Overview

overview

10

Static

static

3

fc7f63ccd8...18.exe

windows7-x64

10

fc7f63ccd8...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    28/09/2024, 14:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fc7f63ccd826f0bed675aac69a0969d3_JaffaCakes118.exe

  • Size

    1.9MB

  • MD5

    fc7f63ccd826f0bed675aac69a0969d3

  • SHA1

    8bb1e89f1080e272cd77e2a08933a9daf3d9db85

  • SHA256

    ccd9dd1098157c884c04bc46825b296607774534e5c4200b856b28a13e03f365

  • SHA512

    1f661e13ccf40e8321abdf9344a8dc3600c2ec41fbac7be301eaeb381e8d8302565570383c226b34b71a3e020ed5a13a93018a8729db7e8f3e67e52d1019b192

  • SSDEEP

    49152:6/H9zPqoEUP/QsGDFxUGXET3pb2uQUr3ZAK6SQKS:gHZhgFxUfT3gu3r3ZAn

Score
10/10
ponycredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 14 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 2 IoCs
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 25 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\fc7f63ccd826f0bed675aac69a0969d3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fc7f63ccd826f0bed675aac69a0969d3_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Users\Admin\AppData\Local\Temp\dwme.exe
      "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
      2⤵
      • Modifies security service
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2228
      • C:\Users\Admin\AppData\Local\Temp\dwme.exe
        C:\Users\Admin\AppData\Local\Temp\dwme.exe startC:\Users\Admin\AppData\Roaming\7C52B\B5BD5.exe%C:\Users\Admin\AppData\Roaming\7C52B
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:544
      • C:\Users\Admin\AppData\Local\Temp\dwme.exe
        C:\Users\Admin\AppData\Local\Temp\dwme.exe startC:\Program Files (x86)\2B557\lvvm.exe%C:\Program Files (x86)\2B557
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2868
      • C:\Program Files (x86)\LP\D5B7\2452.tmp
        "C:\Program Files (x86)\LP\D5B7\2452.tmp"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3048
    • C:\Users\Admin\AppData\Roaming\dwme.exe
      C:\Users\Admin\AppData\Roaming\dwme.exe auto
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:844
    • C:\Windows\SysWOW64\Cloud AV 2012v121.exe
      C:\Windows\system32\Cloud AV 2012v121.exe 5985C:\Users\Admin\AppData\Local\Temp\fc7f63ccd826f0bed675aac69a0969d3_JaffaCakes118.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2740
      • C:\Users\Admin\AppData\Roaming\FjYCwkIVr\Cloud AV 2012v121.exe
        C:\Users\Admin\AppData\Roaming\FjYCwkIVr\Cloud AV 2012v121.exe 5985C:\Windows\SysWOW64\Cloud AV 2012v121.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2352
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2732
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

4
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\7C52B\B557.C52
    Filesize

    300B

    MD5

    573fda89194050ea69a3353771bfadc7

    SHA1

    5d433b8e01a5c1683d7ecee20ba474e1a0b2f19d

    SHA256

    4de03737260c0672e35d2b7fe734d5653a4c2693353b0b33ae9afd66153c51f5

    SHA512

    8b0819698790321b4c7d460e25b6a258fccb975811e00c947906e08d03e5408e200e89adf097f9e9b08f1a8969af8421be25a631984c3d80973a2a4d30591d2e

    Download Submit

  • C:\Users\Admin\AppData\Roaming\7C52B\B557.C52
    Filesize

    696B

    MD5

    45b67e2da92124517cc653632a91457c

    SHA1

    0d3ccc3407997a80323d621dbcece45dee9d04ee

    SHA256

    c9e9661e5c0c8cc2a3d549ceb674eabe75540c54be4e2367843bbd341e0ba676

    SHA512

    6981ea1c93651bea769ea578ed7b0866737beb3131e80a9bd2ab031cdff6b6bbd4118140d053eaa55a5f75bba0f7859b40a99f3fdc6a1fd32d166a95a34dddd7

    Download Submit

  • C:\Users\Admin\AppData\Roaming\7C52B\B557.C52
    Filesize

    993B

    MD5

    af57a72f03e7150c318724e138588a16

    SHA1

    85df9d1541074ceffdb1810853125efe7d04f133

    SHA256

    57bee99c908d73c0622c1fb63bf0ddafb2f44c8bd0e9e92f016f622e56b56f19

    SHA512

    5395fc54b0d66c3f675989088270d6a0a6fc968249c9aa051d4fd8a7973b95f81c67a5547ccb2b6bad72256a8a17654b161da0ae3769efb334f7d9fff10ed7a0

    Download Submit

  • C:\Users\Admin\AppData\Roaming\7C52B\B557.C52
    Filesize

    1KB

    MD5

    40520f1c98af8639dbf27a5f6602ec62

    SHA1

    52ed07c24b1177f695b5f927ee0c462fbe8a0f2f

    SHA256

    154728eb8075586c267f11668fb6b46a8776fff187276e5e1b05054199e3ce5e

    SHA512

    e0bd0e2754a5bbcb0ef4654c82a63574b27352fcc2341abb6548f0281a029efb9b38d3d7e298ee3732e4585247242702dce299aa06c3a84870c80535c7c11b2e

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Cloud AV 2012\Cloud AV 2012.lnk
    Filesize

    1KB

    MD5

    c5c0e0006d019abec4b2466169c7e07b

    SHA1

    732dad4fd0dccd2f5f655f7ee469a243a89078ca

    SHA256

    adfdd229e72880db701b88040ad4d91e7bd244cb1e93a28749e8446345727ed7

    SHA512

    09a073600b326521324d77756ecfaf931fa21471362c9a5112623daeff84299ef6d063a91fbf585388823833f0ee61c2e77cd826dc0673081c4066d4faad0da4

    Download Submit

  • C:\Users\Admin\AppData\Roaming\ahst.lni
    Filesize

    607B

    MD5

    48d76ac9228c29f7c3f0d54a9526f4c2

    SHA1

    ef1a5cc167381e3835d329b072ba20b0d42d4a29

    SHA256

    5437041f8ce5cf372802531839f0ce784a16919a25cc836441da000339e8a78a

    SHA512

    b5aacdbf520a71cf6a74781cb8547f7ddb01e5e8bfe1061766fe2b954115eeb3c8a41e8d5ec563b4aa57ae3b1eaed58bcac9a4ca914ab8d917316b38f35672d7

    Download Submit

  • C:\Users\Admin\AppData\Roaming\ahst.lni
    Filesize

    1KB

    MD5

    4903dc02b5e89e5fa9226536b776addf

    SHA1

    48db324a5a8ece21b53ce52c86e98a905e53ba38

    SHA256

    de28280abb80058953997a4ea177d637ac5e65c092ca10115d8b04f927552f79

    SHA512

    bae6dde1e224530c733910f17c248fb4c8adf6ad099d300188b5021abcaeda00531f5cf7eefae98b685251ce921f370f0ccc9b5b15e73309ba5c864d73ba2d8a

    Download Submit

  • C:\Users\Admin\AppData\Roaming\x5sQJ6dEKfZhXj\Cloud AV 2012.ico
    Filesize

    12KB

    MD5

    bb87f71a6e7f979fcb716926d452b6a8

    SHA1

    f41e3389760eaea099720e980e599a160f0413b9

    SHA256

    14c9c49d8ead9ab59a56c328008f59c20b32c3ad22c00e02d34e16ad7086fe84

    SHA512

    e1d14363274e367ea600afc357d012233fc68f0636e8d05b29992e762d31e9a55b4fa38b08613c2ca528d7fb0f547774a3a3dc79aada32c2c7359c3edcdb549d

    Download Submit

  • C:\Users\Admin\Desktop\Cloud AV 2012.lnk
    Filesize

    1KB

    MD5

    1700eb3f9472ff29eab4669e4488dc0f

    SHA1

    e6b85a46fe7041bbc0127a6e58c5d828925c9a32

    SHA256

    e6b6fc27b37cca3da20037e85de777af6614c51506cb51ea5314eeaf37ec0f8f

    SHA512

    c7c88389b5fb6c1a01383c73697d3b2592c05e72903ac92d160266ef382aeeb650c655eb72ef1662f7c3758416d548f7a6c9fec87dbbbd6de6a71cb3b29ef491

