Analysis

  • max time kernel
    140s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-01-2025 05:01

General

  • Target

    JaffaCakes118_62cf181fb2fd82475dafafd74539ebf1.exe

  • Size

    174KB

  • MD5

    62cf181fb2fd82475dafafd74539ebf1

  • SHA1

    332e45941b06e60f42a8d2a08cb833d275277abe

  • SHA256

    35a887f5eb0904c6b397dfedd868ad7fa436b864d1185fd376b9155ce1874696

  • SHA512

    e259aa2b1eca2bda64a25f5036662eed2c446d004ae49d83cf77802f8a6cca27c17bb222cb602b8bd21314e9d0cc224e95b887e52525f3ae10a60dbc8d73c8e4

  • SSDEEP

    3072:8EZevKD5vXDrqYlhqs+5YM7CEdaPWRfsg3rJVIu0TOsKWX1:wKD5fDrqOhqsnEdBfv9V/0TOsKW

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

  • Cycbot family
  • Detects Cycbot payload 5 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62cf181fb2fd82475dafafd74539ebf1.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62cf181fb2fd82475dafafd74539ebf1.exe"
    1⤵
    • Modifies WinLogon for persistence
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1816
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62cf181fb2fd82475dafafd74539ebf1.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62cf181fb2fd82475dafafd74539ebf1.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3248
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62cf181fb2fd82475dafafd74539ebf1.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62cf181fb2fd82475dafafd74539ebf1.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3032

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\8926.B09

    Filesize

    1KB

    MD5

    064c07860ce1b2370bfaa08d5407ecd5

    SHA1

    bb81bd02ce58decdcbd5732ae7303ab674e91f7d

    SHA256

    c37f6c5d8022ad976ae8746f0ce7de50692179de055ba82eacd9d48f0ade2bb8

    SHA512

    f123e6ead5e194b20647e2ac7723e3424cd00e3d8ca874176e3fffeaa729b62b6b766400e564c9e41978237ac7c6c0dc2a7e7e7c7415a705fed0d00e06548f91

  • C:\Users\Admin\AppData\Roaming\8926.B09

    Filesize

    600B

    MD5

    d286fcfd61e1453cec2d205534191e94

    SHA1

    268025b014a3f4115459c24cd1ac98c279ee833d

    SHA256

    6bad906a6adaaccb760db1dfc62b2023087ab335934f725f6dcd49c0d0b5b767

    SHA512

    0c5fb721821263510e9c39ded79b9b6f6fca0bf3b3d87417b4e49394da29af3135192ee822e96dc78782e7dc3c7fca08742ca09150b9cbf53d206c0e7f41ddab

  • C:\Users\Admin\AppData\Roaming\8926.B09

    Filesize

    996B

    MD5

    947b908dc4f9f4c8b7b9a6cef5398fb6

    SHA1

    042e134c657ae543c9b1dd7d6a8e170e00ddc322

    SHA256

    192b245c835440912863ca38f7eed67051648be24d54e08dd3b6c7e638340d1e

    SHA512

    9c9d003d21c28bec044e26fc11d4c8187406ad9c8a5e81b51c636588f2e2b5951cb6db7271872765c1f2f079def067325b4db9eee360591f92a42cbec42fd12f

  • memory/1816-1-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB

  • memory/1816-2-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB

  • memory/1816-14-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB

  • memory/1816-72-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB

  • memory/1816-188-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB

  • memory/3032-74-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB

  • memory/3032-76-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB

  • memory/3248-13-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB