Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02-12-2024 02:30
General
-
Target
b65c44a2a36ab4db0076028459ab88a5_JaffaCakes118.exe
-
Size
278KB
-
MD5
b65c44a2a36ab4db0076028459ab88a5
-
SHA1
5c3c48ac9cd2393c48f9f69bca0a9d6afd94c74e
-
SHA256
b253a2f90c14b8179108ae3fb95c45b4b8f182018305b4ef2d13d29150a02f1a
-
SHA512
09ac7bee4c7e9e346673a4c2fb3fc5a11fecc9f0ea915b5465393a8b4f30a49b13aa402a0be00103c0b9642e21204c4bfefd191b86a79ead7b0971c8d899774a
-
SSDEEP
6144:cWADC/vlryv64mSmW6yI6eOoq5UO1jQqRcm29I2oeVunDWAs:cVIrS9mZ3X6VoOUOXZ29srDW
Malware Config
Signatures
-
Cycbot
Cycbot is a backdoor and trojan written in C++..
-
Cycbot family
-
Detects Cycbot payload 7 IoCs
Cycbot is a backdoor and trojan written in C++.
-
Modifies security service 2 TTPs 1 IoCs
-
Pony family
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 15 IoCs
-
Suspicious use of FindShellTrayWindow 28 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b65c44a2a36ab4db0076028459ab88a5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b65c44a2a36ab4db0076028459ab88a5_JaffaCakes118.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\b65c44a2a36ab4db0076028459ab88a5_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b65c44a2a36ab4db0076028459ab88a5_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\28DBC\D117E.exe%C:\Users\Admin\AppData\Roaming\28DBC2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\b65c44a2a36ab4db0076028459ab88a5_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b65c44a2a36ab4db0076028459ab88a5_JaffaCakes118.exe startC:\Program Files (x86)\BC327\lvvm.exe%C:\Program Files (x86)\BC3272⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\LP\7E62\4BDF.tmp"C:\Program Files (x86)\LP\7E62\4BDF.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58b21c0f8b42243a0a86b7dca27d555a5
SHA11c5fc50cb2b70d610532e6aaee7769d2dfa8d67a
SHA256452f98cffb5bf2f09da42e5d1c9719e5914016cbac7353c3f2c321ca79157ea3
SHA5126854923575f9b9893948ee18e4330ebd537a6799e3fc034fc79f927fee7ae7798bac3fb456e796c6138aef6837af31882c0d6278629b7ba2ea5093811342d6db
-
Filesize
600B
MD59782b09b0ccfef3f2b211e32d2487124
SHA16148addb1219a89d1c0258763e923b515f3ea2b8
SHA2562826827a2f61cc2511087955f2202d2182b9a9d7a6424c7426b1fe6f69781f51
SHA512e2ad621e7e0e94ae195f14d8cd92ca354e16e9b554b175d8ac6c5c85dc4c70d4a66bcf0de755940e0ca1f3daacb2e71e3cff5f4daa00b8a7de48a54a035b897d
-
Filesize
996B
MD5689653aa0ba2950270e8a21ca57b6f33
SHA13695aad47f5dcf20c7d000d66939a505c871235c
SHA2566df053d5988b0c56209fd14cc9aabaadc61b22edb9723661ac39a691907a7668
SHA512f34a3d94fee3490da043d239d0c73250937e4fd195f8431cfc69c5ef734eaeb3d919553882015b0783b60499eb6fd3b81fa3585865f899c6955409ebc767924a
-
Filesize
99KB
MD508a5937a576b475126ca81d436937a26
SHA10511a1e2596ab2ab23d032c2883c3380fdcc9878
SHA256e74db8ec9e61cb575458a11f2c8e750347a3f50f2e3a0153a7e191ef64923519
SHA512e1da5dbf78aef5ff60d6d6b3961cce297bb0bf96aa51d1f115be1c31110684ecac8585f69c4f1124d712b65b718da0374dc859884fb595d3a9835617bbde8a25
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
112KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB