Overview

overview

10

Static

static

3

JaffaCakes...50.exe

windows7-x64

10

JaffaCakes...50.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    01-01-2025 13:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_57c5deca4b2e9dca6f2e37c59983b150.exe

  • Size

    808KB

  • MD5

    57c5deca4b2e9dca6f2e37c59983b150

  • SHA1

    4d2f55cf77ecd6851747f7cc730876e4c06e0e26

  • SHA256

    5eea185811d3ff23b7f3ddf213e651856cbf0d70e23faf6c8e7837ed31162540

  • SHA512

    2b368fe7c778a6fd596fe1dfb4775a9cf09077db5426515dcd95c544d72b3fb9568ca3a22c12ad711eec445277bd4d184b30efe5a8b7252a9e1025e8c5506a4b

  • SSDEEP

    12288:kcyDz+j8zC/POs/RszSpabbs3JYNpYEzw8kY47hW6DgyPg7VjfAiABU:kc2+ms5pavs+NpM9nXg79CU

Score
10/10
cycbotponybackdoorcredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 6 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 16 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unexpected DNS network traffic destination 5 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 54 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\csrss.exe
    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
    1⤵
    • Executes dropped EXE
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:332
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies WinLogon for persistence
    PID:1280
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_57c5deca4b2e9dca6f2e37c59983b150.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_57c5deca4b2e9dca6f2e37c59983b150.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2792
      • C:\Users\Admin\x276Ht.exe
        C:\Users\Admin\x276Ht.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2928
        • C:\Users\Admin\hsveiq.exe
          "C:\Users\Admin\hsveiq.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:2920
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del x276Ht.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:636
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2196
      • C:\Users\Admin\2xiv.exe
        C:\Users\Admin\2xiv.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2852
        • C:\Users\Admin\2xiv.exe
          "C:\Users\Admin\2xiv.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1208
      • C:\Users\Admin\3xiv.exe
        C:\Users\Admin\3xiv.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:2208
        • C:\Users\Admin\3xiv.exe
          C:\Users\Admin\3xiv.exe startC:\Users\Admin\AppData\Roaming\BD219\B080A.exe%C:\Users\Admin\AppData\Roaming\BD219
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2416
        • C:\Users\Admin\3xiv.exe
          C:\Users\Admin\3xiv.exe startC:\Program Files (x86)\199B4\lvvm.exe%C:\Program Files (x86)\199B4
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1932
        • C:\Program Files (x86)\LP\0AFB\FAF2.tmp
          "C:\Program Files (x86)\LP\0AFB\FAF2.tmp"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2756
      • C:\Users\Admin\4xiv.exe
        C:\Users\Admin\4xiv.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2952
        • C:\Users\Admin\AppData\Local\d9d1177c\X
          *0*bc*a908ea86*31.193.3.240:53
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1756
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1652
      • C:\Users\Admin\5xiv.exe
        C:\Users\Admin\5xiv.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2016
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del JaffaCakes118_57c5deca4b2e9dca6f2e37c59983b150.exe
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:836
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1692
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2372
  • C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
    1⤵
      PID:568
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2844
    • C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
      1⤵
        PID:2400

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      3
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      1
      T1547.004

      Privilege Escalation

      Boot or Logon Autostart Execution

      3
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      1
      T1547.004

      Defense Evasion

      Hide Artifacts

      1
      T1564

      Hidden Files and Directories

      1
      T1564.001

      Modify Registry

      5
      T1112

      Credential Access

      Credentials from Password Stores

      1
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Unsecured Credentials

      3
      T1552

      Credentials In Files

      3
      T1552.001

      Discovery

      Process Discovery

      1
      T1057

      Query Registry

      2
      T1012

      System Information Discovery

      1
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Collection

      Data from Local System

      2
      T1005

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\3xiv.exe
        Filesize

        287KB

        MD5

        3d6f651187a05dfab030fd923b218279

        SHA1

        9d0fff6e4d22777a9f3b7c57baea9f34151eca65

        SHA256

        b0c28bc12dc7dfe527283d315605e01f8a3b282f1e877a3bcf78b3ca35f72f3e

        SHA512

        835cc4eb247e6bdaefef37546922c902a448eb9de32432f59c0b7a9c524a07abfa10d23ad3fd5f3d8897e821f95d73849b5ef8053ace3d480d76720e7d10acbd

