Overview

overview

10

Static

static

3

JaffaCakes...0d.exe

windows7-x64

10

JaffaCakes...0d.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03-01-2025 01:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_694e30fb95d4727c0403006068cea70d.exe

  • Size

    655KB

  • MD5

    694e30fb95d4727c0403006068cea70d

  • SHA1

    359376ab071b7e89693e920123f52d753b5740af

  • SHA256

    2c6008eb20a41cbbeb24f0cc99d2b35c506a136dcea3c2bf9d7474a155609192

  • SHA512

    08d6cb21264b72d4ab5ede6faa40f81d75076d93ee383b34096352577ec5819949b18e4e1ddf2e0853d7cc4f81abb4f34d69ab86840283c734616e0785032206

  • SSDEEP

    12288:/ESqJwbBEE+tOi9c2xwlqXs4zUmvycM6xgNyJ6DsZuhEP60dIIFazZyun23:/EdYj+j9c21lz/VnxgAJxuOCciZzE

Score
10/10
cycbotponybackdoorcredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 3 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 14 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 53 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_694e30fb95d4727c0403006068cea70d.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_694e30fb95d4727c0403006068cea70d.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1636
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_694e30fb95d4727c0403006068cea70d.exe
      JaffaCakes118_694e30fb95d4727c0403006068cea70d.exe
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2276
      • C:\Users\Admin\R07924.exe
        C:\Users\Admin\R07924.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1660
        • C:\Users\Admin\loitoe.exe
          "C:\Users\Admin\loitoe.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:2260
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del R07924.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2200
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2680
      • C:\Users\Admin\aehost.exe
        C:\Users\Admin\aehost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2804
        • C:\Users\Admin\aehost.exe
          aehost.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:2720
      • C:\Users\Admin\behost.exe
        C:\Users\Admin\behost.exe
        3⤵
        • Modifies security service
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:2444
        • C:\Users\Admin\behost.exe
          C:\Users\Admin\behost.exe startC:\Users\Admin\AppData\Roaming\EE72C\ABED3.exe%C:\Users\Admin\AppData\Roaming\EE72C
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1324
        • C:\Users\Admin\behost.exe
          C:\Users\Admin\behost.exe startC:\Program Files (x86)\2C4BA\lvvm.exe%C:\Program Files (x86)\2C4BA
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2412
        • C:\Program Files (x86)\LP\D3AE\7031.tmp
          "C:\Program Files (x86)\LP\D3AE\7031.tmp"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1088
      • C:\Users\Admin\cehost.exe
        C:\Users\Admin\cehost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2824
        • C:\Windows\explorer.exe
          000000C0*
          4⤵
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2992
      • C:\Users\Admin\dehost.exe
        C:\Users\Admin\dehost.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:936
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del JaffaCakes118_694e30fb95d4727c0403006068cea70d.exe
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:3068
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1980
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1616
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Modify Registry

5
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Process Discovery

1
T1057

Query Registry

2
T1012

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\EE72C\C4BA.E72
    Filesize

    600B

    MD5

    7ad9aae3a7bef3964b197fb12263094c

    SHA1

    7fe2e72d89fe2c4a7e8cd8cdf98758a0d19b6ea6

    SHA256

    72d859b1d91a5df4effa127420a6eee17c2ac7e234bea0dc5521560127847f9a

    SHA512

    132c5afbcd7de84f0c738e0d8356b9107d6bc2fe50087ffccc373acb7b54f016d270a1537ec9fbdfc09a4cfea1f09f52297fced652910557358e0e84807f4b32

    Download Submit

  • C:\Users\Admin\AppData\Roaming\EE72C\C4BA.E72
    Filesize

    996B

    MD5

    c64dc77f02dda663cd86f000c8a2e868

    SHA1

    9eea89cfd63b34103387dedc754f0ed8fdfb0196

    SHA256

    327b15ce5e576c2ff5fda86f832d1183d314e21ec514817f02539f3c84254521

    SHA512

    92cbc8eb13088de7b28b42b2eb726d78e52540150dfb3f73f9c435cccb7e0215e4769967f66c00a6f278293d65591eeb26064e19a2a5c6c364a881abca13c383

    Download Submit

  • C:\Users\Admin\AppData\Roaming\EE72C\C4BA.E72
    Filesize

    1KB

    MD5

    e721d5dc89bfb5c8748f6c1f31ec07c9

    SHA1

    d8ea686ec9bef840ea2d3532bc2095d601ed501a

    SHA256

    74ba466c1e0c5e7e3dc5365e6e7e22ae2ed6fb0780d018b939d0d048d12b5f99

    SHA512

    70156f2341e9fd5f6fa7c7d55c650116bf78889e6e627b31a39b9d22cb1fa28c55e868cb81acf6bd6b531ad715f233e565df3eb2fee147e5fd55731b13840285

    Download Submit

  • C:\Users\Admin\AppData\Roaming\EE72C\C4BA.E72
    Filesize

    1KB

    MD5

    a4fc38947c51535b9bf51b47f90e6263

    SHA1

    6368bcc2cb6b9f9050265b880c12d1f5fa1c1798

    SHA256

    27d79334c221185ca27642c4011dd484a9ab47ba5cf2657223c1e4969772c2cc

    SHA512

    32cef93599025a212cb729d30d3ceee15bfc98472a2779f83c890cfbe224f958ba3d1f741f2fa9430689853a7e98673aea5108894ece600cb9b9a8f8293dc165

