Overview

overview

10

Static

static

3

b198ccf178...18.exe

windows7-x64

10

b198ccf178...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    29-11-2024 13:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b198ccf17826157030f93839b0073334_JaffaCakes118.exe

  • Size

    278KB

  • MD5

    b198ccf17826157030f93839b0073334

  • SHA1

    2ba5171bf0917bc42b0f3307b02d96fba026eb8c

  • SHA256

    cae560e45455ea4fd8ddd3e5a9de9eef9e7bf9c26b1fae83b538ec111e145cc6

  • SHA512

    fc3c194d25c17aacb5ccada7c7ed3195a543c735b8f22c4b1a39e2e54df7f005b1c1e521d135cc651529e2f81261582b3dacfaa57061e3df5eaae5af9102efe8

  • SSDEEP

    6144:h2xWmwEiSh908fenhnhwNJJ3FQl8gLxq9KuFlqvsqBVSNk3teUF:h2ZrTgnhh6FyrLskuzqEqiY8U

Score
10/10
cycbotponybackdoorcredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 7 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\b198ccf17826157030f93839b0073334_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b198ccf17826157030f93839b0073334_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1628
    • C:\Users\Admin\AppData\Local\Temp\b198ccf17826157030f93839b0073334_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\b198ccf17826157030f93839b0073334_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\2DF27\5FDA5.exe%C:\Users\Admin\AppData\Roaming\2DF27
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3032
    • C:\Users\Admin\AppData\Local\Temp\b198ccf17826157030f93839b0073334_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\b198ccf17826157030f93839b0073334_JaffaCakes118.exe startC:\Program Files (x86)\27ADC\lvvm.exe%C:\Program Files (x86)\27ADC
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1980
    • C:\Program Files (x86)\LP\A5B2\44DD.tmp
      "C:\Program Files (x86)\LP\A5B2\44DD.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1844
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2008
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

4
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Query Registry

2
T1012

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\2DF27\7ADC.DF2
    Filesize

    1KB

    MD5

    452e8c0fccf57b7ca71cd84b5e44f635

    SHA1

    f65ac46609cc3079142b73628b347f77b0d7d213

    SHA256

    2d4862f7740ff7d939e5f303a8a2aab0e6088e77f9bc113e80c26c4d5a471121

    SHA512

    c13d967585432e78885f3673b3c6e4e0696b4e202a08ccfbaadca16cf75c2ae7ba0a71ea57140b05025d008f81af378084a4743ebb701e210bbf15b71e2e4c3d

    Download Submit

  • C:\Users\Admin\AppData\Roaming\2DF27\7ADC.DF2
    Filesize

    600B

    MD5

    1d2abb398d22a66cf4c543baf4dd538a

    SHA1

    0148106ea32b6a9b25f6dd49b67c3439fb576deb

    SHA256

    1f5a4ce631c5b7947077c4925eb882145a4d9a837694dc987eff0a0555675835

    SHA512

    7063da28500498cc9741ef88d6d64ddab65091575afee0c45e98341dbd34ee6ca461a6aa113bd8224ada710aaf1ff512f3b432ba84bb071d2a20256556bab118

    Download Submit

  • C:\Users\Admin\AppData\Roaming\2DF27\7ADC.DF2
    Filesize

    996B

    MD5

    091f3d214d09bde08ea9ac91f3abdd39

    SHA1

    867dd797771e1d8697e161c741c59499362b97b6

    SHA256

    43a9cc2edd8c3449d431141c0e2c8dd00d25b7e1f4c0a40241d662c3688e752d

    SHA512

    7230c248da0ba839da245454a37ba169d719de33f9063e3bd4e8381fccb03d49541e94c7d6bd7df48ed30dcfae0dabc054c6483cc1d384f951fa76a94d6baf5b

    Download Submit

  • \Program Files (x86)\LP\A5B2\44DD.tmp
    Filesize

    96KB

    MD5

    abdf7c2a2de69f2f798043643ef01a8f

    SHA1

    1806ca9979a2e1e84584546c506065de5bf01fe9

    SHA256

    37e6fca8e1aa158e984074806f79b20e3b7885a199d54e97da3e463da764bff3

    SHA512

    7eb6ae4126f98054f32358e0bd8efbd11dbe5e712c4284372a92150da30bbec4ee1f102aa7241e1aa4821a29917c9531fc0f50f1703708bfffddb4714f209f5d

    Download Submit

  • memory/1628-15-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

    Download

  • memory/1628-16-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/1628-1-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

    Download

  • memory/1628-85-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/1628-2-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/1628-209-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/1628-212-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/1844-208-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/1980-83-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/1980-84-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/3032-14-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/3032-12-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download