Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-12-2024 06:02
Static task
static1
Behavioral task
behavioral1
Sample
ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe
-
Size
175KB
-
MD5
ea3b9249a3ba39f80ce970035fd29b6e
-
SHA1
ce74a66ddbb12215633684c89b8f8953b162d6fe
-
SHA256
2c5ce95aeacb3e801b028f20d29e38cc37f743e9510277c96a7a9bd59e6e1135
-
SHA512
b8a3340e24eb7a686e510d9cb5734e86a4b11e27892bef1f5cd9c9db6dd75ef06fe5fcd360a8c5aac71762f5c32e83ebfda964acf48bba8c4af9bc534d08b558
-
SSDEEP
3072:08pm73ZaCPVzYDHn6eXy5n0GrY7ANMFfNnRgs/M4/m+iNVvzxmJrY+zuHbKJlUtV:V0ZeHS50GqfpRRU9+A6IK8t6Vb
Malware Config
Signatures
-
Cycbot family
-
Detects Cycbot payload 6 IoCs
Cycbot is a backdoor and trojan written in C++.
resource yara_rule behavioral2/memory/2768-17-0x0000000000400000-0x0000000000446000-memory.dmp family_cycbot behavioral2/memory/2768-18-0x0000000000400000-0x0000000000446000-memory.dmp family_cycbot behavioral2/memory/4732-20-0x0000000000400000-0x0000000000446000-memory.dmp family_cycbot behavioral2/memory/4732-77-0x0000000000400000-0x0000000000446000-memory.dmp family_cycbot behavioral2/memory/4756-81-0x0000000000400000-0x0000000000446000-memory.dmp family_cycbot behavioral2/memory/4732-177-0x0000000000400000-0x0000000000446000-memory.dmp family_cycbot -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe" ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/4732-2-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2768-17-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2768-18-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4732-20-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4732-77-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4756-79-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4756-81-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4732-177-0x0000000000400000-0x0000000000446000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4732 wrote to memory of 2768 4732 ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe 82 PID 4732 wrote to memory of 2768 4732 ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe 82 PID 4732 wrote to memory of 2768 4732 ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe 82 PID 4732 wrote to memory of 4756 4732 ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe 88 PID 4732 wrote to memory of 4756 4732 ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe 88 PID 4732 wrote to memory of 4756 4732 ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming2⤵
- System Location Discovery: System Language Discovery
PID:2768
-
-
C:\Users\Admin\AppData\Local\Temp\ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp2⤵
- System Location Discovery: System Language Discovery
PID:4756
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
597B
MD5d17ec9963a5825ded0e21067250c8c2e
SHA16719833080b6aab72a89a247f9d8efab9d7123a4
SHA25625030ef6ab033abc2368828717a329ee2720bb788e881136c7ef0a8ad8c51921
SHA5121926bfc62f707b6e5eb8ad43b66597b05f8fce11aebb2e3d495a1bb36becddf36c46ed0e17159cef23e18990af304699eecb088c82065fa85816cce6cfd1d682
-
Filesize
1KB
MD5e318b0dd7c8066fe30d0b73f4e96f493
SHA100e033e57e1925453bea3de9aae1a9cafb176532
SHA25605029d0c5c8ccdafb050c3125c9e20bd1b6b2234e69830644f4ece6f72d1dcae
SHA512feabf4c4415138b234bd0e6136a95ddc8e4f26b3d82848bb7c6fa53d0a29295ad8fcfd693d39ac0e99948c125b047cabcbbe3b003fc1ddcda276443bece7d8b1
-
Filesize
897B
MD5d268d676f9a91f83fe90b1a4bd1f6a87
SHA14bb5ffacc34618b42e73d087533b57d49232bcb2
SHA256cbed13717aad0ce1ff1f1445abcc0ab407fcd62b77f36a48799b9d9264bcda4b
SHA5123b82ce6daa955931a3eaf4be2e450d62883c2ace5d6f976b3d5beaaa3208c6e9b5a80c8184bb2c3d1b9e6d4cd416808985f0a3d9dca92ecc26ee55168602ac3b
-
Filesize
1KB
MD507f45e3e006c3224850ddd66dbbb7cc5
SHA1b23be0ef449d64e746b01ae050de4433ac7cdeb1
SHA25662957b97a9a99f8f1cdd35c0ce47095e2714d605149c82094d64b5a927c1ec97
SHA5128f9a2168d39e9edf444d4e1492c8eb2579757b6c58cc9e749ecad8bf08a6d52f87ca5100271175ddc43420a5c024186bc74d2ef86340fb3a6d4796703ca4b7e0