        Download Submit

      • C:\Users\Admin\AppData\Roaming\BD219\99B4.D21
        Filesize

        600B

        MD5

        049e08a3d163f570645170dcdd4beefa

        SHA1

        ccdbfd06bc7ed9c547e7f4aee8389e7756d7f6b4

        SHA256

        22fe68563f26a5cd55e170b631d8367bafd083e575940447b1da96add68b3ce9

        SHA512

        872cd8db931e18472cf6c7abab60ba95ff06ca51b2432d75079a9ea10efb107b45da052b366d14b0117179777e3a5943a36530020b1c14a40f9c121ff760fba6

        Download Submit

      • C:\Users\Admin\AppData\Roaming\BD219\99B4.D21
        Filesize

        996B

        MD5

        4b9dfb6e286f7d680addf2330727ede0

        SHA1

        92b381d0343cf2cbb403e6b629bb6b8c9a8e6499

        SHA256

        9a0cf49bdcc5961ba48a690cdd1feecd7be60f4377999f1112a6a9663cf7cc8f

        SHA512

        9b1c092861818b5ea64c2e4185caa6630eb3d708a7ef1c12072905b151e2ebb5b39efeeb8f737829cd7197bf0c4dc331110015f6e6dec771d5f53bfc73260ac4

        Download Submit

      • C:\Users\Admin\AppData\Roaming\BD219\99B4.D21
        Filesize

        1KB

        MD5

        62c546b61911374b54a5ff45dc6dbf20

        SHA1

        ec29cd9ccc0c001f68f6c2ac135626f60ae8f118

        SHA256

        38a7d629ff7b771a406e1a467a88da28649fccd901a762dc653331288735ff2b

        SHA512

        7bb8981393e8c3b761620ae4a96e75b7cc0b51b9c5851c4f2be9b9ddabdd7ee3e1bc686d4469d261d851eef72206a81360109fce3a1fcf95cc211334c85efec9

        Download Submit

      • \Program Files (x86)\LP\0AFB\FAF2.tmp
        Filesize

        101KB

        MD5

        8ddb300fe82a1e8ab0b0c9b704725316

        SHA1

        899ef3abfa492136996ccffd0958e0c607817835

        SHA256

        86725431a4d0a9b52b5be71853baac7bc228b5ce92443e758a376ef7e7cbac5f

        SHA512

        3a13663e34a65a6f255c973aeb4c2534adc386135d401b7274fd958c753e29116dc85f6736481593d8cdf7459dc65aa926de7d5b3a67db983730e36db146b321

        Download Submit

      • \Users\Admin\2xiv.exe
        Filesize

        64KB

        MD5

        930ddf5711ff276332bc5e1eec8cded0

        SHA1

        e14b2bdd272fe546c043ab7a2f249955e1820744

        SHA256

        4ee9b7d064b411cbde34bb286e46d1d99112efe5f928420b4dc11a66d9b6839d

        SHA512

        3ca938a3bd51168445a50b4f823feb9db2eee5d7828e32cc90be64275b2702e8c3eba0cf8a4e9d5b1b7a17a4df8b7c627315a140bcd2f47e2b78e5e220ae4f6d

        Download Submit

      • \Users\Admin\4xiv.exe
        Filesize

        265KB

        MD5

        45cba518c7a8b41f65690da873e13e3d

        SHA1

        5a787a1f7f7bdd22c72b0f9d26818d902b65da8b

        SHA256

        c31f65ef14f409c290bb661077f8473bf0a2de47e08d0256c1f086556b50ab79

        SHA512

        7515485b6d9e90cf4dd00b076c4173f19adffe0215d95edadd4ceb61b46a06c3751aa524c70a3cac738b751bc73802877ef2d16a44b5cc0399c3e85b704249f7

        Download Submit

      • \Users\Admin\5xiv.exe
        Filesize

        44KB

        MD5

        fd4f97e710556c5769ab1e074a5c02b5

        SHA1

        eaac335c1dd2cd449f4d3b4f9b5cdad0cffa6d61

        SHA256

        7cf1fcac1a66a68e71346d784a0fe68aca36f15425c3c44a9a6eb60241617e18

        SHA512

        6f01d7a97497d245cf4144fac30cd169435ad51ea432adf2469e822773c529ff08daf0ffdca80c1aab607490b9f8f7cd06e08f6219c0065b58a773d42c159726

