Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-01-2025 18:36
General
-
Target
JaffaCakes118_f4a299dee043b761ebda36a5d846b116.exe
-
Size
174KB
-
MD5
f4a299dee043b761ebda36a5d846b116
-
SHA1
093201cf450cd84edbc1795ae2e10fdeadc4be8d
-
SHA256
1bd0f6b56b2962c533b700d93d47fd9d6d320068a422be7880b24b0c09eb2e10
-
SHA512
50e5fa0a1d3fdc1f44a1261b08c88cf61b40aa2f1a91461839f91f6bc87559957bb7c94e11f5f2cdf910b5f9f50774bb899359f0cf213e7591648266a9b06b03
-
SSDEEP
3072:N86UNmwtv6jXf0N8CeVKaQhcoh/HpDtVqECw6xjgVLLXbUPj4WZ4P2PdQLD/DbQo:ys0CzbRVX0c0/Hpb6wdVLHOf4P2PdKlj
Malware Config
Signatures
-
Cycbot
Cycbot is a backdoor and trojan written in C++..
-
Cycbot family
-
Detects Cycbot payload 7 IoCs
Cycbot is a backdoor and trojan written in C++.
-
Modifies security service 2 TTPs 1 IoCs
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 3 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 15 IoCs
-
Suspicious use of FindShellTrayWindow 28 IoCs
-
Suspicious use of SendNotifyMessage 17 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f4a299dee043b761ebda36a5d846b116.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f4a299dee043b761ebda36a5d846b116.exe"1⤵
- Modifies security service
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f4a299dee043b761ebda36a5d846b116.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f4a299dee043b761ebda36a5d846b116.exe startC:\Users\Admin\AppData\Roaming\18971\37C9A.exe%C:\Users\Admin\AppData\Roaming\189712⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f4a299dee043b761ebda36a5d846b116.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f4a299dee043b761ebda36a5d846b116.exe startC:\Program Files (x86)\71B61\lvvm.exe%C:\Program Files (x86)\71B612⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
996B
MD54f8532ae21092e20b9a88fc7625173ab
SHA1b87f0cebda1277ea27a577bbf9daa970221cdcd1
SHA256b5cadb67b6f3ddc0cadca09e2aff7514f9d33b45ea70bbd2ccbe1587ef3c455a
SHA512260667595350bf54f5e2ac8e0f7ca125a285bb584322d0af8e1651ff8fb976986711110a4220b86352d8a3f202b5b5ba462ff09b77067af8668b0b62c5793968
-
Filesize
1KB
MD59f70d0846870fe2a10849858bd5da30c
SHA1bcd53fee8b1fdb28cc03a59c51dbae4f5b4d03de
SHA2563c2cce3ac84a4a57aa37cb937824b7345e752f2e2eebf453cd32402da36d8276
SHA51243453a5a5d8672acd0b626b6fe24538dd16a32bf26d801ca67c1e85cbe105173213fedc713036d2ca147fbfe2eaad5d113cd55aa69480bcc1552f946fea66c75
-
Filesize
1KB
MD5ade4fbf56e74f9583f8bcb584f78828b
SHA1ba8d0e100ceda7cdd8019505c859883d384c0b2e
SHA256980e2a9bc6d760ef5c2b3b9a95d075bb6de2d64883753a73b11a82c14f31e25b
SHA512c5726bf2db8aa53e5441ce647353b9d743197ad050bd15a144b26306afd614cff90a6613f7d53064ed3a9cc840caf2880ab96e3d57a28a06d845404831f8465c
-
Filesize
600B
MD508478e835a097b2aa5a0d6f6ac748cea
SHA130999cf89c4b89fb389af6b65f957775a02a9862
SHA256bc720db567f64096488143c6b72b04ad516465dd17c59d637da5e7eff88c983c
SHA5128cb0d6c1e6c5c6ed78a4b4ee87b083830aa1a10284afab0aa238c8547bdf7d9298a34cd55cf0eac1a8e5a35e0143f409f88616ad0fddc8aaf57ae7dcc9beb423
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
316KB
-
Filesize
328KB
-
Filesize
316KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB