Overview

overview

10

Static

static

3

JaffaCakes...e1.exe

windows7-x64

10

JaffaCakes...e1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04-01-2025 04:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_7784fe587f786892f8df93f0056eade1.exe

  • Size

    808KB

  • MD5

    7784fe587f786892f8df93f0056eade1

  • SHA1

    8f60e7f8250dd2b5ddd04465f903645fa625ce27

  • SHA256

    cc2915d3d4526f27a801f573dbf06b6148367af615eda80f0ef73b8b913dfff4

  • SHA512

    69cf4f223aab358839eb0c8db828aba6e95fe1c8aacaa99138b35c34dd31973078d45f26af082895b1ccf2435bea8cd03018ee083bf71e3c61672dea4099e440

  • SSDEEP

    12288:lcyDz+j8zC/POs/RszSpabbs3JYNpYEzw8kY47hW6DgyPg7VjfAiABU:lc2+ms5pavs+NpM9nXg79CU

Score
10/10
cycbotponybackdoorcredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 6 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 16 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unexpected DNS network traffic destination 5 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 53 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\csrss.exe
    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
    1⤵
    • Executes dropped EXE
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:332
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies WinLogon for persistence
    PID:1236
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7784fe587f786892f8df93f0056eade1.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7784fe587f786892f8df93f0056eade1.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2584
      • C:\Users\Admin\x276Ht.exe
        C:\Users\Admin\x276Ht.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2196
        • C:\Users\Admin\zoieg.exe
          "C:\Users\Admin\zoieg.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:2300
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del x276Ht.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2864
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2304
      • C:\Users\Admin\2xiv.exe
        C:\Users\Admin\2xiv.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2816
        • C:\Users\Admin\2xiv.exe
          "C:\Users\Admin\2xiv.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:2936
      • C:\Users\Admin\3xiv.exe
        C:\Users\Admin\3xiv.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:2692
        • C:\Users\Admin\3xiv.exe
          C:\Users\Admin\3xiv.exe startC:\Users\Admin\AppData\Roaming\72293\DBD8E.exe%C:\Users\Admin\AppData\Roaming\72293
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:236
        • C:\Users\Admin\3xiv.exe
          C:\Users\Admin\3xiv.exe startC:\Program Files (x86)\93D30\lvvm.exe%C:\Program Files (x86)\93D30
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1020
        • C:\Program Files (x86)\LP\8E37\67D7.tmp
          "C:\Program Files (x86)\LP\8E37\67D7.tmp"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1864
      • C:\Users\Admin\4xiv.exe
        C:\Users\Admin\4xiv.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2520
        • C:\Users\Admin\AppData\Local\76a54caa\X
          *0*bc*ab1be7e5*31.193.3.240:53
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2480
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1852
      • C:\Users\Admin\5xiv.exe
        C:\Users\Admin\5xiv.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2728
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del JaffaCakes118_7784fe587f786892f8df93f0056eade1.exe
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:2804
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:560
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1108
  • C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
    1⤵
      PID:2524
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2428
    • C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
      1⤵
        PID:2676

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      3
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      1
      T1547.004

      Privilege Escalation

      Boot or Logon Autostart Execution

      3
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      1
      T1547.004

      Defense Evasion

      Hide Artifacts

      1
      T1564

      Hidden Files and Directories

      1
      T1564.001

      Modify Registry

      5
      T1112

      Credential Access

      Credentials from Password Stores

      1
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Unsecured Credentials

      3
      T1552

      Credentials In Files

      3
      T1552.001

      Discovery

      Process Discovery

      1
      T1057

      Query Registry

      2
      T1012

      System Information Discovery

      1
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Collection

      Data from Local System

      2
      T1005

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\72293\3D30.229
        Filesize

        600B

        MD5

        982266b62aad01489e350492173dfb15

        SHA1

        f47df9130c7a3564db1ae9b7cca603a30d68b84d

        SHA256

        91f003648e6cf76d0032bc549ad2cec0718d671456367a8bf1629875eac1dfb6

        SHA512

        782327123bad7f59d32005a41054dcf91431151a5abcfed32b54dea8798e4e146c5fe7f637afdca7d52c523867d4a9c6f562e20b817e59a2bde7f35da9e4d483