        Download Submit

      • \Users\Admin\AppData\Local\d9d1177c\X
        Filesize

        38KB

        MD5

        72de2dadaf875e2fd7614e100419033c

        SHA1

        5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

        SHA256

        c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

        SHA512

        e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

        Download Submit

      • \Users\Admin\hsveiq.exe
        Filesize

        332KB

        MD5

        558663fa23ea16533078f5e699a8a8e5

        SHA1

        6583fdd5c3d8464ad386ffa85f4615ec31d1cedc

        SHA256

        cff383a4669a6fd493f700afefa65701c15e26d4566d4aa8e3d5a2517889b8a4

        SHA512

        bccddbdf83ee78026d12300a52e9c26d29151180a853f02c83345a92e532ea064a5006d766d14f1ca26c8ec7af1b59998f46b148c37cf164494e2f1a574be365

        Download Submit

      • \Users\Admin\x276Ht.exe
        Filesize

        332KB

        MD5

        ad27bc021625bc7692f942a626b3a576

        SHA1

        12d961ecb68e63c2cf3c3590da311a9bd5e521f7

        SHA256

        39c408d03296d3639563dfb51ee977fb508fc9fd4d005e6cad8551ea3f2f4fb0

        SHA512

        2c51d8fe3cc5d2eb50d7cc5faf76f8b1d35380eb078409b1fa24caa9ca719d3b447d0669f07138330d360471a06bbc1dcca5e7a2eb81179af164a87a9f6b74bb

        Download Submit

      • \Windows\System32\consrv.dll
        Filesize

        29KB

        MD5

        76f2ad6212981964aeea83926e5ffdd7

        SHA1

        8f016ab22ce1338507218f713166c5c169eee65e

        SHA256

        0b2de0f2219abcf8c5bd580b5b46777eb41290bf5d4b4225b4fd65e56cd99e08

        SHA512

        e650275cf11752d12c89aa189270627e54b7b5f55b6f9261aa4e25eafc073374ae9bbae2a380338a81ee07c4aaa0ee3608a45c118fccae1c382f99554b26a91f

        Download Submit

      • \systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}
        Filesize

        2KB

        MD5

        c524bff734708f158344d28186fe27fb

        SHA1

        55fc6b5336c61abcdd69daf08af99448242c1057

        SHA256

        8bc07ca83110d0bcaad3dc942877ffa9b0254d5fd8c881109faaf9536aa673a9

        SHA512

        004138e6f0cb61a9d30a8783195bf0dedc4ee6a30f434a5d481e0001e9af97199ac1481527c13e4511e32887a96a73ba58fdf07188e3a67bc14e52b943eb31ee

        Download Submit

      • memory/332-85-0x0000000002170000-0x000000000217B000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1208-50-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/1208-43-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/1208-41-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/1208-39-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/1208-48-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/1208-49-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/1208-51-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/1208-45-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1208-46-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/1280-99-0x0000000002AE0000-0x0000000002AEB000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1280-94-0x0000000002AE0000-0x0000000002AEB000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1280-103-0x0000000002AF0000-0x0000000002AFB000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1280-102-0x0000000002AE0000-0x0000000002AEB000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1280-76-0x0000000002220000-0x0000000002226000-memory.dmp

        Filesize

        24KB

        Download

      • memory/1280-72-0x0000000002220000-0x0000000002226000-memory.dmp

        Filesize

        24KB

        Download

      • memory/1280-80-0x0000000002220000-0x0000000002226000-memory.dmp

        Filesize

        24KB

        Download

      • memory/1280-227-0x0000000002200000-0x0000000002201000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1280-228-0x0000000002AF0000-0x0000000002AFB000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1932-232-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/2208-300-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/2208-125-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/2208-437-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/2208-107-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/2416-120-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/2756-438-0x0000000000400000-0x000000000041D000-memory.dmp

        Filesize

        116KB

        Download

      • memory/2792-442-0x0000000002B50000-0x000000000360A000-memory.dmp

        Filesize

        10.7MB

        Download

      • memory/2928-27-0x0000000003010000-0x0000000003ACA000-memory.dmp

        Filesize

        10.7MB

        Download

      • memory/2952-288-0x0000000030670000-0x00000000306BF000-memory.dmp

        Filesize

        316KB

        Download

      • memory/2952-121-0x0000000030670000-0x00000000306BF000-memory.dmp

        Filesize

        316KB

        Download