Overview

overview

10

Static

static

3

JaffaCakes...1f.exe

windows7-x64

10

JaffaCakes...1f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    26-01-2025 13:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_3611ab527d19120df298c28fc77e351f.exe

  • Size

    285KB

  • MD5

    3611ab527d19120df298c28fc77e351f

  • SHA1

    928ec2293ba14c0b52e03ff39a05049f355fc654

  • SHA256

    5368e5a5e0ffdbc64ecf8b37f6f0b10765ecef0793517ab113cc2669d7ac80a1

  • SHA512

    d0da50e4b3685f916759f897d9c16f61b128e14e0d94fb16b731a785f08f744d60b30b7a8df35ede2200e4edfc870dcbc044506f48f5ce5a1ad5b6d030ed2a90

  • SSDEEP

    6144:q3PJYTtoMLh+3p26R+7O1ysus4rGLZDPb9fU2Zum:Ywcp2WuvyZDPxfU2ZZ

Score
10/10
cycbotponybackdoorcredential_accessdefense_evasiondiscoverypersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 7 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 24 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3611ab527d19120df298c28fc77e351f.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3611ab527d19120df298c28fc77e351f.exe"
    1⤵
    • Modifies security service
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2096
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3611ab527d19120df298c28fc77e351f.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3611ab527d19120df298c28fc77e351f.exe startC:\Users\Admin\AppData\Roaming\C890C\0EEF8.exe%C:\Users\Admin\AppData\Roaming\C890C
      2⤵
        PID:2608
      • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3611ab527d19120df298c28fc77e351f.exe
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3611ab527d19120df298c28fc77e351f.exe startC:\Program Files (x86)\0C4F4\lvvm.exe%C:\Program Files (x86)\0C4F4
        2⤵
          PID:2172
        • C:\Program Files (x86)\LP\F88C\7291.tmp
          "C:\Program Files (x86)\LP\F88C\7291.tmp"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1792
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2772
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1600

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      2
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Privilege Escalation

      Boot or Logon Autostart Execution

      2
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Defense Evasion

      Modify Registry

      4
      T1112

      Credential Access

      Credentials from Password Stores

      1
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Unsecured Credentials

      3
      T1552

      Credentials In Files

      3
      T1552.001

      Discovery

      Query Registry

      2
      T1012

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Collection

      Data from Local System

      2
      T1005

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\C890C\C4F4.890
        Filesize

        996B

        MD5

        ba58e6486e865ef739478e333c376ce5

        SHA1

        01ce5d6c38a9b50aa159b58f87f10dba1204c1da

        SHA256

        6b13146a2b3434131a0bb09fa2ee316e5f04392341bfdad5de697ecd023eade0

        SHA512

        6fede24294c4c9c5440219096bcd0c087b05367c2b88a7ce2324ca7abfc3ca99d25401798bf046f5d4fafbf06f83f80d5032091e4b4d0414c8f76328fa6ea8c8

        Download Submit

      • C:\Users\Admin\AppData\Roaming\C890C\C4F4.890
        Filesize

        600B

        MD5

        8d3a5e1062cbbd9ef6b25ce0752a2dfa

        SHA1

        ea0df26f2007fcc61e18f83792a106e50c602748

        SHA256

        47f1325da2142954a2a0e07fa154d8c4d89be4a413ca029d1f5cef78f52ece17

        SHA512

        a7503374a253b070977a84d69922296793f2d953605a8288dd26dda2bfc8f47de78b11a11aacc7b0aa954451fb62c66608a873965bf22bfa2f9a7bbae1779922

        Download Submit

      • C:\Users\Admin\AppData\Roaming\C890C\C4F4.890
        Filesize

        1KB

        MD5

        8fddc14f62ed0fca13e50f9f01754123

        SHA1

        5f2af1ba82b3b5a2c545d4e6eb0128f2d2026a82

        SHA256

        a6a2ebab446917d8594702d0313440cbd08e654994ceefb48e20c0a74021fb00

        SHA512

        560470f7aba942544141545e6816493e093879dc894aef3fce148f3801f63fe3208caf4070188e9e68a2db966058263b815b518e6a14a755d91fdc83c551be55

        Download Submit

      • \Program Files (x86)\LP\F88C\7291.tmp
        Filesize

        101KB

        MD5

        d05e213f1756ab068c1d0c2ff369f13f

        SHA1

        d4fd2de345b7cd63a60f74529cef21c2ef1ddd02

        SHA256

        e66de59c866eb7d4576a153630b056450c79ca0a1063c09e3f46223c144d4db7

        SHA512

        f713d260921e07b8521de257548630439375f574e2fc68bec305809e80df6d70a1674642e94572aecd6e3692a64587f3e9e5f3506ea6dadfd9cc46aa3f7e8422

        Download Submit

      • memory/1792-289-0x0000000000400000-0x000000000041C000-memory.dmp

        Filesize

        112KB

        Download

      • memory/2096-117-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/2096-14-0x0000000000400000-0x0000000000468000-memory.dmp

        Filesize

        416KB

        Download

      • memory/2096-1-0x0000000000400000-0x0000000000468000-memory.dmp

        Filesize

        416KB

        Download

      • memory/2096-11-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/2096-288-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/2096-2-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/2096-292-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/2172-119-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/2172-121-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/2608-17-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/2608-15-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/2608-13-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download