Analysis

  • max time kernel
    141s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    19/01/2025, 18:35

General

  • Target

    JaffaCakes118_cfab3eabefc57c89260df28a862ba93c.exe

  • Size

    180KB

  • MD5

    cfab3eabefc57c89260df28a862ba93c

  • SHA1

    9ed96cd62792b592790515825ac8fb2d7c9249e9

  • SHA256

    6c7cdd1c62cef41160ca49712ff92ac8c3d6538ff26c1eac29770a79c2cc3698

  • SHA512

    e19ece17f744403aa3ee7609b4cb258cbab686e3f0dd7e08632c137baaf0992007473e5833cbd45ccab460ff2c37046df14cd8f4a6f8e5ac11dd430c87e520a1

  • SSDEEP

    3072:4S9cjd689a5Z6H9wCtm7sIrQebXBQAS2ge4h1c3FrixOFla+xwZ:4hd66F9wGm7V+hbe4h1Etraa

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

  • Cycbot family
  • Detects Cycbot payload 5 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cfab3eabefc57c89260df28a862ba93c.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cfab3eabefc57c89260df28a862ba93c.exe"
    1⤵
    • Modifies WinLogon for persistence
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cfab3eabefc57c89260df28a862ba93c.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cfab3eabefc57c89260df28a862ba93c.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2076
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cfab3eabefc57c89260df28a862ba93c.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cfab3eabefc57c89260df28a862ba93c.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2496

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\72A0.617

          Filesize

          1KB

          MD5

          8343ca043fbdda4ed667232b058eab88

          SHA1

          9a569353ce60d57451909581582a13c479c38f6a

          SHA256

          8b142561dfa444a282f8ffdb29cb7f1235ddfc57d30a807891a9ba2eefdfe590

          SHA512

          b8d7beb998ac9f480daf2c75593d6f63d6f13a74f2b2c28ad59518effc543e73335fc082e72819a1dae09d3f00041191d20eb22fcf1802d1c7bc6cddce4bac2a

        • C:\Users\Admin\AppData\Roaming\72A0.617

          Filesize

          600B

          MD5

          d55bde2f9c20abbdbfa2683baccab584

          SHA1

          6bc30d72d35855a223192984045eab6e395c716b

          SHA256

          a86eb43833b4e2a741814882d3a91038061aca37820fcce8a66c3fe93298d4b2

          SHA512

          e4a16a622316a8ca13b0d25b7e6c4daa6cdb48a182253be0967d2afb15dad0b2ab241892c8076fa8e064a5545854b52665dc9c15534c7f1aad31fc258c768218

        • C:\Users\Admin\AppData\Roaming\72A0.617

          Filesize

          996B

          MD5

          1fcde450aa4f9834871b4a5a36477ddd

          SHA1

          b5d65d1fff4ce2d777085e99b9c820b932c16417

          SHA256

          04456318e6fe17411cb5f3686338239b546ba4643ed5ec49d59d746e7b7587e8

          SHA512

          d2b051a37fdd0c9717ba56151bac050c87d36186fee72dc7a68522c52f6f266a552dd5ac44e414348bdbaa6b21976bb80cc94d4d0b08145c8ce21e2d7285e19c

        • memory/2060-85-0x0000000000400000-0x000000000048C000-memory.dmp

          Filesize

          560KB

        • memory/2060-2-0x0000000000400000-0x000000000048C000-memory.dmp

          Filesize

          560KB

        • memory/2060-179-0x0000000000400000-0x000000000048C000-memory.dmp

          Filesize

          560KB

        • memory/2060-1-0x0000000000400000-0x000000000048C000-memory.dmp

          Filesize

          560KB

        • memory/2060-15-0x0000000000400000-0x000000000048C000-memory.dmp

          Filesize

          560KB

        • memory/2076-13-0x0000000000400000-0x000000000048C000-memory.dmp

          Filesize

          560KB

        • memory/2076-14-0x000000000056B000-0x0000000000585000-memory.dmp

          Filesize

          104KB

        • memory/2076-12-0x0000000000400000-0x000000000048C000-memory.dmp

          Filesize

          560KB

        • memory/2496-83-0x0000000000400000-0x000000000048C000-memory.dmp

          Filesize

          560KB

        • memory/2496-82-0x0000000000400000-0x000000000048C000-memory.dmp

          Filesize

          560KB