Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
03-11-2024 21:05
General
-
Target
8d823732d7c08e9d006ad28dcfcd9853_JaffaCakes118.exe
-
Size
1.9MB
-
MD5
8d823732d7c08e9d006ad28dcfcd9853
-
SHA1
50bd2a3e3d9cb967c8aa9fd72bb0a2626d350da3
-
SHA256
645397aa16ec0291f74945cc4d4a535d7a8b26b1ac11629be76a91f50124c658
-
SHA512
9be430e058188fd78d2134eb002f55c8206f1b16edd9f9d27f1cdcf18a1c840202ddfabd7cfa6012c64467f426db58d5ba76f961844f09859cbade5dc72aada3
-
SSDEEP
49152:6yH9zPqoEUP/QsGDFxUGXET3pb2uQUr3ZAK6SQKS:RHZhgFxUfT3gu3r3ZAn
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
-
Pony family
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Drops file in Drivers directory 1 IoCs
-
Executes dropped EXE 7 IoCs
-
Loads dropped DLL 14 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 2 IoCs
-
UPX packed file 15 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 3 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 10 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 21 IoCs
-
Suspicious use of FindShellTrayWindow 33 IoCs
-
Suspicious use of SendNotifyMessage 26 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 28 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d823732d7c08e9d006ad28dcfcd9853_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8d823732d7c08e9d006ad28dcfcd9853_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dwme.exe"C:\Users\Admin\AppData\Local\Temp\dwme.exe"2⤵
- Modifies security service
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\dwme.exeC:\Users\Admin\AppData\Local\Temp\dwme.exe startC:\Users\Admin\AppData\Roaming\43091\AB65B.exe%C:\Users\Admin\AppData\Roaming\430913⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\dwme.exeC:\Users\Admin\AppData\Local\Temp\dwme.exe startC:\Program Files (x86)\91B01\lvvm.exe%C:\Program Files (x86)\91B013⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\LP\5BF4\3044.tmp"C:\Program Files (x86)\LP\5BF4\3044.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\dwme.exeC:\Users\Admin\AppData\Roaming\dwme.exe auto2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Cloud AV 2012v121.exeC:\Windows\system32\Cloud AV 2012v121.exe 5985C:\Users\Admin\AppData\Local\Temp\8d823732d7c08e9d006ad28dcfcd9853_JaffaCakes118.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\KaQJ6dWK8R\Cloud AV 2012v121.exeC:\Users\Admin\AppData\Roaming\KaQJ6dWK8R\Cloud AV 2012v121.exe 5985C:\Windows\SysWOW64\Cloud AV 2012v121.exe3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
300B
MD59c7c7d3db2cab7eef7e1b475d6af8eb7
SHA1b133ef9e3e6531d0743ed9f0449ed4dc3279a60a
SHA256db0c36887c57029394f58141a7975f30db7983f544096fe2be52b4495976bea1
SHA5126da77d6c0adb9ae91de89c330db3cfe8c0ebdbaf6e3ee626f685556ac3f33d1dd0ad0c4236677cf48794abbb4bc97d3bfc5748397f6e7315a85895388951f4b6
-
Filesize
696B
MD54abeee2dbcba03b77ca7bd1eae867a38
SHA10a007f97d9f12154bb849ea1159c9d68ddf9d02e
SHA25647671ffd8b713c3f2ff4c82c5f34afeb230daf16c33b91f5c7b9a210576a02c8
SHA512c698aea34764f1e337345f2bf1e82381105e8923dbc415b96f5f7b6420bdf810f09220b05e1526add911561b7a78861edba2af5df694b9b0823b9642d88ba5a9
-
Filesize
1KB
MD5cd7f5a60f85573daf753d149466f49cc
SHA19363e9f7eb07e206f28c0b0884b41e1f25d501db
SHA2563d1e172cf40b3d2c95659b87c21fda39ce1191e359212d5fee6fa0a63abe718c
SHA512c1184c048ca1b29f2c2a425aff8232a991760be1cf7586e94af2dc9e89e6bfdaae9b4038043b57410d80560a03050feedc809d80c34314e172bf15db91daf0d9
-
Filesize
1KB
MD534499513802070318e0a234fa3bc8f90
SHA1ac6744607503d7c71284ab61ce8943ff84c6a9ba
SHA2563fa48aedbfaa9cea16a312e86d08deee7282b4e4e413d0ee7e0014bd90744b36
SHA51265bb5f15143646d630859fdecefe1b389dacae7083242cda7a1c1357ed18c063f31f2d6c740ae98e3305eb00ce9e7618928a30a8b8cec7e602b3fae793d060d7
