Analysis
-
max time kernel
141s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19/01/2025, 18:35
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_cfab3eabefc57c89260df28a862ba93c.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_cfab3eabefc57c89260df28a862ba93c.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_cfab3eabefc57c89260df28a862ba93c.exe
-
Size
180KB
-
MD5
cfab3eabefc57c89260df28a862ba93c
-
SHA1
9ed96cd62792b592790515825ac8fb2d7c9249e9
-
SHA256
6c7cdd1c62cef41160ca49712ff92ac8c3d6538ff26c1eac29770a79c2cc3698
-
SHA512
e19ece17f744403aa3ee7609b4cb258cbab686e3f0dd7e08632c137baaf0992007473e5833cbd45ccab460ff2c37046df14cd8f4a6f8e5ac11dd430c87e520a1
-
SSDEEP
3072:4S9cjd689a5Z6H9wCtm7sIrQebXBQAS2ge4h1c3FrixOFla+xwZ:4hd66F9wGm7V+hbe4h1Etraa
Malware Config
Signatures
-
Cycbot family
-
Detects Cycbot payload 5 IoCs
Cycbot is a backdoor and trojan written in C++.
resource yara_rule behavioral1/memory/2076-13-0x0000000000400000-0x000000000048C000-memory.dmp family_cycbot behavioral1/memory/2060-15-0x0000000000400000-0x000000000048C000-memory.dmp family_cycbot behavioral1/memory/2496-83-0x0000000000400000-0x000000000048C000-memory.dmp family_cycbot behavioral1/memory/2060-85-0x0000000000400000-0x000000000048C000-memory.dmp family_cycbot behavioral1/memory/2060-179-0x0000000000400000-0x000000000048C000-memory.dmp family_cycbot -
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe" JaffaCakes118_cfab3eabefc57c89260df28a862ba93c.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2060-1-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2060-2-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2076-12-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2076-13-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2060-15-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2496-83-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2060-85-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2060-179-0x0000000000400000-0x000000000048C000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_cfab3eabefc57c89260df28a862ba93c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_cfab3eabefc57c89260df28a862ba93c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_cfab3eabefc57c89260df28a862ba93c.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2060 wrote to memory of 2076 2060 JaffaCakes118_cfab3eabefc57c89260df28a862ba93c.exe 30 PID 2060 wrote to memory of 2076 2060 JaffaCakes118_cfab3eabefc57c89260df28a862ba93c.exe 30 PID 2060 wrote to memory of 2076 2060 JaffaCakes118_cfab3eabefc57c89260df28a862ba93c.exe 30 PID 2060 wrote to memory of 2076 2060 JaffaCakes118_cfab3eabefc57c89260df28a862ba93c.exe 30 PID 2060 wrote to memory of 2496 2060 JaffaCakes118_cfab3eabefc57c89260df28a862ba93c.exe 33 PID 2060 wrote to memory of 2496 2060 JaffaCakes118_cfab3eabefc57c89260df28a862ba93c.exe 33 PID 2060 wrote to memory of 2496 2060 JaffaCakes118_cfab3eabefc57c89260df28a862ba93c.exe 33 PID 2060 wrote to memory of 2496 2060 JaffaCakes118_cfab3eabefc57c89260df28a862ba93c.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cfab3eabefc57c89260df28a862ba93c.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cfab3eabefc57c89260df28a862ba93c.exe"1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cfab3eabefc57c89260df28a862ba93c.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cfab3eabefc57c89260df28a862ba93c.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft2⤵
- System Location Discovery: System Language Discovery
PID:2076
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cfab3eabefc57c89260df28a862ba93c.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cfab3eabefc57c89260df28a862ba93c.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp2⤵
- System Location Discovery: System Language Discovery
PID:2496
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58343ca043fbdda4ed667232b058eab88
SHA19a569353ce60d57451909581582a13c479c38f6a
SHA2568b142561dfa444a282f8ffdb29cb7f1235ddfc57d30a807891a9ba2eefdfe590
SHA512b8d7beb998ac9f480daf2c75593d6f63d6f13a74f2b2c28ad59518effc543e73335fc082e72819a1dae09d3f00041191d20eb22fcf1802d1c7bc6cddce4bac2a
-
Filesize
600B
MD5d55bde2f9c20abbdbfa2683baccab584
SHA16bc30d72d35855a223192984045eab6e395c716b
SHA256a86eb43833b4e2a741814882d3a91038061aca37820fcce8a66c3fe93298d4b2
SHA512e4a16a622316a8ca13b0d25b7e6c4daa6cdb48a182253be0967d2afb15dad0b2ab241892c8076fa8e064a5545854b52665dc9c15534c7f1aad31fc258c768218
-
Filesize
996B
MD51fcde450aa4f9834871b4a5a36477ddd
SHA1b5d65d1fff4ce2d777085e99b9c820b932c16417
SHA25604456318e6fe17411cb5f3686338239b546ba4643ed5ec49d59d746e7b7587e8
SHA512d2b051a37fdd0c9717ba56151bac050c87d36186fee72dc7a68522c52f6f266a552dd5ac44e414348bdbaa6b21976bb80cc94d4d0b08145c8ce21e2d7285e19c