    Download Submit

  • C:\Windows\System32\drivers\etc\hosts
    Filesize

    1KB

    MD5

    f2ea5bc21a83316fd72208c642d1fd24

    SHA1

    03e86324c992adeb27cec2f787f10336b9709f1e

    SHA256

    23c1b9ef169be235490c763b54e52279c7d45acfe9816767dc0ff5828ef69c2c

    SHA512

    13a38e4d5043182941a43eb003a7ca984b6606b21dc387d13833c58c07b83f4032de0889199f6b9bcaee589fef1676c36df1c9071234137e3591928bbd185583

    Download Submit

  • C:\Windows\System32\drivers\etc\hosts
    Filesize

    1KB

    MD5

    f48cfb5db32cdf990f35a5ef9146dbf4

    SHA1

    09b4f991e17aba915160f6c153c6d78e2d4aa4d9

    SHA256

    72439cac78aae2122ddea93a12f562ea85c9fb909bef25cae982480a2d51f397

    SHA512

    385c74297ee70bdce1cf2dbcafd95e1d96f1b9ffd0fac713d614f84b9d02c28359276434ea164082ae46b312f40dd9911a27526df2ef3613118a0efc9271d301

    Download Submit

  • \Program Files (x86)\LP\D5B7\2452.tmp
    Filesize

    99KB

    MD5

    b6c44c70136fcbed1aace964c4e98e9d

    SHA1

    4f7961087e09cdf03efe4fe0b7f2243499504628

    SHA256

    75d10ab1bea3e7cb80e3c0048b79cf0496c88b885ff853d6f430c71272030bcd

    SHA512

    801762bbc8ffa62fd49dadb75bfa0ff31f73ee4b712c91d23885f0d4fbc45eebbc30f2ab84e04ce375e8a269bb2a1c8514c4dd9cbd50f42e5960987c719092da

    Download Submit

  • \Users\Admin\AppData\Local\Temp\dwme.exe
    Filesize

    279KB

    MD5

    28f68e83db55f7bea9da2240ed0fb82e

    SHA1

    f921166658168cd0149fc4bf192ed37a2281ab15

    SHA256

    41a4cfba62cc917f591523b5adefa926afb6bfe54aba4d2b72ac6f98253d9b58

    SHA512

    40976449c4a135a2375ef875f0d0e7c0a3f612786ab7901a49b5def17348fdfc57ad0b6fb7e83ea01714d8c95f1154c27502572f1905bfde18d818ffe58fcbc6

    Download Submit

  • \Windows\SysWOW64\Cloud AV 2012v121.exe
    Filesize

    1.9MB

    MD5

    fc7f63ccd826f0bed675aac69a0969d3

    SHA1

    8bb1e89f1080e272cd77e2a08933a9daf3d9db85

    SHA256

    ccd9dd1098157c884c04bc46825b296607774534e5c4200b856b28a13e03f365

    SHA512

    1f661e13ccf40e8321abdf9344a8dc3600c2ec41fbac7be301eaeb381e8d8302565570383c226b34b71a3e020ed5a13a93018a8729db7e8f3e67e52d1019b192

    Download Submit

  • memory/544-139-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/844-42-0x00000000022D0000-0x00000000023D0000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/844-43-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/1676-28-0x0000000000400000-0x0000000000917000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/1676-0-0x0000000002E40000-0x0000000003255000-memory.dmp

    Filesize

    4.1MB

    Download

  • memory/1676-29-0x0000000000400000-0x0000000000914000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/1676-2-0x0000000000400000-0x0000000000917000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/1676-1-0x0000000000400000-0x0000000000914000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/2228-127-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2228-241-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2228-108-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2228-385-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2352-113-0x0000000000400000-0x0000000000917000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/2352-231-0x0000000000400000-0x0000000000917000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/2352-140-0x0000000000400000-0x0000000000917000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/2352-44-0x0000000002E50000-0x0000000003265000-memory.dmp

    Filesize

    4.1MB

    Download

  • memory/2352-305-0x0000000000400000-0x0000000000917000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/2740-39-0x0000000000400000-0x0000000000917000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/2740-30-0x0000000002D10000-0x0000000003125000-memory.dmp

    Filesize

    4.1MB

    Download

  • memory/2868-233-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/3048-306-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download