Overview

overview

10

Static

static

3

JaffaCakes...b5.exe

windows7-x64

10

JaffaCakes...b5.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    14-01-2025 22:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_46e61b55174c83c383389850ac3eb4b5.exe

  • Size

    273KB

  • MD5

    46e61b55174c83c383389850ac3eb4b5

  • SHA1

    41f9651e4a7a46bb90db9eb417e2c957a5f71577

  • SHA256

    2e7fc0a389bc29d5102e3fb17d46ddb42575718df32a5d68a67972993f0cbe1e

  • SHA512

    7914168708124753a0ec51a021cd85b859150e7ffbcada300c3b030225ef0618cdc07488b11a0562873cd22c4f7ea36c5458d08b77c9db500aa991658ac4fd08

  • SSDEEP

    6144:t7wYVlIgvifJtX+hTJRaSSb4TomjGOKJ2QYQDc8qPm/X1Xe:tpVl1vOX+cS0KfKBcI9e

Score
10/10
cycbotponybackdoorcredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 7 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 24 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_46e61b55174c83c383389850ac3eb4b5.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_46e61b55174c83c383389850ac3eb4b5.exe"
    1⤵
    • Modifies security service
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2704
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_46e61b55174c83c383389850ac3eb4b5.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_46e61b55174c83c383389850ac3eb4b5.exe startC:\Users\Admin\AppData\Roaming\3F60E\9B579.exe%C:\Users\Admin\AppData\Roaming\3F60E
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2660
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_46e61b55174c83c383389850ac3eb4b5.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_46e61b55174c83c383389850ac3eb4b5.exe startC:\Program Files (x86)\0E3F6\lvvm.exe%C:\Program Files (x86)\0E3F6
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1728
    • C:\Program Files (x86)\LP\7903\BB92.tmp
      "C:\Program Files (x86)\LP\7903\BB92.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2976
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2816
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

4
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Query Registry

2
T1012

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\3F60E\E3F6.F60
    Filesize

    996B

    MD5

    9476d5e1489fd6e390459720da9283de

    SHA1

    650095abcb6af86722952969d1eb4ba1f9635eb1

    SHA256

    c9d67ed08593686c7779ac51487e1db394ad220075328a167ad401aa4695f259

    SHA512

    85728d9a138efc5ae56307006a138bc38e29877d9c6119b8118af2f653079e749e224c2eae0891876f086f2df7f579686a50309fc40d1e4df99dea574533de54

    Download Submit

  • C:\Users\Admin\AppData\Roaming\3F60E\E3F6.F60
    Filesize

    600B

    MD5

    854ba7de29c5ba07b96a062bd8f4481e

    SHA1

    83c5631ab4b5740a1a64eb6c227f259722060720

    SHA256

    69ae6e135e36483a4a32fcf0b8bcb92b827ad5e1e6e946ee2fe30542d29a9924

    SHA512

    561d25dde8029b53ea1585184e5471ae9b146d3a68ecbe3a158149064bd19cfb0eedb91297acddf575a0f7c7f82ee650056646d3f9ed497b61eeedab6a02eba2

    Download Submit

  • C:\Users\Admin\AppData\Roaming\3F60E\E3F6.F60
    Filesize

    1KB

    MD5

    657465cf112d3f38304b809669a14541

    SHA1

    1eda2666716bf6462fbcc7da63113ecd231a1437

    SHA256

    13fef0e9e74fc39f85238def4c2392dfb31c4f20da9a8006e75aa8527039b0e3

    SHA512

    44b94c89dce06b1efb9eafebac9849c5d1c029bc2f80eb840788b47397904bde9e509f64333117ea1b916609f198dd6bdac4c12ec4bad4dd513c2d6aae5d237f

    Download Submit

  • \Program Files (x86)\LP\7903\BB92.tmp
    Filesize

    96KB

    MD5

    1efe6aaebdbfec6cd83d915c31a330b3

    SHA1

    8a95e69bbf7bd68700052618a8f38dbe7f6281b4

    SHA256

    228ed97d6890e3a2cd98c1bae8373feb479f287ac640e385720da44fdc99a3b4

    SHA512

    9e0000f6375c7c5daa635daebffae95e5fafec45e4955c86f915a3129b7bc2285472ee8190a2fbab72ca48f27d9536c8661e4e0d358bf0859f4ceba0a790e181

    Download Submit

  • memory/1728-122-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/1728-124-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/2660-19-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/2660-18-0x0000000000528000-0x0000000000549000-memory.dmp

    Filesize

    132KB

    Download

  • memory/2660-16-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/2704-0-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/2704-308-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/2704-13-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/2704-15-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

    Download

  • memory/2704-2-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

    Download

  • memory/2704-3-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/2704-303-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/2704-120-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/2976-304-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2976-305-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download