Overview

overview

10

Static

static

3

JaffaCakes...dc.exe

windows7-x64

10

JaffaCakes...dc.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20-01-2025 20:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_f878dfd7853f7d8f18aff9c7c1a1bddc.exe

  • Size

    275KB

  • MD5

    f878dfd7853f7d8f18aff9c7c1a1bddc

  • SHA1

    7cbb353b503a25cd7a93b886af0bc5f1c542005c

  • SHA256

    28c5fb4c4db907c2d1e1d2b84df3b6120674274a867c69759333c0b5572ca01a

  • SHA512

    25f39b8fa321ff5bb763ea23fae45380a75cfe80540c7d1886e7522b19c3de2f3d030e18b4fdb7bdfbfad0853c295f1d834ac210ce67c1f40522c8c652e09652

  • SSDEEP

    6144:wmui0L90a+zm5ITP8XBx404ve7ursBOCnitzJ9Plds72YR3XohqOiV0WA//a:ki0LKbm5w6B0v7rKVMzJJMLRnohqOiV5

Score
10/10
cycbotponybackdoorcredential_accessdefense_evasiondiscoverypersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 7 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f878dfd7853f7d8f18aff9c7c1a1bddc.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f878dfd7853f7d8f18aff9c7c1a1bddc.exe"
    1⤵
    • Modifies security service
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1920
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f878dfd7853f7d8f18aff9c7c1a1bddc.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f878dfd7853f7d8f18aff9c7c1a1bddc.exe startC:\Users\Admin\AppData\Roaming\667E8\37C9A.exe%C:\Users\Admin\AppData\Roaming\667E8
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1900
    • C:\Program Files (x86)\LP\9A66\390A.tmp
      "C:\Program Files (x86)\LP\9A66\390A.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2400
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f878dfd7853f7d8f18aff9c7c1a1bddc.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f878dfd7853f7d8f18aff9c7c1a1bddc.exe startC:\Program Files (x86)\E8401\lvvm.exe%C:\Program Files (x86)\E8401
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2052
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2328
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

4
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Query Registry

2
T1012

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\667E8\8401.67E
    Filesize

    1KB

    MD5

    4473fd348503824062c4a34352ba1cf9

    SHA1

    b7523f2ff6bcc59dd9587f07fdfb2c9f91963314

    SHA256

    07e2743ceaefbd301061cd9048f00302a79f3eb379e3449c9f404dba00d53bf4

    SHA512

    060e950c8be091fc9b6ee22499dbf78f79366bf3dce8a81eae7b5fbccf61ea31da1669fb79e93db196a23ec80f85b225f3596f1b9e220cdcb26e7e7d274e9df8

    Download Submit

  • C:\Users\Admin\AppData\Roaming\667E8\8401.67E
    Filesize

    600B

    MD5

    aac46016469d0426d9373a10211d73b8

    SHA1

    03d9e1dd4e92c230af1ea6ef014534ed3851b7b4

    SHA256

    83d018ede8a77ffc774cd36a94a4f9f36e1d63073d0c36cf82c50387664dbdac

    SHA512

    b47d678cbf0f7d239a4486f453de87a5a8e4e1fa55e55dc44b1373a139e24aee2065841add343046111c59c2009d2f12d2ab9592560c88fb6aa5515573947a62

    Download Submit

  • C:\Users\Admin\AppData\Roaming\667E8\8401.67E
    Filesize

    897B

    MD5

    e03b84c6f6bf4457427051ec65cc17f9

    SHA1

    965c9ad0b48e24e5302de80b75bb82bc73d3c295

    SHA256

    dd6d80211aba9d0b06a95b15ab992d13da755a01cfbff2e88c762afd2a3216e8

    SHA512

    bd9f902e206a7f576baf6bc41fddc08684a11cdc82b9874a34111c68c6f07fedd2b41a8e6903ed1bcb206e40be25ca590fdea995fe938681a51ba753fe61d9ec

    Download Submit

  • \Program Files (x86)\LP\9A66\390A.tmp
    Filesize

    96KB

    MD5

    dd72281b969ae1398b69e5b336558555

    SHA1

    6b02db524a82a99c6b84542cde1edaa06c4e6ff0

    SHA256

    b1cbb0784fb37f48595650261ac1ff9659bfe5161509283a604c242cba30cd6c

    SHA512

    032e6a1b2af20b4c3c0a6a9754ba4b2cc40f8196b17908e3e2660b5ddbb2f0bafb2e3ea71ea75f101210222a86aa0491b379951f24f6427e01ba1706ec60e296

    Download Submit

  • memory/1900-18-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/1920-4-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/1920-19-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/1920-5-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

    Download

  • memory/1920-0-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/1920-3-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/1920-183-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/1920-2-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

    Download

  • memory/1920-312-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/2052-181-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/2400-184-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download