Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
07-12-2024 04:09
General
-
Target
d096ee783772e6d9b03cf9937fad1673_JaffaCakes118.exe
-
Size
279KB
-
MD5
d096ee783772e6d9b03cf9937fad1673
-
SHA1
63c785faff0940313971eea23f06e59b845668a6
-
SHA256
8dbd7313ccca75f76f9b180f1a0285af37d160b26d0cf60d90c541315a473549
-
SHA512
67ee1601afa10f9e62d23ec8f46cfab36fd3b9846a1823c558dfd1d7e2b2a21c1a850d047adc76b7a8c721ed60daa21e36b27b93c87bde912d93047b5e271d14
-
SSDEEP
6144:mLFmrTgnaZioBLy1hTH6Tzs/QccXMahBuB1O4jbnRWwtbC:mL0wmBPs6XiBgun1
Malware Config
Signatures
-
Cycbot
Cycbot is a backdoor and trojan written in C++..
-
Cycbot family
-
Detects Cycbot payload 7 IoCs
Cycbot is a backdoor and trojan written in C++.
-
Modifies security service 2 TTPs 1 IoCs
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 15 IoCs
-
Suspicious use of FindShellTrayWindow 28 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d096ee783772e6d9b03cf9937fad1673_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d096ee783772e6d9b03cf9937fad1673_JaffaCakes118.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d096ee783772e6d9b03cf9937fad1673_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d096ee783772e6d9b03cf9937fad1673_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\00A23\E0FF9.exe%C:\Users\Admin\AppData\Roaming\00A232⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\d096ee783772e6d9b03cf9937fad1673_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d096ee783772e6d9b03cf9937fad1673_JaffaCakes118.exe startC:\Program Files (x86)\233C4\lvvm.exe%C:\Program Files (x86)\233C42⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\LP\F920\977F.tmp"C:\Program Files (x86)\LP\F920\977F.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
996B
MD572a3c20bb57e80244c71cb3aa4acafa3
SHA171db39e5f0337f22f3a83978f744335c1c0a438d
SHA2563cbfe579052c4a3e51cccc27e85bec6bb9c4bc3a45ebcd72ababe1b21772040b
SHA512828ebb38069d0e29707508a2b1b1ca4ab5d8cb3b543305855df38b6e26a3295469f64826a2567b9e413e82ff293d209d8f1b103b06c3b0f73697074509b76a89
-
Filesize
1KB
MD52b88010fab89a5f25a0e0210f933fdbc
SHA1be8c647a41bc915d12afc7bab25c41aea3204556
SHA256c1f96f0e8d2416315682891d2e987140dc0b2e48eba3e45d4bc43aadf480fe59
SHA5123bd6fba6ab9ccf208ee4b3820550d75e687344884b89c88bfbfef007d2536468c3c12b087df72b50c83536d133590ca0edecb4661c6273424a7241afafbfb28c
-
Filesize
1KB
MD5503a80efb672b45785ed5cb099b4370e
SHA1573c11d867d5df8df09b0dcc5ac4021e3816e882
SHA256e0bb971177dc347dd82d1ca2168af57fdf2b7eb4b88c0c07764011e929c15784
SHA51279ee269510165dc4c947796f1a3d03b05b1be78ba36c3a179c89b0aa71cbfb3e112c38c1a22b6a7afa144bbb8885b4d854500b07286975bd958966d7d70e394c
-
Filesize
600B
MD51f4cc2818cc3e055ba684f419c71fe08
SHA124155c82d231093c876a3c53299319041d50a84a
SHA256d3728939c70c5995dd3bf228f86cd027690a816f513f1ed0c5677b832b5e70c0
SHA51262d9dbff42164ff37c1ad5d1682f27ead0fb94d84b28274b192200432e06538049326958222945629a71849ae9e711cf0bf0d2062657e8b1d28d19bd45176f3e
-
Filesize
300B
MD56d13f89c72a0b1652f5151883a3b4401
SHA15b3ede56ac0dae299aa87e2b5ea3f9d9c4803487
SHA2562173022b8d3b627108b1a931ef6ac6ee85d3dae111d27713aa2730daca81a511
SHA512461c4e61e8f1adf8b02cc0389573d7f28bf79970e1bd195ec62cde77436d063f4565b246dd3e24a4e66d63bf35e5dbcb9ace69d1f1ab72c6a51b81a3017f5008
-
Filesize
98KB
MD53077916ac605a3afcbc45302868e143e
SHA1813cf55c52114b81d0168b81653ba675d059f281
SHA2568a84aa4b6d33d95679f210d9866f63a1b9dd66a87d0be40feb4ce255379358d3
SHA512b40ad6e084c03eef7b6510d71ca50b26420116c6a4c3957280fef6c2a81de921eb7b26beb0bdbeecbeb3b96da1b1227bfe424622ff9300f4f47eb638f6efe028
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
412KB
-
Filesize
424KB
-
Filesize
412KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
108KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB