Overview

overview

10

Static

static

3

a8ae4098ec...18.exe

windows7-x64

10

a8ae4098ec...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27-11-2024 16:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a8ae4098ec4487575459754266c47de5_JaffaCakes118.exe

  • Size

    281KB

  • MD5

    a8ae4098ec4487575459754266c47de5

  • SHA1

    8daad8626d332fcae5efbb4178cfa1b933f667d5

  • SHA256

    6b53c11d275b8b12ba4ecd2dcb60329747df81874b25cdd5addba781b91cd0f6

  • SHA512

    df5e2df51d6e8414860d30277c0f22315972da7a2ee2bac67902344098ef513cd001f57c8a6be20ab76db73003500b2f3655a307c417479f41fac8f6b5b32e6b

  • SSDEEP

    6144:hG9fc8FuSTCIxJnMqktvhIaQvg2/bu36gVswSGqTtld1+Vm:hG9fc8fvxiqkQaQY2/buKYPIn

Score
10/10
cycbotponybackdoorcredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 7 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\a8ae4098ec4487575459754266c47de5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a8ae4098ec4487575459754266c47de5_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:548
    • C:\Users\Admin\AppData\Local\Temp\a8ae4098ec4487575459754266c47de5_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\a8ae4098ec4487575459754266c47de5_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\425F5\8D33C.exe%C:\Users\Admin\AppData\Roaming\425F5
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2776
    • C:\Users\Admin\AppData\Local\Temp\a8ae4098ec4487575459754266c47de5_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\a8ae4098ec4487575459754266c47de5_JaffaCakes118.exe startC:\Program Files (x86)\F59E7\lvvm.exe%C:\Program Files (x86)\F59E7
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1740
    • C:\Program Files (x86)\LP\3CD4\6078.tmp
      "C:\Program Files (x86)\LP\3CD4\6078.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2904
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:800
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

4
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Query Registry

2
T1012

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\425F5\59E7.25F
    Filesize

    996B

    MD5

    cc17fb30e632f4709c99d5c16979ddac

    SHA1

    4bce6d62fc753e775f51d9298d079ae6b8f380f9

    SHA256

    0aa4583c3967f7ded49a6cac810904b45baad945978d936886682d4b459b2fff

    SHA512

    627b106d049ed23391058d10c1c6b0f04313e5aeb72167f8963a204c5351159c18cf3b04775693d35ffd4966a344d044596b9cceeccf9ea77418a9bf727f014c

    Download Submit

  • C:\Users\Admin\AppData\Roaming\425F5\59E7.25F
    Filesize

    600B

    MD5

    66efbb5d88d0ae7709405e673e2f9328

    SHA1

    f6194672f2102942204493be85f1c307b945c47b

    SHA256

    58e87732ae2b81c31eaa54a9edfa393e1c59c5f235e7e4a2866b326e0c69a2a2

    SHA512

    a37aa5560175a6776a4513fd7a7655b86f0a695a0ee66a40af77a6027b04fd795d26909cec9b866bd18b3df9add9f79957832c64e7a462e2e93fe72dc6c31144

    Download Submit

  • C:\Users\Admin\AppData\Roaming\425F5\59E7.25F
    Filesize

    1KB

    MD5

    c8e66da5acacec16b1ee54aba3b31b9b

    SHA1

    e60dffabb79b2c32e5b7022c1ea6638bc5657f6b

    SHA256

    213dcf14877f2d24a4ac748f1d47af65dc016917b3990218f89f7cadd34e2d1d

    SHA512

    ea3218009d0285712b90f97939424d351d7bb2423219b10b13ef6233bf9d9bf4f0fc4e0ad083b9fa49489fb0e8d0e479658ae5ff8d5e496dacda98db11cb3aff

    Download Submit

  • \Program Files (x86)\LP\3CD4\6078.tmp
    Filesize

    100KB

    MD5

    a7ed9038e4cd6d1fb462df4c0750f8f4

    SHA1

    1e9ed1991330322f48a624cffe11d5c89619587f

    SHA256

    6cbf51577edb732c2c90fa18e2384b97c97332da36cc815ae7a7e85bb6c11e13

    SHA512

    3724af484d94733c715102862c03d6b834f9bf0801f0c00ffae7be64d5db6c4212c33732c3048a5b367d3dcf1fc98c9b905a2f1b780a84a35a6e84b26cd548c5

    Download Submit

  • memory/548-2-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/548-11-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/548-318-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/548-314-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/548-15-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

    Download

  • memory/548-120-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/548-1-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

    Download

  • memory/1740-122-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/1740-123-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2776-16-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2776-13-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2904-315-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download