Overview

overview

10

Static

static

3

fa4d4bf75a...18.exe

windows7-x64

10

fa4d4bf75a...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/09/2024, 11:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fa4d4bf75a1b9f9262b7a75e13a35912_JaffaCakes118.exe

  • Size

    267KB

  • MD5

    fa4d4bf75a1b9f9262b7a75e13a35912

  • SHA1

    fe6c44a8a52417343554955d2c4256c089c8bfde

  • SHA256

    3057ccd02a85862bea425e6b4777ad6998b0646557f5c5e1fae7029d8ee437d7

  • SHA512

    447da809b03f6b036bce17075687290b37ec6c91098814a4aac0405d8fa14f1302b2a5ae1340a39f14c4193e74de3c7b437ac1420479d1cca8a42a9368929e30

  • SSDEEP

    6144:e9nHPoWoWBVJjMCPnsWmoQKSdEOWlzwaKNmnsimFfmwOEt4fqfI:8AAIcnsWACeaKNPFdOEafb

Score
10/10
ponycredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 3 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 58 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of FindShellTrayWindow 41 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\fa4d4bf75a1b9f9262b7a75e13a35912_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fa4d4bf75a1b9f9262b7a75e13a35912_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4092
    • C:\Users\Admin\AppData\Local\Temp\fa4d4bf75a1b9f9262b7a75e13a35912_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\fa4d4bf75a1b9f9262b7a75e13a35912_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\45A36\07388.exe%C:\Users\Admin\AppData\Roaming\45A36
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2784
    • C:\Users\Admin\AppData\Local\Temp\fa4d4bf75a1b9f9262b7a75e13a35912_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\fa4d4bf75a1b9f9262b7a75e13a35912_JaffaCakes118.exe startC:\Program Files (x86)\36CA2\lvvm.exe%C:\Program Files (x86)\36CA2
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2232
    • C:\Program Files (x86)\LP\88A4\D54E.tmp
      "C:\Program Files (x86)\LP\88A4\D54E.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4408
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1508
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3692
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1836
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4592
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3652
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2172
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3360
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

5
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Peripheral Device Discovery

2
T1120

Query Registry

4
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\LP\88A4\D54E.tmp
    Filesize

    96KB

    MD5

    1af9198aefc1a89dce2e8f9227ae8c64

    SHA1

    718e24e7694b5d98a78455bfb8376e849aba5de7

    SHA256

    a0dc0e890177fe303dc2cd1d94f582325b42f48df6ddada24bc5f52dbad14a02

    SHA512

    4bfcc7c92baf26285ba33952bc87eeb994c502828b57feb3d5e90fe3ee53f754242ccfc4be61382bfd436bbb9890f50d83d9f0dce36c8d059a7a9874c0c646c8

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
    Filesize

    471B

    MD5

    1f02b795d703ffe77e8cf0ac4a209329

    SHA1

    19eaa8c597efd541c94d6e2c5642edacedcc51bc

    SHA256

    48eacb1ee044d692b42f3a6e6a3d0615313e66587ba17b995e2cf894a6c2813d

    SHA512

    6613dabd6027a78628ad6dbe2793455a927e9d60a94c6fbaf11a93e3a991eac711dfcc2039b3e825908a1a1014ef573d3e8d741beda3c10c6a33432501339fe0

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
    Filesize

    420B

    MD5

    aa2091c15d7042ffa920f5f5b88543fb

    SHA1

    b68b6f6572e86e3afa81bf9bf5ce1827e01635d1

    SHA256

    f8d342c48718d525b462037dca2d3ac0e2744da5ef2537e13de0163fa28cd052

    SHA512

    c0943a21e70d23ad7126d7add1be28842add32298162d35d7391ab27c14e7d1119782770dd367452e39d970d08ab3ac4b4d39b1e8457342b445661523a97a5a0

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133719091392015667.txt
    Filesize

    74KB

    MD5

    3c724d61b47345fcb3514d57a309fbeb

    SHA1

    9770b6296a097f8630cca35be73d1928ca4df357

    SHA256

    be610b567a68f788d1f1708a53827c400caa5aba2af6b76ea4f4ec9fe18f6f3a

    SHA512

    a155bae63e662051c530572356054b8b9b1a9ee7097533f1432d3821b51ce30e5acf9c7cb5fdb36bb4adf2efc02be3dee541d18768937e4de831426974ed1830

    Download Submit

  • C:\Users\Admin\AppData\Roaming\45A36\6CA2.5A3
    Filesize

    596B

    MD5

    e81da9679dbdf3a8f584034015a650a7

    SHA1

    8718aa797a25b6cf31d84f70cd95bc8855c15adf

    SHA256

    165a860b4e5cbe60f35323948948347fa1405533e2762e632a77267090ee9b38

    SHA512

    7dbac4f6eac8c2afb3efd4d8261011c8b3e69cd8e2f7a4b7438da0289415d826b09701d3dd2888f3a3254758b1bc343851487235f0ae636bd934788b6e213dc8

    Download Submit

  • C:\Users\Admin\AppData\Roaming\45A36\6CA2.5A3
    Filesize

    996B

    MD5

    0ca8491db19f80d25734dc98806b18c7

    SHA1

    018c66a0aebb88bc9e07792140942d1b5059b609

    SHA256

    52b6c8a4833823d709b8905c2b20745dfc9c20c618f6711731478df3adfd61b4

    SHA512

    6cd5710ea5e9f0c0d9a2cf2e687a5155477f57361bf7c233c96085b857121fefafe887c87a5c42971e884e5ef429b9a546ac28212367e816d5ef123663f43147

    Download Submit

  • C:\Users\Admin\AppData\Roaming\45A36\6CA2.5A3
    Filesize

    600B

    MD5

    3656452c3ae4e8101471ea7c974cadc7

    SHA1

    ebadd588a1c3196f839afda84d73222d49521c70

    SHA256

    bb4fa2c691c4228d43c03bdbafc4ba30191a4a0f9d3154cbe1f62b9e9dc0fa02

    SHA512

    0603e1374e7a4cee43f24d79c4be0c92daf908d9e3b44435059be16c08b2727b312eed4edd0bb47df67a95c22cccec5e98bce10ad06d7b0248067dfceb23ad14

    Download Submit

  • C:\Users\Admin\AppData\Roaming\45A36\6CA2.5A3
    Filesize

    1KB

    MD5

    6d5bdf5e143575234941b3bd59d315b6

    SHA1

    52f1db081404e12383e878d9b615ec0514edcf19

    SHA256

    6bc643ba29e988b92eadb714a152410aa3b358b355d3669e990fbd531941d3ea

    SHA512

    2e3bb3cc2a5e2fc362fed391951020b2b97c6315ed4163e1aa42bc62fab9498c0e7899c777aa5010a882aef99b0319562b8f3ac94532452629b3f0b90b062e39

    Download Submit

  • memory/1756-329-0x000001437DDD0000-0x000001437DDF0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1756-293-0x000001437C700000-0x000001437C800000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1756-322-0x000001437D9C0000-0x000001437D9E0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1756-298-0x000001437DA00000-0x000001437DA20000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1756-294-0x000001437C700000-0x000001437C800000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2232-141-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/2784-18-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/4092-14-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

    Download

  • memory/4092-13-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/4092-139-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/4092-0-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/4092-16-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/4092-3-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/4092-453-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/4092-2-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

    Download

  • memory/4092-484-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/4408-454-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download