Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
08-12-2024 04:04
General
-
Target
d5284ab1af003d9f2a34c1279c06dafe_JaffaCakes118.exe
-
Size
172KB
-
MD5
d5284ab1af003d9f2a34c1279c06dafe
-
SHA1
633ec406ffaccf21a94d9e13200106d8a19a7658
-
SHA256
42eafbd6c7be0dca12e0dbb2691010c9570983846e046f0617be49710b12ed8e
-
SHA512
c70d427b21557832e4705eece34a7aa6b9e091b5b575b883bd954c0263de61cde4a5f3cc11e2c2f5c431bfc405e777afb3fdb58c3a9c77d25031e7e5b6802db5
-
SSDEEP
3072:fYynmP47+9WXyb2R7eO9Y1n9Oc9s/i5a4WgDRVYTV5bBc+dMOb95:hk0iesnkce/i+gDITV5bPdRb95
Malware Config
Signatures
-
Cycbot
Cycbot is a backdoor and trojan written in C++..
-
Cycbot family
-
Detects Cycbot payload 5 IoCs
Cycbot is a backdoor and trojan written in C++.
-
Modifies security service 2 TTPs 1 IoCs
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of FindShellTrayWindow 28 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5284ab1af003d9f2a34c1279c06dafe_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d5284ab1af003d9f2a34c1279c06dafe_JaffaCakes118.exe"1⤵
- Modifies security service
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d5284ab1af003d9f2a34c1279c06dafe_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d5284ab1af003d9f2a34c1279c06dafe_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\0D92A\48ED3.exe%C:\Users\Admin\AppData\Roaming\0D92A2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\d5284ab1af003d9f2a34c1279c06dafe_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d5284ab1af003d9f2a34c1279c06dafe_JaffaCakes118.exe startC:\Program Files (x86)\2A500\lvvm.exe%C:\Program Files (x86)\2A5002⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD536d1e551610f7973167d5797e9667c5b
SHA1f85f7b266d407a7926acc20802f677f90dd004be
SHA256d45026c59c64e23ba670a58cfc86c978687b53ff7930a95cfaf4b18a7ef5127b
SHA5127d2d6b420949ef50b2bff1371344c2930218a104ca1570c023b6146363219f87d5fd4d607573f20c9212a71bc716a236541aa850999dda4763b450daed7e2913
-
Filesize
600B
MD5113ce04601ce98babc2be8995bf46011
SHA16501a08e8f8b9b83070d81bc79530f504565fa36
SHA256da2274ebf35f36996ac241da69fdf5d2dbaee07efa89acc395c3bf7b9127ce15
SHA51255d2bd3c14ac47112d1ada65f3e47bae038c98c13448db8c3fa3241616c5858a712fee3151a901c547c287a511bcda7cf7f1fe165d494d9618e3e644282b69a3
-
Filesize
996B
MD5989657eee9f50c3fbeb9326f7bbd6185
SHA104b80329db2c7a95d0516d371d2c30112c9811e1
SHA256981c04590687fb4ec258f9f064219ed9c38244b9a82dc132b56ffb7c60443c13
SHA5129a9cfe2e72c991f1606cd3bdac876b61506c488b4f4f72d19c583044cfa4a405e426ec160f459e2973b38fa3333cc2e5c073dd4536ca392d576750c4515dfc26
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB