Overview

overview

10

Static

static

3

a81b7b8400...18.exe

windows7-x64

10

a81b7b8400...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    27-11-2024 13:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a81b7b84002b7b65ed10424e0c8f45b3_JaffaCakes118.exe

  • Size

    279KB

  • MD5

    a81b7b84002b7b65ed10424e0c8f45b3

  • SHA1

    7b18a10e9cbbe0dab47a240547cce14713372bef

  • SHA256

    dd0528460b2d1d1946c1873f410f505946f7c47a97f86628fb9dd64331d249d1

  • SHA512

    306dcd6e3cffab31323eed8df31c78dfbcf8f9cd15606e670fe3bf6c0cef38254635fd84cd12ce8290bf524f0b267021203b89a5d6bb67125ad580e61009a298

  • SSDEEP

    6144:m7OT0l65RAHqjeEnoz5OEKS64y5eUSqX5kdpfkQr7ZBfE9M:m7URGgdoz5LDsOddkUBc9M

Score
10/10
cycbotponybackdoorcredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 7 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\a81b7b84002b7b65ed10424e0c8f45b3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a81b7b84002b7b65ed10424e0c8f45b3_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2312
    • C:\Users\Admin\AppData\Local\Temp\a81b7b84002b7b65ed10424e0c8f45b3_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\a81b7b84002b7b65ed10424e0c8f45b3_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\D5A34\F7E98.exe%C:\Users\Admin\AppData\Roaming\D5A34
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1776
    • C:\Users\Admin\AppData\Local\Temp\a81b7b84002b7b65ed10424e0c8f45b3_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\a81b7b84002b7b65ed10424e0c8f45b3_JaffaCakes118.exe startC:\Program Files (x86)\34D55\lvvm.exe%C:\Program Files (x86)\34D55
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2152
    • C:\Program Files (x86)\LP\98AD\E8AA.tmp
      "C:\Program Files (x86)\LP\98AD\E8AA.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2308
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2708
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

4
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Query Registry

2
T1012

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\D5A34\4D55.5A3
    Filesize

    600B

    MD5

    24fa21c3eda78329fe0756f2e37ed0f5

    SHA1

    edd2ecb9110d2c99d65bfe047e3f0247227a818d

    SHA256

    f472219f2c2d4d6649b00c6dc27bdc9811f08bea6019d7d7e0df62aec85fa949

    SHA512

    3b543af376c82a5ea02ec6302654341ec44507d6b1b1742ea5e037004da5f8d76c6e97901c8ef4e107d2fb750a2011af9d464df781515e407389abf2ab758203

    Download Submit

  • C:\Users\Admin\AppData\Roaming\D5A34\4D55.5A3
    Filesize

    1KB

    MD5

    ed7a45005d4c3c1c8de646a22aefaeb6

    SHA1

    80e06cf47464df9d2bb91396c7f78d76008cf17e

    SHA256

    27e2623bb9de8b241f5bb6ece5bceb2181d0d8025cc48c99fa4d3d5b8b0193bf

    SHA512

    d8eca51b10a37d92e6126979fa719bf58d1d29f682e6bb223a8c2d73ada1d1ab5ce4c19d2fb929d9a6f107cdc9271c64fef8d2e86f8d58ca49b5919092795ec1

    Download Submit

  • C:\Users\Admin\AppData\Roaming\D5A34\4D55.5A3
    Filesize

    996B

    MD5

    bd5f4923baff3ab41d9ea94475e6b3f7

    SHA1

    ce9b920bb4be4fa11f7449ec6c4b46770ddcc879

    SHA256

    8a5936051fe073f9007506d76075f640a1e8e3beb737790c4db1b0344cee9a73

    SHA512

    0a8e5dc5ed518214c7fab8ae872535d44bf61ff29925b3ad592a3ec49c2bb2018f01786124990dd0eb5d476d4325726d0754af624f8edf4d55f0489e16092f0e

    Download Submit

  • \Program Files (x86)\LP\98AD\E8AA.tmp
    Filesize

    99KB

    MD5

    cb853d0e676be7b23903aa89175d8d69

    SHA1

    2066462d42c45133df60c5e5f9e8956373d191b0

    SHA256

    7291b34528651c542a4e09036bb828f27c9f75c134d2be3aed3e1c5a0db5fe20

    SHA512

    bf96f4c8511929ef380562004211a72821330465538db6da3367cbce387092384265e0bfd4ab54e62b742d68d668ff1457f43381d7a770fd3027f3bab1f36038

    Download Submit

  • memory/1776-89-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/1776-15-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/1776-16-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2152-90-0x0000000002340000-0x0000000002440000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2152-91-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2308-203-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2312-1-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

    Download

  • memory/2312-13-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

    Download

  • memory/2312-119-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2312-11-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2312-2-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2312-202-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2312-206-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download