Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2025, 18:57
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_d032b2a990bafb82e3472c97101b14f3.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_d032b2a990bafb82e3472c97101b14f3.exe
-
Size
173KB
-
MD5
d032b2a990bafb82e3472c97101b14f3
-
SHA1
35f5baa21c642933065fc32f862ff36d43f8c74b
-
SHA256
16efd532684c4624f8a73b14930d2ea72b291caa15b099331ab397a9c73bf752
-
SHA512
7dc3f7080084b3f325a07111f84bf1516b7bfa8ccad0a0cb3af6249ae05a5c04b166454781aadb8c543d82a897e73e1db9d09f0a44a2431a7a160795c649606e
-
SSDEEP
3072:bZh60ADfBVq4vl/PzAqKc135bdpZ+4vX57jNlzLNmyyIz1ifHJKy/crb5gGb/:bZbCz/NntKc135bvZ+4vX13zBmjIwpKv
Malware Config
Signatures
-
Cycbot family
-
Detects Cycbot payload 5 IoCs
Cycbot is a backdoor and trojan written in C++.
resource yara_rule behavioral2/memory/2388-13-0x0000000000400000-0x000000000046D000-memory.dmp family_cycbot behavioral2/memory/4556-14-0x0000000000400000-0x000000000046D000-memory.dmp family_cycbot behavioral2/memory/4556-77-0x0000000000400000-0x000000000046D000-memory.dmp family_cycbot behavioral2/memory/776-79-0x0000000000400000-0x000000000046D000-memory.dmp family_cycbot behavioral2/memory/4556-186-0x0000000000400000-0x000000000046D000-memory.dmp family_cycbot -
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\45D25\\00ED3.exe" JaffaCakes118_d032b2a990bafb82e3472c97101b14f3.exe -
resource yara_rule behavioral2/memory/4556-2-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral2/memory/2388-12-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral2/memory/2388-13-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral2/memory/4556-14-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral2/memory/4556-77-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral2/memory/776-79-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral2/memory/4556-186-0x0000000000400000-0x000000000046D000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_d032b2a990bafb82e3472c97101b14f3.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4556 wrote to memory of 2388 4556 JaffaCakes118_d032b2a990bafb82e3472c97101b14f3.exe 84 PID 4556 wrote to memory of 2388 4556 JaffaCakes118_d032b2a990bafb82e3472c97101b14f3.exe 84 PID 4556 wrote to memory of 2388 4556 JaffaCakes118_d032b2a990bafb82e3472c97101b14f3.exe 84 PID 4556 wrote to memory of 776 4556 JaffaCakes118_d032b2a990bafb82e3472c97101b14f3.exe 94 PID 4556 wrote to memory of 776 4556 JaffaCakes118_d032b2a990bafb82e3472c97101b14f3.exe 94 PID 4556 wrote to memory of 776 4556 JaffaCakes118_d032b2a990bafb82e3472c97101b14f3.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d032b2a990bafb82e3472c97101b14f3.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d032b2a990bafb82e3472c97101b14f3.exe"1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d032b2a990bafb82e3472c97101b14f3.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d032b2a990bafb82e3472c97101b14f3.exe startC:\Program Files (x86)\Internet Explorer\D3A4\BBE.exe%C:\Program Files (x86)\Internet Explorer\D3A42⤵PID:2388
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d032b2a990bafb82e3472c97101b14f3.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d032b2a990bafb82e3472c97101b14f3.exe startC:\Users\Admin\AppData\Local\Temp\lvvm.exe%C:\Users\Admin\AppData\Local\Temp2⤵PID:776
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5977fae99c83d680dabb0ebc44d85dc3c
SHA1ab55d09efdefb494d92a66361ca0bbbdb530a4ed
SHA256e99ed20aeb5bc173288199a3274604192cc54fbd0f73b496ca4cca0b34df492e
SHA512cd53d005d2bbde9f5e415945c66beba915addf1ef783b1551f12a19fdb227bfb7dc1c44043e70b23be1ab89e39425d518b15ad413739641bde78af50a2232d70
-
Filesize
600B
MD538ec6431981f58cd5d01e506606c5b1c
SHA1fc616d2c88cc424518b376edd81375a0224810a4
SHA2561d9a16f4dde8561ec7f2828e0d9da011e561d275f3b704b691a6007a2cb7207b
SHA51222c682ddb0e4e7878324eb5ba2d52b14080cad6bac519e75f056f1346df146c5a7ff5f6fd1a13c1b9f409f57f31e2c67084f7ee6233788255729826c1e4c4542
-
Filesize
996B
MD5e89800e70cb94d7736d10604f211897c
SHA1b17bf1f9f0b4ad60f47a6913dee848c0307cf3c8
SHA2565b09a4929c3b2c31ce3bfce9add25df2167d3e0f4a7f302aebbec839e3b6572a
SHA512b0ab40b39c2f351ba541a6840a82db6eaf85b8c61501e8a8b2e182cbf8567ec0a98d8fe05d12e93efcf45feb7660ef14e7c03165c0ab19a77918026e40556c1a