Overview

overview

10

Static

static

3

JaffaCakes...08.exe

windows7-x64

10

JaffaCakes...08.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    96s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    12-01-2025 18:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_1539a5e31e86fd24f7c365a381bd1c08.exe

  • Size

    279KB

  • MD5

    1539a5e31e86fd24f7c365a381bd1c08

  • SHA1

    298dcd4ba4112935423ea14cc1db1bddf9a604b3

  • SHA256

    14fc9fd4c76b7cdf28be98a089647f2c8443bb1badf15760eb92ccaf56b5d62a

  • SHA512

    c6ecf329595c16372f3865a4695fe9d6d10e3ef6facdd8cd8bfa0a02673a7ba0a026c42d0eefb1e7f8bc61e306404472cbed2fb81e25e93d437b118d6a3fe7f0

  • SSDEEP

    6144:tdtDcV4n5hja23uKiNQuOINaKjFW10kNPtP/zwdraO0:FAV4n5JnLi5OJKw1ztP/zkr

Score
10/10
cycbotponybackdoorcredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 8 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SendNotifyMessage 19 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1539a5e31e86fd24f7c365a381bd1c08.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1539a5e31e86fd24f7c365a381bd1c08.exe"
    1⤵
    • Modifies security service
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2124
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1539a5e31e86fd24f7c365a381bd1c08.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1539a5e31e86fd24f7c365a381bd1c08.exe startC:\Users\Admin\AppData\Roaming\57DEE\BE204.exe%C:\Users\Admin\AppData\Roaming\57DEE
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2148
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1539a5e31e86fd24f7c365a381bd1c08.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1539a5e31e86fd24f7c365a381bd1c08.exe startC:\Program Files (x86)\EE861\lvvm.exe%C:\Program Files (x86)\EE861
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1824
    • C:\Program Files (x86)\LP\0485\5226.tmp
      "C:\Program Files (x86)\LP\0485\5226.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2192
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2968
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1452
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x568
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

4
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Query Registry

2
T1012

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\57DEE\E861.7DE
    Filesize

    696B

    MD5

    50c4f807c9a94d3a97566583b7a4d775

    SHA1

    077629904a66df0e3c4cb3de18177500433f7008

    SHA256

    15a04f5cb8b29ab85b75347b947aa4f672d106e1ba8af720899ae8c3489ceb17

    SHA512

    2bb11e718faecc48b9beb13dabeda5a6cf9976f3e14b6f743b34e10035a5108bcaa62e296a03a3766b49f65fd2d18df12ba785f7513cb064931fd132b86f70fa

    Download Submit

  • C:\Users\Admin\AppData\Roaming\57DEE\E861.7DE
    Filesize

    300B

    MD5

    c5ea7ea69e71e408ecf8b9337333a173

    SHA1

    bce097466fb44e52c9792e3b049fd3044b4a0e48

    SHA256

    c464ce46bf81302d14884f938906b8421de2b2462355472020da8aee52f02a96

    SHA512

    0b004fab9d20de43ab3974b1196e30784bf14d0ac5552d9a3a60e52a8dd282ce5461b4b4b77099beb3abab39823dec00b68e22aeee9febab7d26ca904af6f5d6

    Download Submit

  • C:\Users\Admin\AppData\Roaming\57DEE\E861.7DE
    Filesize

    1KB

    MD5

    3f6aba06ade619c2f8f60aa3d3c19009

    SHA1

    f585b786bee69bbc7bcb0e3a7615c65ff8a3eb51

    SHA256

    00ddd11abc017b25f00e7141445203b988f1d98778a2658190629af2f053de97

    SHA512

    c374322104c71e490777b4bc8e84c62bb40289bce5a3903d383713728c624536511f1b8439d37d7d2d2221cc288e16d080b832d0c70c150099ef2fbb42a5a6e5

    Download Submit

  • \Program Files (x86)\LP\0485\5226.tmp
    Filesize

    99KB

    MD5

    ed2bad1e6970c4aede88be76b11c9250

    SHA1

    74a9b54a7b24414b3035c5e7cdb3d89393e785d3

    SHA256

    8d766352dd398f94f5e3ead77d5b5ffffb8e605b066c47086020f8f8400ccdae

    SHA512

    ffbf62a08a1112be48d39d36abee306b7ac17186177842a8d7b1253ecadc0827d2d8541b7e35e037c13c6e247670f83a7d73bf5f09ff7f20815678694236bc8f

    Download Submit

  • memory/1824-123-0x00000000006C0000-0x00000000007C0000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1824-124-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2124-264-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2124-1-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

    Download

  • memory/2124-329-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2124-8-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

    Download

  • memory/2124-9-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2124-2-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2124-3-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2124-125-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2148-14-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2148-12-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2148-11-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2192-266-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2192-267-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download