Analysis

  • max time kernel
    140s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15/10/2024, 23:37

General

  • Target

    4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe

  • Size

    263KB

  • MD5

    4a82471b1cdc5f3661b0d8c40f8046cd

  • SHA1

    ce34d8c2ebd1ae8deac602d89625871be0c4b3c7

  • SHA256

    66e69609fd141fe7c16c728fa8f02280d1dc2994b93f78e7fb2e745ccfedc644

  • SHA512

    d4caf454ef9df0d94c7b27b3e5217c873ec81ae1bbab93266a39dc9f0e83a97af61ad18191f45c709e29b81c2214f7fbf4d4b04eecfe35dc49add84167e250d0

  • SSDEEP

    6144:n0c3knldodUmC33e3sPaeBFSflE9tM3OwJki2zP0z+TzTj:0c3k2C3ykdwGRTr

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Disables taskbar notifications via registry modification
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 17 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2148
    • C:\Users\Admin\AppData\Local\Temp\4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\4308C\6B1EC.exe%C:\Users\Admin\AppData\Roaming\4308C
      2⤵
        PID:1312
      • C:\Users\Admin\AppData\Local\Temp\4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe startC:\Program Files (x86)\8C7E4\lvvm.exe%C:\Program Files (x86)\8C7E4
        2⤵
          PID:1364
        • C:\Program Files (x86)\LP\EC04\70BD.tmp
          "C:\Program Files (x86)\LP\EC04\70BD.tmp"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1916
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2992
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1772

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Roaming\4308C\C7E4.308

              Filesize

              996B

              MD5

              8183bf8e4f9e040ccfb9c6df0e7bdbc0

              SHA1

              9805a0f12a94cdbec33ba9dc9f64468433f01baf

              SHA256

              35fc658f129823175e5276b5828ebf7fe1f4e95b7aeddcd21069afa78843446e

              SHA512

              2bb4ea285fea9b2d765e7d9af19816a730cf2e96b616844a85155448d9223cd7a95f49cd0576d228ad1cd3364cfc0c9b9c57c5126195982d79cb21d64e0a284b

            • C:\Users\Admin\AppData\Roaming\4308C\C7E4.308

              Filesize

              600B

              MD5

              0dfb601d3ee514e59ab212f93b270d39

              SHA1

              79e29d16020df01b2e6f00333d61557c906f2032

              SHA256

              587d3d9ad2b04917bc7a260c35ae0abe0fca023430b1387205e7b65b9f4d6d77

              SHA512

              3650fd251d9ba075e75559f22dd3363e1fb1a27b7dfe12a88b0762ff562afd8c3f279ed6712b90470b145841af68d1a69ab453a72ceb941b1219a962cbdd6dc1

            • \Program Files (x86)\LP\EC04\70BD.tmp

              Filesize

              94KB

              MD5

              357af328908353040840f79fd805c127

              SHA1

              aa051df5c1e1d7a52e903532bb1353026bc8f942

              SHA256

              334acfbe4cc54bf676308670e21cd742bae7e0a6f957f1564bc655fc2d3df3d0

              SHA512

              c0d91065f2b12c7b5f80fea522d2668b29828e651ae4868ed0ffff2c217b91f416db8e60c8362fd2130e57e191c4aecab80b9756a6de3eb0a2371d80b266f851

            • memory/1312-19-0x0000000000400000-0x0000000000469000-memory.dmp

              Filesize

              420KB

            • memory/1312-15-0x0000000000400000-0x0000000000469000-memory.dmp

              Filesize

              420KB

            • memory/1312-17-0x0000000000400000-0x0000000000469000-memory.dmp

              Filesize

              420KB

            • memory/1364-128-0x0000000000400000-0x0000000000469000-memory.dmp

              Filesize

              420KB

            • memory/1364-126-0x0000000000400000-0x0000000000469000-memory.dmp

              Filesize

              420KB

            • memory/1916-304-0x0000000000400000-0x000000000041B000-memory.dmp

              Filesize

              108KB

            • memory/2148-3-0x0000000000400000-0x0000000000469000-memory.dmp

              Filesize

              420KB

            • memory/2148-16-0x0000000000400000-0x0000000000466000-memory.dmp

              Filesize

              408KB

            • memory/2148-124-0x0000000000400000-0x0000000000469000-memory.dmp

              Filesize

              420KB

            • memory/2148-0-0x0000000000400000-0x0000000000469000-memory.dmp

              Filesize

              420KB

            • memory/2148-2-0x0000000000400000-0x0000000000466000-memory.dmp

              Filesize

              408KB

            • memory/2148-13-0x0000000000400000-0x0000000000469000-memory.dmp

              Filesize

              420KB

            • memory/2148-303-0x0000000000400000-0x0000000000469000-memory.dmp

              Filesize

              420KB

            • memory/2148-307-0x0000000000400000-0x0000000000469000-memory.dmp

              Filesize

              420KB