    Download Submit

  • C:\Users\Admin\behost.exe
    Filesize

    279KB

    MD5

    2a583120a51178ee5f8bc2727faaa73e

    SHA1

    91296d42eeddb285aeea28f5139cadda10f21df7

    SHA256

    b315e97fff3561563da4dcf7283636f42eef9ebaf422506e01f03716d4877b02

    SHA512

    003e11b916256091486311881a06286d532a9940d75977a44afa3c116277a0f490505e9b4053f56846fb6d1d7584d7748f622bc9cae088af93820452027dac8b

    Download Submit

  • \Program Files (x86)\LP\D3AE\7031.tmp
    Filesize

    104KB

    MD5

    0cb09d0443d2eda312058ae1a2fa83c2

    SHA1

    1888844fcab4269a5c08b5cf122b100e8abb3cb0

    SHA256

    50a9af2fe05dd06d6ff825bcf2106b64385e7fdf9a06a0a18ac187c4a057503a

    SHA512

    93bfdc4d14a7ba7cce25d0a83faa29e0efa7932f3024aa82fcc1d606cb9a65e0ebd91942ad9992ce787f639df1748fde9599cb9b676245a17a8198064df2e24c

    Download Submit

  • \Users\Admin\R07924.exe
    Filesize

    188KB

    MD5

    4f9c5823c5d1255ded151b01c0a58e15

    SHA1

    2f7018a9211472ddfa5d2f09629bf90adce4676c

    SHA256

    e38564871dc5952e2d1d22d51e312e3064cf84df95c0420021153cb5c264adcf

    SHA512

    b5518effbf476d9486a5ddaa65c937e97b10470d533f8e0c9af30956868c032f6bdb524d13a004e4a0d19e9a88b5f3f11ee82e5602b1175092fb36a9959d40ca

    Download Submit

  • \Users\Admin\aehost.exe
    Filesize

    129KB

    MD5

    e2b1704acdf48221cd9be91bae3546c5

    SHA1

    f53a59b62276f58cf8689768f747e16f53dbd341

    SHA256

    8b1c13bb2e95f71ed75d8fca7aeefc556ecd377d5d4f6c544d77ac8f74255ca5

    SHA512

    1b3d8baa981851a79c4f12f3ea2a4d197b3439e76ca723acd578acabd731310d6eeb3a4567a10d48f45192ae9c4cd732eca04c0a7fffa636e7bd364ed1357b53

    Download Submit

  • \Users\Admin\cehost.exe
    Filesize

    145KB

    MD5

    56be9270582de0986c72139ea218e121

    SHA1

    d33b8a2127ccf6b6f42a0c0f266136a376def18c

    SHA256

    8b40a882fde5ef3df2ec3112142b654c949adf7f559bc1912ad9d08ebb17c257

    SHA512

    dcee7d3d16e19e5a36a386d097c171ed7761ad4fc626b5d523b9c33f952fa24da733c56fcb8ff440894c3672c468d04cecc001ae9a680a9607347a5f517e6023

    Download Submit

  • \Users\Admin\dehost.exe
    Filesize

    24KB

    MD5

    7cda5863b933988b7bd1d0c8035dafd9

    SHA1

    68c64d655d0df1c9974587d12b3b88f5ce1f4cac

    SHA256

    400cb530f1489c46ada1dedc35b51cb53e8174f5cdda0d086ef593c135e0f216

    SHA512

    978440c09b70b695fdc171c6e2a7c064aa078d4a300db7f297afde5e3c1cfdf513da01dae967a9a8c524c185432ef87bf922a5cc97a9c8a6d1fd9cc3155e0aea

    Download Submit

  • \Users\Admin\loitoe.exe
    Filesize

    188KB

    MD5

    f42a14b88742331304f3370236e09b09

    SHA1

    9f59d16f7d2744639e64ab9f3647aa4d3d6a5fe4

    SHA256

    a14c143c34610515fa8c24d99bf63160f6289015b23267c2f13bc35839a04316

    SHA512

    99f16dadd5c0548c6b2fff1c50cddb4798b637f3f9965dacedaeb68e5127bbf627655ba46840cb822052e2f4bd8084db592534c4bbaeebcc20b8ffbc955a52b6

    Download Submit

  • memory/1324-133-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/1636-9-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

    Download

  • memory/1660-43-0x0000000003980000-0x000000000443A000-memory.dmp

    Filesize

    10.7MB

    Download

  • memory/2276-335-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

    Download

  • memory/2276-14-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

    Download

  • memory/2276-52-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

    Download

  • memory/2276-5-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

    Download

  • memory/2276-2-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

    Download

  • memory/2276-93-0x0000000000540000-0x0000000000582000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2276-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2276-3-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

    Download

  • memory/2276-0-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

    Download

  • memory/2276-11-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

    Download

  • memory/2276-92-0x0000000000540000-0x0000000000582000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2276-12-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

    Download

  • memory/2412-202-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/2444-138-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/2720-58-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2720-66-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2720-54-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2720-76-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2720-75-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2720-69-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2720-64-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2720-56-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2720-61-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2804-73-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/2824-95-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2824-100-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2992-111-0x0000000001F10000-0x0000000001F29000-memory.dmp

    Filesize

    100KB

    Download

  • memory/2992-97-0x00000000000F0000-0x0000000000105000-memory.dmp

    Filesize

    84KB

    Download

  • memory/2992-101-0x0000000001F10000-0x0000000001F29000-memory.dmp

    Filesize

    100KB

    Download

  • memory/2992-106-0x0000000001F10000-0x0000000001F29000-memory.dmp

    Filesize

    100KB

    Download