        Download Submit

      • C:\Users\Admin\AppData\Roaming\72293\3D30.229
        Filesize

        996B

        MD5

        d9c7d267748912d87ee1a998bf7a663d

        SHA1

        3d97d2a7750eca71b849d6399702035e95327326

        SHA256

        c18dadc6f391795aa2f830b8165765c6def681eaf44cd34dbfa816a2ec44752d

        SHA512

        b0106a18db47cda758aa28cca5138344ff1fbe7ceb8a6817d71287ff17ecf7d9d3a4b8578c19146367d1528da61c8c66b93c295a6e48253e6fd5082d7869c03e

        Download Submit

      • C:\Users\Admin\AppData\Roaming\72293\3D30.229
        Filesize

        1KB

        MD5

        5515613fef4840a6668853eed7f4f958

        SHA1

        8055b42dd8de81b7915abb0d4041cbf69e273980

        SHA256

        75f51fbe0b510862fbdd20190397499fac763f9390e1c68dd0d9da7b5797aaed

        SHA512

        5daeba81d445ebf27625e824466f88a9d2ba754b0d15240513023c91ade86022619b25c6160391e48aadbbf148e8dcaf5db58bde0040b225d03db4b394829001

        Download Submit

      • C:\Windows\system32\consrv.dll
        Filesize

        29KB

        MD5

        76f2ad6212981964aeea83926e5ffdd7

        SHA1

        8f016ab22ce1338507218f713166c5c169eee65e

        SHA256

        0b2de0f2219abcf8c5bd580b5b46777eb41290bf5d4b4225b4fd65e56cd99e08

        SHA512

        e650275cf11752d12c89aa189270627e54b7b5f55b6f9261aa4e25eafc073374ae9bbae2a380338a81ee07c4aaa0ee3608a45c118fccae1c382f99554b26a91f

        Download Submit

      • \Program Files (x86)\LP\8E37\67D7.tmp
        Filesize

        101KB

        MD5

        8ddb300fe82a1e8ab0b0c9b704725316

        SHA1

        899ef3abfa492136996ccffd0958e0c607817835

        SHA256

        86725431a4d0a9b52b5be71853baac7bc228b5ce92443e758a376ef7e7cbac5f

        SHA512

        3a13663e34a65a6f255c973aeb4c2534adc386135d401b7274fd958c753e29116dc85f6736481593d8cdf7459dc65aa926de7d5b3a67db983730e36db146b321

        Download Submit

      • \Users\Admin\2xiv.exe
        Filesize

        64KB

        MD5

        930ddf5711ff276332bc5e1eec8cded0

        SHA1

        e14b2bdd272fe546c043ab7a2f249955e1820744

        SHA256

        4ee9b7d064b411cbde34bb286e46d1d99112efe5f928420b4dc11a66d9b6839d

        SHA512

        3ca938a3bd51168445a50b4f823feb9db2eee5d7828e32cc90be64275b2702e8c3eba0cf8a4e9d5b1b7a17a4df8b7c627315a140bcd2f47e2b78e5e220ae4f6d

        Download Submit

      • \Users\Admin\3xiv.exe
        Filesize

        287KB

        MD5

        3d6f651187a05dfab030fd923b218279

        SHA1

        9d0fff6e4d22777a9f3b7c57baea9f34151eca65

        SHA256

        b0c28bc12dc7dfe527283d315605e01f8a3b282f1e877a3bcf78b3ca35f72f3e

        SHA512

        835cc4eb247e6bdaefef37546922c902a448eb9de32432f59c0b7a9c524a07abfa10d23ad3fd5f3d8897e821f95d73849b5ef8053ace3d480d76720e7d10acbd

        Download Submit

      • \Users\Admin\4xiv.exe
        Filesize

        265KB

        MD5

        45cba518c7a8b41f65690da873e13e3d

        SHA1

        5a787a1f7f7bdd22c72b0f9d26818d902b65da8b

        SHA256

        c31f65ef14f409c290bb661077f8473bf0a2de47e08d0256c1f086556b50ab79

        SHA512

        7515485b6d9e90cf4dd00b076c4173f19adffe0215d95edadd4ceb61b46a06c3751aa524c70a3cac738b751bc73802877ef2d16a44b5cc0399c3e85b704249f7

