Overview

overview

10

Static

static

3

JaffaCakes...c1.exe

windows7-x64

10

JaffaCakes...c1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15-01-2025 23:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_64ec8c9f9ac8c458774ff323d8c549c1.exe

  • Size

    278KB

  • MD5

    64ec8c9f9ac8c458774ff323d8c549c1

  • SHA1

    1956d1504da927d007825a2fcaae7084d4f2ea45

  • SHA256

    210c003349ae00ec0e19c8ebbef379d336504027ba3a6a7c671e2e9d0ba737a7

  • SHA512

    0c5443cebf907129028ef01b32e6bfae146e2cb0cf07ebd8af0d24ba92170f5f8e485c9b3bd73bf3eea6a6fa1459e5db0d5f342da3b709312762e3f9c19f663e

  • SSDEEP

    6144:+H54+Ttb6qJKFWidMKVY3ef4nTNEgnicIeBQtbhx++/qwbG4YrdnSUGWIiO:ARtbzDKVY3eG9i0BQtn+IbBYrdSM

Score
10/10
cycbotbackdoorcredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 8 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_64ec8c9f9ac8c458774ff323d8c549c1.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_64ec8c9f9ac8c458774ff323d8c549c1.exe"
    1⤵
    • Modifies security service
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:768
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_64ec8c9f9ac8c458774ff323d8c549c1.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_64ec8c9f9ac8c458774ff323d8c549c1.exe startC:\Users\Admin\AppData\Roaming\53107\733A5.exe%C:\Users\Admin\AppData\Roaming\53107
      2⤵
      • System Location Discovery: System Language Discovery
      PID:352
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_64ec8c9f9ac8c458774ff323d8c549c1.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_64ec8c9f9ac8c458774ff323d8c549c1.exe startC:\Program Files (x86)\079F7\lvvm.exe%C:\Program Files (x86)\079F7
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1520
    • C:\Program Files (x86)\LP\A505\1861.tmp
      "C:\Program Files (x86)\LP\A505\1861.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2184
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2060
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

4
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Query Registry

2
T1012

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\53107\79F7.310
    Filesize

    1KB

    MD5

    808aa4219e1042440f5b5a880cd57497

    SHA1

    0cc53cdad7d43167604125f6185c801cc6321b2f

    SHA256

    8be5d12ee59b6ba8adfe3196402484079ef8876f91d2fe71a858261dd6afbb1d

    SHA512

    ee230a509ec0bc42ebb2863bf42e341cc7fd3674364fc68a3f77a9ae5e1d8847cb91272b14ca941a6c9152d70743779c1d8f2ac216c2f375c7d3747fad7753ac

    Download Submit

  • C:\Users\Admin\AppData\Roaming\53107\79F7.310
    Filesize

    1KB

    MD5

    61f2a3421ca768f6dace9fba74a3e1ff

    SHA1

    37cc9da7881d6d4ba7a820f03de8bcb33210dca6

    SHA256

    2af4834a48f08a4a1db09950787a6fa44fb64b87ff507a7d3bcdfaa925106f53

    SHA512

    69be010b9e13808bef5b640eba4c819f6de275beea7a7d4f599bce0789344c1a9318aff17d05447bc139c59778524041ed60a4f26cf3bef5d13f03a6c8d4a83f

    Download Submit

  • C:\Users\Admin\AppData\Roaming\53107\79F7.310
    Filesize

    600B

    MD5

    5894318787e22d5d8b41ac2b34cd9f39

    SHA1

    ce5cc5ebc82114d132a4289ce57d4d360afda915

    SHA256

    c991ba287302c4730c266396a8491fdd94ceac9d1ef0536a74f05b6aae2811aa

    SHA512

    f0a1d41ce654f284ae0459e4d3d8c48badf64c77357743ed4c876ab81f3c99c0cec6ab56304b6ca2bc669c3b1e6bf805499d44736ae3e239ac238c6d2ba41aca

    Download Submit

  • C:\Users\Admin\AppData\Roaming\53107\79F7.310
    Filesize

    996B

    MD5

    691e3143d1a620140ebce2ebef079448

    SHA1

    87096257cb5199cfec3b1321de1f7e8061da3290

    SHA256

    eaf45e56f866af8bc7e44953e12dcd4b8d2e04ac33686aa05700f10f108b853c

    SHA512

    454161512dd395fb8ff477a15d68c1d6f33e6e6b15eec0380e420adaa8736120c77faf822bb4c4a6f7b30715abdc043e6db1b4c2bbc0adc14411bf37af8466a7

    Download Submit

  • \Program Files (x86)\LP\A505\1861.tmp
    Filesize

    98KB

    MD5

    be3c3fbcfec757ce744f2ec4c1d29d7b

    SHA1

    b837ee4245e00548763e8a32169bfec2db6ea4c9

    SHA256

    ea048c587dd9a876e56cc557c3fc4836c0cf0d009e63236242944c3b61cae9fe

    SHA512

    64e0edff36037fd452fd3ef2bc3b623080930da5a4e23a6e2a7d548b0fb5f6ff71c129a6b27d10b0622eb50e743d4afd208985058035e6038524c8b461983a06

    Download Submit

  • memory/352-15-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/352-14-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/352-12-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/768-17-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/768-16-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

    Download

  • memory/768-89-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/768-1-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

    Download

  • memory/768-2-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/768-198-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/768-201-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/768-204-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/1520-88-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/2184-200-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download