149be89d
SHA256a7cdfe5b28f20082e920a2e930e92fce77f08499d2d07f0ffa5e63407f7adf4d
SHA51278b3f4580506c752ccc5a3f97fa38a01e0776cca9e9d0c0f76287e3137402a5a2096d4953a2fb09136caf3707ce40a120cbd9159810a51f9812bc83f5d156411
-
Filesize
600B
MD53f6fd9750b50a06e2a4fe8e852d1963c
SHA16a216a9fed1d79b04b54e5443ce522e3cf00e8c4
SHA2567d3699efa0a5b0c98cec3c5c22abb74e05fb3dc6a8e4439617b8f5acfb72d729
SHA512365bfd71128a6b32db6913c24382358b1ea926643f3e0780ab3d3c44b1fee19b4d2b0497c1d27cc2b42e415865db590a964d2f95db3fa48d2b381785ebedcbe4
-
Filesize
1KB
MD524348df4e915ee696cfb396a5aa1f73c
SHA182f3a1f4f18c5e0cf44670f622f3728086f817af
SHA25636a03411b8d083b3e3df5d8708409ac1ede9656e1d5e8921c6e6574b6c924b18
SHA512cd9a0b7904f9ddc9750e958d9bad411f6087a146be8f6e28d9f509d3de186361d42549569db0b1eb50f909df89186495d3306e3d32496826f1d8fcc3c8ce72fd
-
Filesize
95KB
MD5b3665f15b4cd433e21ac50c2f224b101
SHA1b96fc19237dd9767418f23dab9451489c75bf5b6
SHA256d7c3b90a540de9a91bb01c49e5f632a8e9085dfd774e627b31799018dcd6aed9
SHA512b2e030be29ac15267cd1613070aac2f5282680a6d3a56878e6e44f5eba58b8870e1a05dbc7418f7b67a271b8a184902d483863465e2e2692a9929cec740e20bd
-
Filesize
416KB
-
Filesize
416KB
-
Filesize
408KB
-
Filesize
416KB
-
Filesize
416KB
-
Filesize
416KB
-
Filesize
416KB
-
Filesize
408KB
-
Filesize
416KB
-
Filesize
416KB
-
Filesize
108KB
-
Filesize
416KB
-
Filesize
416KB