        Download Submit

      • \Users\Admin\5xiv.exe
        Filesize

        44KB

        MD5

        fd4f97e710556c5769ab1e074a5c02b5

        SHA1

        eaac335c1dd2cd449f4d3b4f9b5cdad0cffa6d61

        SHA256

        7cf1fcac1a66a68e71346d784a0fe68aca36f15425c3c44a9a6eb60241617e18

        SHA512

        6f01d7a97497d245cf4144fac30cd169435ad51ea432adf2469e822773c529ff08daf0ffdca80c1aab607490b9f8f7cd06e08f6219c0065b58a773d42c159726

        Download Submit

      • \Users\Admin\AppData\Local\76a54caa\X
        Filesize

        38KB

        MD5

        72de2dadaf875e2fd7614e100419033c

        SHA1

        5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

        SHA256

        c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

        SHA512

        e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

        Download Submit

      • \Users\Admin\x276Ht.exe
        Filesize

        332KB

        MD5

        ad27bc021625bc7692f942a626b3a576

        SHA1

        12d961ecb68e63c2cf3c3590da311a9bd5e521f7

        SHA256

        39c408d03296d3639563dfb51ee977fb508fc9fd4d005e6cad8551ea3f2f4fb0

        SHA512

        2c51d8fe3cc5d2eb50d7cc5faf76f8b1d35380eb078409b1fa24caa9ca719d3b447d0669f07138330d360471a06bbc1dcca5e7a2eb81179af164a87a9f6b74bb

        Download Submit

      • \Users\Admin\zoieg.exe
        Filesize

        332KB

        MD5

        ff77249640cee41442ac06869f0a296d

        SHA1

        bcb7f29acb41b897b25a74af1031fa128696d16b

        SHA256

        299ef25f71285a5dbfacb609a4f0515e0fd6b23d7fd25e9a600942d890d54a7f

        SHA512

        1eeb189339d42dd77ac88aa846deba4d7c87889fcea7ddefbd6957b554d052945ba8af8d370c0c8db573274d275589f66f54ad41b8bcf4ef029d548c06116133

        Download Submit

      • \systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}
        Filesize

        2KB

        MD5

        c524bff734708f158344d28186fe27fb

        SHA1

        55fc6b5336c61abcdd69daf08af99448242c1057

        SHA256

        8bc07ca83110d0bcaad3dc942877ffa9b0254d5fd8c881109faaf9536aa673a9

        SHA512

        004138e6f0cb61a9d30a8783195bf0dedc4ee6a30f434a5d481e0001e9af97199ac1481527c13e4511e32887a96a73ba58fdf07188e3a67bc14e52b943eb31ee

        Download Submit

      • memory/236-118-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/332-85-0x00000000023E0000-0x00000000023EB000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1020-243-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/1236-76-0x0000000002530000-0x0000000002536000-memory.dmp

        Filesize

        24KB

        Download

      • memory/1236-80-0x0000000002530000-0x0000000002536000-memory.dmp

        Filesize

        24KB

        Download

      • memory/1236-73-0x0000000002530000-0x0000000002536000-memory.dmp

        Filesize

        24KB

        Download

      • memory/1236-102-0x0000000002550000-0x000000000255B000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1236-98-0x0000000002550000-0x000000000255B000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1236-94-0x0000000002550000-0x000000000255B000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1236-103-0x0000000002560000-0x000000000256B000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1236-245-0x0000000002510000-0x0000000002511000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1236-246-0x0000000002560000-0x000000000256B000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1864-438-0x0000000000400000-0x000000000041D000-memory.dmp

        Filesize

        116KB

        Download

      • memory/2196-27-0x0000000003740000-0x00000000041FA000-memory.dmp

        Filesize

        10.7MB

        Download

      • memory/2520-121-0x0000000030670000-0x00000000306BF000-memory.dmp

        Filesize

        316KB

        Download

      • memory/2520-312-0x0000000030670000-0x00000000306BF000-memory.dmp

        Filesize

        316KB

        Download

      • memory/2584-441-0x00000000029F0000-0x00000000034AA000-memory.dmp

        Filesize

        10.7MB

        Download

      • memory/2692-116-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/2692-437-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/2692-241-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/2692-446-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/2936-39-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2936-51-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2936-45-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2936-43-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2936-46-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2936-48-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2936-41-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2936-50-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2936-49-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download