Analysis
- max time kernel
140s - max time network
122s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
- submitted
14/12/2024, 22:10
General
- Target f0f0d787dc559f8fc5b11507f8e58677_JaffaCakes118.exe
- Size 283KB
- Sample241214-13h11awkds
- SHA256 4cbcfef8e11b00d2fbf32d6f1a47055d0ba0ef59b11409a1545e27bff375769a
Malware Config
Signatures
- Cycbot
Cycbot is a backdoor and trojan written in C++..
- Cycbot family
- Detects Cycbot payload 8 IoCs
Cycbot is a backdoor and trojan written in C++.
- Modifies security service 2 TTPs 1 IoCs
- Pony family
- Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Disables taskbar notifications via registry modification
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 5 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 15 IoCs
- Suspicious use of FindShellTrayWindow 28 IoCs
- Suspicious use of SendNotifyMessage 22 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- System policy modification 1 TTPs 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0f0d787dc559f8fc5b11507f8e58677_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f0f0d787dc559f8fc5b11507f8e58677_JaffaCakes118.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f0f0d787dc559f8fc5b11507f8e58677_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f0f0d787dc559f8fc5b11507f8e58677_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\676D4\BE40F.exe%C:\Users\Admin\AppData\Roaming\676D42⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\f0f0d787dc559f8fc5b11507f8e58677_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f0f0d787dc559f8fc5b11507f8e58677_JaffaCakes118.exe startC:\Program Files (x86)\D4935\lvvm.exe%C:\Program Files (x86)\D49352⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\LP\0FD6\6623.tmp"C:\Program Files (x86)\LP\0FD6\6623.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
4935.76D
4935.76D
4935.76D
6623.tmp
memory/2084-16-0x0000000000400000-0x000000000046B000-memory.dmp
memory/2084-15-0x0000000000400000-0x000000000046B000-memory.dmp
memory/2084-13-0x0000000000400000-0x000000000046B000-memory.dmp
memory/2204-197-0x0000000000400000-0x000000000041C000-memory.dmp
memory/2308-14-0x0000000000400000-0x0000000000468000-memory.dmp
memory/2308-1-0x0000000000400000-0x0000000000468000-memory.dmp
memory/2308-82-0x0000000000400000-0x000000000046B000-memory.dmp
memory/2308-11-0x0000000000400000-0x000000000046B000-memory.dmp
memory/2308-2-0x0000000000400000-0x000000000046B000-memory.dmp
memory/2308-198-0x0000000000400000-0x000000000046B000-memory.dmp
memory/2308-201-0x0000000000400000-0x000000000046B000-memory.dmp
memory/2656-84-0x0000000000400000-0x000000000046B000-memory.dmp