Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/01/2025, 18:57

General

  • Target

    JaffaCakes118_d032b2a990bafb82e3472c97101b14f3.exe

  • Size

    173KB

  • MD5

    d032b2a990bafb82e3472c97101b14f3

  • SHA1

    35f5baa21c642933065fc32f862ff36d43f8c74b

  • SHA256

    16efd532684c4624f8a73b14930d2ea72b291caa15b099331ab397a9c73bf752

  • SHA512

    7dc3f7080084b3f325a07111f84bf1516b7bfa8ccad0a0cb3af6249ae05a5c04b166454781aadb8c543d82a897e73e1db9d09f0a44a2431a7a160795c649606e

  • SSDEEP

    3072:bZh60ADfBVq4vl/PzAqKc135bdpZ+4vX57jNlzLNmyyIz1ifHJKy/crb5gGb/:bZbCz/NntKc135bvZ+4vX13zBmjIwpKv

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

  • Cycbot family
  • Detects Cycbot payload 5 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d032b2a990bafb82e3472c97101b14f3.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d032b2a990bafb82e3472c97101b14f3.exe"
    1⤵
    • Modifies WinLogon for persistence
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4556
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d032b2a990bafb82e3472c97101b14f3.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d032b2a990bafb82e3472c97101b14f3.exe startC:\Program Files (x86)\Internet Explorer\D3A4\BBE.exe%C:\Program Files (x86)\Internet Explorer\D3A4
      2⤵
        PID:2388
      • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d032b2a990bafb82e3472c97101b14f3.exe
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d032b2a990bafb82e3472c97101b14f3.exe startC:\Users\Admin\AppData\Local\Temp\lvvm.exe%C:\Users\Admin\AppData\Local\Temp
        2⤵
          PID:776

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Roaming\45D25\5796.5D2

              Filesize

              1KB

              MD5

              977fae99c83d680dabb0ebc44d85dc3c

              SHA1

              ab55d09efdefb494d92a66361ca0bbbdb530a4ed

              SHA256

              e99ed20aeb5bc173288199a3274604192cc54fbd0f73b496ca4cca0b34df492e

              SHA512

              cd53d005d2bbde9f5e415945c66beba915addf1ef783b1551f12a19fdb227bfb7dc1c44043e70b23be1ab89e39425d518b15ad413739641bde78af50a2232d70

            • C:\Users\Admin\AppData\Roaming\45D25\5796.5D2

              Filesize

              600B

              MD5

              38ec6431981f58cd5d01e506606c5b1c

              SHA1

              fc616d2c88cc424518b376edd81375a0224810a4

              SHA256

              1d9a16f4dde8561ec7f2828e0d9da011e561d275f3b704b691a6007a2cb7207b

              SHA512

              22c682ddb0e4e7878324eb5ba2d52b14080cad6bac519e75f056f1346df146c5a7ff5f6fd1a13c1b9f409f57f31e2c67084f7ee6233788255729826c1e4c4542

            • C:\Users\Admin\AppData\Roaming\45D25\5796.5D2

              Filesize

              996B

              MD5

              e89800e70cb94d7736d10604f211897c

              SHA1

              b17bf1f9f0b4ad60f47a6913dee848c0307cf3c8

              SHA256

              5b09a4929c3b2c31ce3bfce9add25df2167d3e0f4a7f302aebbec839e3b6572a

              SHA512

              b0ab40b39c2f351ba541a6840a82db6eaf85b8c61501e8a8b2e182cbf8567ec0a98d8fe05d12e93efcf45feb7660ef14e7c03165c0ab19a77918026e40556c1a

            • memory/776-79-0x0000000000400000-0x000000000046D000-memory.dmp

              Filesize

              436KB

            • memory/2388-12-0x0000000000400000-0x000000000046D000-memory.dmp

              Filesize

              436KB

            • memory/2388-13-0x0000000000400000-0x000000000046D000-memory.dmp

              Filesize

              436KB

            • memory/4556-1-0x0000000000400000-0x000000000046D000-memory.dmp

              Filesize

              436KB

            • memory/4556-2-0x0000000000400000-0x000000000046D000-memory.dmp

              Filesize

              436KB

            • memory/4556-14-0x0000000000400000-0x000000000046D000-memory.dmp

              Filesize

              436KB

            • memory/4556-77-0x0000000000400000-0x000000000046D000-memory.dmp

              Filesize

              436KB

            • memory/4556-186-0x0000000000400000-0x000000000046D000-memory.dmp

              Filesize

              436KB