Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-01-2025 20:55
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe
-
Size
275KB
-
MD5
0776ff2bbabde899c82cfcebfdd5823c
-
SHA1
98a7c44b1ecf19029e2a9250e09cdec53b75577b
-
SHA256
00723b15c6476a81851e14af4806c99075d153f4b315e6bb06bdd6267448b738
-
SHA512
920ace20e82c7653b911870a9b529f4908ab0b2229e33ab205913a1d143f80788193b195b0c0a3ec23c663666711b7b8f0b15f7457de8a414d177438a3e63213
-
SSDEEP
6144:MPRrvDiFDhXWwc7Q+Jsra1eBrMyrBSCxCWYg3AR:ERrGLXtubJsu1yHrkC0C3A
Malware Config
Signatures
-
Cycbot family
-
Detects Cycbot payload 7 IoCs
Cycbot is a backdoor and trojan written in C++.
resource yara_rule behavioral1/memory/2696-13-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2696-15-0x0000000000400000-0x0000000000467000-memory.dmp family_cycbot behavioral1/memory/1560-19-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2696-128-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2864-130-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2696-321-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2696-325-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe -
Pony family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 376 9FE7.tmp -
Loads dropped DLL 2 IoCs
pid Process 2696 JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe 2696 JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\A42.exe = "C:\\Program Files (x86)\\LP\\1DBF\\A42.exe" JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
resource yara_rule behavioral1/memory/2696-3-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2696-13-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1560-17-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1560-16-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2696-15-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral1/memory/1560-19-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2696-128-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2864-130-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2696-321-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2696-325-0x0000000000400000-0x000000000046A000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\LP\1DBF\9FE7.tmp JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe File created C:\Program Files (x86)\LP\1DBF\A42.exe JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe File opened for modification C:\Program Files (x86)\LP\1DBF\A42.exe JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FE7.tmp -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2696 JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe 2696 JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe 2696 JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe 2696 JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe 2696 JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe 2696 JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe 2696 JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe 2696 JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe 2696 JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe 2696 JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe 2696 JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe 2696 JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe 2696 JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe 2696 JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2432 explorer.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeRestorePrivilege 2808 msiexec.exe Token: SeTakeOwnershipPrivilege 2808 msiexec.exe Token: SeSecurityPrivilege 2808 msiexec.exe Token: SeShutdownPrivilege 2432 explorer.exe Token: SeShutdownPrivilege 2432 explorer.exe Token: SeShutdownPrivilege 2432 explorer.exe Token: SeShutdownPrivilege 2432 explorer.exe Token: SeShutdownPrivilege 2432 explorer.exe Token: SeShutdownPrivilege 2432 explorer.exe Token: SeShutdownPrivilege 2432 explorer.exe Token: SeShutdownPrivilege 2432 explorer.exe Token: SeShutdownPrivilege 2432 explorer.exe Token: SeShutdownPrivilege 2432 explorer.exe Token: SeShutdownPrivilege 2432 explorer.exe Token: SeShutdownPrivilege 2432 explorer.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe -
Suspicious use of SendNotifyMessage 17 IoCs
pid Process 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe 2432 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2696 wrote to memory of 1560 2696 JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe 31 PID 2696 wrote to memory of 1560 2696 JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe 31 PID 2696 wrote to memory of 1560 2696 JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe 31 PID 2696 wrote to memory of 1560 2696 JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe 31 PID 2696 wrote to memory of 2864 2696 JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe 33 PID 2696 wrote to memory of 2864 2696 JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe 33 PID 2696 wrote to memory of 2864 2696 JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe 33 PID 2696 wrote to memory of 2864 2696 JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe 33 PID 2696 wrote to memory of 376 2696 JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe 36 PID 2696 wrote to memory of 376 2696 JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe 36 PID 2696 wrote to memory of 376 2696 JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe 36 PID 2696 wrote to memory of 376 2696 JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe 36 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe startC:\Users\Admin\AppData\Roaming\F312C\1F41D.exe%C:\Users\Admin\AppData\Roaming\F312C2⤵PID:1560
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0776ff2bbabde899c82cfcebfdd5823c.exe startC:\Program Files (x86)\2C14E\lvvm.exe%C:\Program Files (x86)\2C14E2⤵PID:2864
-
-
C:\Program Files (x86)\LP\1DBF\9FE7.tmp"C:\Program Files (x86)\LP\1DBF\9FE7.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:376
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2808
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2432
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
996B
MD5572ce48fd032ba8b4b8ca6d2d1ca4e46
SHA173ad56eb0df0312ed87b20a4dff3a89d197d638c
SHA256b0528e4948c23daf36816614871b8c69d55021841547ccc8358f719f014eb0e2
SHA51265f6addac33b9a4d45d3dff78506b3c708b8d000a5061dcfb066851195c1aa46101a0b5aeb87a175637be5abefa06f9b03fab12677b1cda0d8263cc498c725d3
-
Filesize
600B
MD5df7bf06fc486bedee3a5a6b527930f5e
SHA1d1a2545ee17eec8bc0c0f191b640ce346df92d7f
SHA256cf7794410e8289ee4b8f0e8cc449909b23ebf706b6efb78989fdfca680de0ba0
SHA512ca8c7785723b0f98198c91aae931ad17c258d38844a0a3296286d96e417e194c7b4639a6bbbaaadfbf0234aabdde9a3fd76beccedb2b642c4d8b84acd692b381
-
Filesize
1KB
MD5abaf40519bea1c01ed6207a4884ec550
SHA18ca924b98e625491421fc74aa6e01045c0330044
SHA25621fd08279d567cc10db092fbfd760533d90220023bc47f672a39a0a14b464e05
SHA512fc787be6aeb91edc8180884160473bc8aa3e2375149ca711a54b1e257ebc5d64bb66a779f844490f6852786f9a06a19a6e7620d1cfb77568b3132e218cd63cd2
-
Filesize
97KB
MD5cf0279e2ad6a9e3cd7ed73eef3dca989
SHA1cd44ebe43dbec73b19ad27904a84cb6aff45bba4
SHA25627ad5e0d34c0a68c884b3e6c93815a44efe2aa26c6faecc51b926edb674551d7
SHA5129f28509721cf9456a3845939a14ab9cd46806fc52f33449cc036c7ad1a7165e8b88c244d1a5bb39f71da24a2e818e663c720d860332e9fd099594bc71c198c03