Overview

overview

10

Static

static

3

JaffaCakes...01.exe

windows7-x64

10

JaffaCakes...01.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    23-01-2025 16:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_1908ab6d26e6326da28684182a90f101.exe

  • Size

    276KB

  • MD5

    1908ab6d26e6326da28684182a90f101

  • SHA1

    1e7006908ec23cfb263b7715f7c2146116c00a8b

  • SHA256

    a3ee5513d7b4a45e0443d914b343b7e7f0127b67661ce28f5e2bb939fef739a8

  • SHA512

    b46325f239eeef51f165dc4534608f5e089c3c2c55e1bfdc7e4ce773de2cb0372ac1ccac313cc8906e85f1debbe78dad1587c8d1b2bc403592b2d168b7f31b69

  • SSDEEP

    6144:hQFbHhfUo3rTACgHk+YZPnO+ws75v6HyND/mMwecBt:hYBx3rcfERfOO7iy/mM2

Score
10/10
cycbotponybackdoorcredential_accessdefense_evasiondiscoverypersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 7 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1908ab6d26e6326da28684182a90f101.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1908ab6d26e6326da28684182a90f101.exe"
    1⤵
    • Modifies security service
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:576
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1908ab6d26e6326da28684182a90f101.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1908ab6d26e6326da28684182a90f101.exe startC:\Users\Admin\AppData\Roaming\8B8F7\D97D0.exe%C:\Users\Admin\AppData\Roaming\8B8F7
      2⤵
      • System Location Discovery: System Language Discovery
      PID:588
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1908ab6d26e6326da28684182a90f101.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1908ab6d26e6326da28684182a90f101.exe startC:\Program Files (x86)\F72E8\lvvm.exe%C:\Program Files (x86)\F72E8
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1780
    • C:\Program Files (x86)\LP\D058\6B9F.tmp
      "C:\Program Files (x86)\LP\D058\6B9F.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:904
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2248
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

4
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Query Registry

2
T1012

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\8B8F7\72E8.B8F
    Filesize

    996B

    MD5

    94ce4488585eebe2dee7b249def18cca

    SHA1

    1889266a13acaa38f1f784abc4149e27643d6b34

    SHA256

    642872be6e1673c92b11ea039d67c277dcf2716fef1aa965f93dd515f7e318e0

    SHA512

    a695cee0be94da4570f1e35aed3fe629f5d2ecf4cf169abb17b0e8f50233573378d1f50e66361d116626f7ddf352cb77380f2bedd0ac40479228709a22e22b3f

    Download Submit

  • C:\Users\Admin\AppData\Roaming\8B8F7\72E8.B8F
    Filesize

    600B

    MD5

    f50f3037825bcd8535899ff75459d043

    SHA1

    90bc8acc20e14d4d2baf2e353d8c59360fd58365

    SHA256

    e8ca3f128f95fa1f2b0d56253dac19d83bbccc04e4bd554dda0bbefea3102cad

    SHA512

    29453b31b1ece6f34f7f60e23eba2fc98b41a6dbdf4bc8b178e411df2bda69bec2e008c13a9a9287ad7f973e7183e19c0203f60776f3deb86726061f23c16e9b

    Download Submit

  • C:\Users\Admin\AppData\Roaming\8B8F7\72E8.B8F
    Filesize

    1KB

    MD5

    fc824724e7fdfff7805c01616415dee5

    SHA1

    cdaa6aac961f24e530ea13232a330e7708a8cb88

    SHA256

    5db38ea0165fa20ca7d335a95966b67386e13825fa93977d6b2b8a29a58757e6

    SHA512

    d6012a349a4d8df9c4dbdd314b9f0e4941b7a81964f26ff797e0ca449bb3279e96ecf257b659a73d3a6603ed3b339284f3026791bd97d9d20d0e5e274b334b55

    Download Submit

  • \Program Files (x86)\LP\D058\6B9F.tmp
    Filesize

    97KB

    MD5

    08df2b9be15594b345d79bd5535ac84a

    SHA1

    eb968f7bbf3b7d680cf3f7d2ebbd7f3f144db432

    SHA256

    6a6a071e5db43185d023fa676a2ba483c1c67a8364c120dc600a401028535a57

    SHA512

    f6639fdc7bf6ec2e722bc0548f2a5be3c5dec18487aca110afb9f5a6353066d003f158d26c365a950d2aed73bae408f3b9160815801e0fc952837f01c3e3179e

    Download Submit

  • memory/576-0-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/576-16-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

    Download

  • memory/576-3-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/576-136-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/576-2-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

    Download

  • memory/576-13-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/576-321-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/576-325-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/588-15-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/588-19-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/588-17-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/904-322-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1780-138-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download