Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-01-2025 21:05
General
-
Target
JaffaCakes118_975e4eb479cee6e64db95f92ba16b09f.exe
-
Size
173KB
-
MD5
975e4eb479cee6e64db95f92ba16b09f
-
SHA1
454ed006f79e3fcd5c7cbc6990804f577e21f770
-
SHA256
1d2eb7fcf146e5a44450a0bcabd9d236cab78e3f68b4d835447ccc3d492a9b2d
-
SHA512
b4c3e0fe8cd2411e0b158bb99933bf1028fceabbde38de1008f9a4fc9534e441ce160bf2081b64f3901b6038ca53974d2358d431373c7b3406ec58b90cdeae1b
-
SSDEEP
3072:mWaxnaAF8CFG+a8oaLbkTukdxNPvuOffLL9NAt412s0gWzCEwSX7fXyr:/axaU4+aHTuqvuOffLhNAS2s0dCE/LfK
Malware Config
Signatures
-
Cycbot
Cycbot is a backdoor and trojan written in C++..
-
Cycbot family
-
Detects Cycbot payload 7 IoCs
Cycbot is a backdoor and trojan written in C++.
-
Modifies security service 2 TTPs 1 IoCs
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 15 IoCs
-
Suspicious use of FindShellTrayWindow 28 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_975e4eb479cee6e64db95f92ba16b09f.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_975e4eb479cee6e64db95f92ba16b09f.exe"1⤵
- Modifies security service
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_975e4eb479cee6e64db95f92ba16b09f.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_975e4eb479cee6e64db95f92ba16b09f.exe startC:\Users\Admin\AppData\Roaming\85477\6041A.exe%C:\Users\Admin\AppData\Roaming\854772⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_975e4eb479cee6e64db95f92ba16b09f.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_975e4eb479cee6e64db95f92ba16b09f.exe startC:\Program Files (x86)\7738A\lvvm.exe%C:\Program Files (x86)\7738A2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD535a89f51ea778b1fc7c781f50b38b265
SHA186984eaef75fc6abef396e16ce769c594382759d
SHA2562f5889d3063fc25b557387a351d899940acd32d294b2a558a3a3ad186aeb31dd
SHA512af6dcffc2f62aa1f42e9e5a25ab08c1b1edba8116afee21fe553adf40547d0918c3a330c6c89c1e1a64dea19c76015252b773fb73fdef1b4ab0ff07bee54f871
-
Filesize
1KB
MD58dea00ce3eff9eed0275642832ac77be
SHA105f8ed294ec8039d1cfa0bcba7b2803f9516e905
SHA256f23b62ce399fb4ce55bca58f2ab78a4ce5e99e5c1ef655923851fb835e6ed28e
SHA512849931624364b7e9952281d72e0696c6305e3b75fc030d6c1e5ddeba04273d11df1c3cd1d4ff6ebf9bcb97c47ce0cb400243f9590666b0969245a7d0088295a0
-
Filesize
600B
MD584f21424366281ffdd6815d74bd5dc07
SHA13c544f0f9e8d323816e0ec1c4e885daf2fe79da4
SHA256e1ab9a1c04dfb7cf0c57f3988770d171276d2ee1a527fbb085ff997c1d92400d
SHA51256dd9fb8c9b6e7fce8d0bd959ef437e7830a122d0a09c53eb84b410312aee4dd53e7e95253a3ec6b51b165b1df6590afa2851a51d71a7585f7998054ef32ed30
-
Filesize
996B
MD5d0f12e3e63cb37c78119637feb40ac0c
SHA1e0e4e645cb9a5e60cd16e57c7865b3c6f3ff5d9d
SHA256a8cf1d341d78ceeb911703b99dd70345d17514b9062d0eced824bacf3885a3eb
SHA5126a8745d89778878f5b659ee4843185f1913ac5a5ee017d782153f42e67e8471249b2528b4dae7ce232a528ebe79ab1f154e0324fdbeb432525019bad7e31ccd7
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
316KB
-
Filesize
328KB
-
Filesize
316KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB