Overview

overview

10

Static

static

3

JaffaCakes...22.exe

windows7-x64

10

JaffaCakes...22.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    140s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    12-01-2025 19:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_16d415398c5443ce76a48be2df745722.exe

  • Size

    274KB

  • MD5

    16d415398c5443ce76a48be2df745722

  • SHA1

    98e4340a22a7b9d6811e33a5d3b48560cfb81e8c

  • SHA256

    17c956c2f179d1f91d5c5c95923f4d1c7db13b18ec9bbd3e66d16d4ce3623979

  • SHA512

    e35fba808cf332d23c9a7a4b2b85f22db2031d0543512ff7b250b233b2493b25328fdb749be7c40f60f45d71f8a9fa0a54447ff5f7cf13e0d683bc0612e41b10

  • SSDEEP

    6144:q7uTmMLFpJa9x7nIUel6f1OjTtkrY2czN+RLQqQtNaz:q7uaMLrmx7nIUel6fsjmr9QWEqwNaz

Score
10/10
cycbotponybackdoorcredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 8 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 24 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_16d415398c5443ce76a48be2df745722.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_16d415398c5443ce76a48be2df745722.exe"
    1⤵
    • Modifies security service
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2688
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_16d415398c5443ce76a48be2df745722.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_16d415398c5443ce76a48be2df745722.exe startC:\Users\Admin\AppData\Roaming\57D17\D0DDB.exe%C:\Users\Admin\AppData\Roaming\57D17
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2576
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_16d415398c5443ce76a48be2df745722.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_16d415398c5443ce76a48be2df745722.exe startC:\Program Files (x86)\17C57\lvvm.exe%C:\Program Files (x86)\17C57
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2792
    • C:\Program Files (x86)\LP\DB45\4154.tmp
      "C:\Program Files (x86)\LP\DB45\4154.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2064
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2424
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

4
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Query Registry

2
T1012

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\57D17\7C57.7D1
    Filesize

    696B

    MD5

    7d3e06d98a37ad86a0e83fb041d65a5b

    SHA1

    a9b2cffc09530f090b556267a64725bcc184664a

    SHA256

    980eca0c759d4fb24a9c82852d6eb9055b515716c2b77923a4ec49e20edb9706

    SHA512

    3c14c4c33698e5f78be2c8593cd0304d13c843e6669e183b13eaa68593ffc29b5f613f11c8dd05823c6a0f9213b888444890a0866eec13f03ea7d3bae8180eda

    Download Submit

  • C:\Users\Admin\AppData\Roaming\57D17\7C57.7D1
    Filesize

    993B

    MD5

    206d51afbacf4da93738540050a4f4b0

    SHA1

    21f1194974e8e2788ef31bb1dff97121e4edf40b

    SHA256

    8269bd7ffa2df2370a4e74a16ff95e2f17468ddf442d6238c6f31f7cb67f8187

    SHA512

    48335d718208ae0b0cfc238c2d8e0563e3af02f14e5ae75e3e1c4bc565439a67ecd06463730ab6e7d2dcd0dd1d8565709d45289154e80e9248e4a48bf51e7681

    Download Submit

  • C:\Users\Admin\AppData\Roaming\57D17\7C57.7D1
    Filesize

    300B

    MD5

    20186eb49b09b41a7275f21834184acf

    SHA1

    89fb28f6f8ed3ff5830229f153dc29b9e930e674

    SHA256

    9a562807c08ca6ee133e29cd14cb67d5f92d49287d60dd51b6c7ec8b673ea88d

    SHA512

    83d7d6ef4c03ac74e05bd2df7ec5b815de747cdb87c7ddadff33e8ce363ee08f2d06844d327f8bcd8e6c0668ace474a1346462a696b3c03cfa29aa80db67b188

    Download Submit

  • C:\Users\Admin\AppData\Roaming\57D17\7C57.7D1
    Filesize

    1KB

    MD5

    3d8965caabbe4335f7d8d52d06dce1ea

    SHA1

    eeecfdd2d8865708f53af294ee131269d0bf305c

    SHA256

    9bbebd2402d98d6c4631318169c342035d8fad7f91f1483faa378c97294d3a06

    SHA512

    a8eb8e756dd46868503724d961ec5db3aba510f80bd9a6fd0bd927b4f73ec53def9bae1d6390d332154b5b698ffd3b692011b3d4a291cd635317c4d3c4d7de0f

    Download Submit

  • \Program Files (x86)\LP\DB45\4154.tmp
    Filesize

    98KB

    MD5

    137b967546ac441246b86423c0371e6c

    SHA1

    288e6b0171b769f6cf89f2a94b7d278d99866186

    SHA256

    b99b941a23c733c3516fcbe0c0f254a1b8add5982612e251ddf73e243511fc46

    SHA512

    4317a5f44b4404d1880f4248529e496dddc5025de60af57d0c7f4fee510715c93db5aba1f3c7851ef3efc5a53be9c6445b9a93e8ea65c4ebe5a2ab44ccb98810

    Download Submit

  • memory/2064-253-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2576-11-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2576-13-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2576-10-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2688-4-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

    Download

  • memory/2688-129-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2688-1-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

    Download

  • memory/2688-3-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2688-252-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2688-14-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2688-2-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2688-303-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2792-128-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download