-
Filesize
1KB
MD522f3354be9fcbfad013655590c56c7ba
SHA12a222895b628d4c6669b24bba63ae44def7ceabd
SHA256af83565241e16053d1e51e3f67d936ad6f388a3e7f3ab180da90c2e84a4b8bc6
SHA5123c2902220a6f8377b00f8ea9c67ae10f162ddeed701357c543e042ff7dc6f3c9d4d767182ca51bc0b96b5125e802cd40cd4ef8c35e4c465149970128629f4c1e
-
Filesize
12KB
MD5bb87f71a6e7f979fcb716926d452b6a8
SHA1f41e3389760eaea099720e980e599a160f0413b9
SHA25614c9c49d8ead9ab59a56c328008f59c20b32c3ad22c00e02d34e16ad7086fe84
SHA512e1d14363274e367ea600afc357d012233fc68f0636e8d05b29992e762d31e9a55b4fa38b08613c2ca528d7fb0f547774a3a3dc79aada32c2c7359c3edcdb549d
-
Filesize
612B
MD5ec82cfa14478215ea8e412907780c381
SHA1c8fdedb60a0c3a83d0fb72abe115be264dc89338
SHA256b159995872d74fbe1d54f561f5702ed75f26c19e85caa51599abb76f10ad68bf
SHA51276f700b0d8a5247dc188ccefd674b7d0ee1842a06f00f64c780599b7757bd3f6e87a0f0c1c887947cacdb8fbda5d0b935bf91007ff794bf821125d46bf15a1b5
-
Filesize
1KB
MD5bc84802c6569135b0613b518ed3b674d
SHA19e6c1d1e8ecbe8e8506624ca45f4e88576c608d8
SHA2568ef22020d76c6d83941be931a9434d40a4aa42b3c7f711197e838bd91c1455cf
SHA5129ab4bff4fb9c4c192fcd8f5e5c75a6428f714d048c7f5f5c6af3e81e36fb1354736432d0af169d162dfb50a315cdfa15240e64cb15d3b7648e3d1a8a76049af7
-
Filesize
1KB
MD594978bc3dde772a609ec092df42e692f
SHA1678f099a1027536bbe6f6f6fb4fb6625dbf71e7b
SHA256145a23cfe9b98b167237e03c82e78cc736011efa701bdb2c455234a875efa4bb
SHA512a12ea2d3c8dc3b35ed72a15f888b41179f555ad480040568df3c69ce84df581c99e5917da632a2e7fc449ee70a6c3df368b35441c2734d4f16e33f6704173b2e
-
Filesize
1KB
MD536dfa60cf7f29a2dc9490d564ca144b9
SHA1eb5317b4e6c4d9d7685f971f4fa1dcc1574bbffb
SHA2567c0d3bd7425c1e8c3ee7eb43008e581ff18f857dc596fc15e137b85b11cf2e30
SHA51205f0372c838e7a5de8b0c8f70986f93d267be0d9d700e04c833c56f1ce12b632fefc46d5d108762a6543910a50c64798cc69aaa64dedcc675878e59df717586c
-
Filesize
1KB
MD5240d7cae8e391e295306e8fc0cfc9572
SHA1f4abdf41e5c7731d7db779e93f6cb2a45e23ad57
SHA256f81f7e0e06da058fd81b70380a06e7d101ae3822d7619ee162293785b34163e7
SHA512ca9a5ef1e1b16eca9c385ecc9cff75eb30e4e1bda996e154365c5f370950d094c676b4ce0c0f48b97b89ec915a5329f2bbac5ef464396ce91b139159a9db63ce
-
Filesize
1KB
MD5a13948b289b4cd583cf97b68ffa38269
SHA1b49e3bf18153a9481b0017f5a860bc924ae5800d
SHA256af9f8ff34151c9bbe699c4735739a726fa3eb8629401418258723073f4f4ee05
SHA51276aa99a5241f08de5d8ea5215cadab68adee79e8cec8ef5f9974e3e830a77c11241df7a9787fae7b140ff4029b8701c3cf61563d8c337e5a5b1cc5e9b8a1797f
-
Filesize
99KB
MD5b6c44c70136fcbed1aace964c4e98e9d
SHA14f7961087e09cdf03efe4fe0b7f2243499504628
SHA25675d10ab1bea3e7cb80e3c0048b79cf0496c88b885ff853d6f430c71272030bcd
SHA512801762bbc8ffa62fd49dadb75bfa0ff31f73ee4b712c91d23885f0d4fbc45eebbc30f2ab84e04ce375e8a269bb2a1c8514c4dd9cbd50f42e5960987c719092da
-
Filesize
279KB
MD528f68e83db55f7bea9da2240ed0fb82e
SHA1f921166658168cd0149fc4bf192ed37a2281ab15
SHA25641a4cfba62cc917f591523b5adefa926afb6bfe54aba4d2b72ac6f98253d9b58
SHA51240976449c4a135a2375ef875f0d0e7c0a3f612786ab7901a49b5def17348fdfc57ad0b6fb7e83ea01714d8c95f1154c27502572f1905bfde18d818ffe58fcbc6
-
Filesize
1.9MB
MD58d823732d7c08e9d006ad28dcfcd9853
SHA150bd2a3e3d9cb967c8aa9fd72bb0a2626d350da3
SHA256645397aa16ec0291f74945cc4d4a535d7a8b26b1ac11629be76a91f50124c658
SHA5129be430e058188fd78d2134eb002f55c8206f1b16edd9f9d27f1cdcf18a1c840202ddfabd7cfa6012c64467f426db58d5ba76f961844f09859cbade5dc72aada3
-
Filesize
112KB
-
Filesize
428KB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
4.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
4.1MB
-
Filesize
5.1MB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
1024KB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
4.1MB