General
-
Target
JaffaCakes118_3862cefe93343f4e78a81f01fdf3acd2
-
Size
272KB
-
Sample
250126-xt1b5s1nfk
-
MD5
3862cefe93343f4e78a81f01fdf3acd2
-
SHA1
f17bd83180dfd616cb8ee3990c5998465c13adfc
-
SHA256
07c086a81e8d89e50afd21f5690a1322b17c1517cfaf2ab68705c40ee8530def
-
SHA512
61a8863ef8d83a9b53a29980219b122636b9fea511490f3daca687f66b2eb16987c1bb69dc464cf8e38fdd89aca5d0a00ebcc56c11e314bc6f36a854e7422c9d
-
SSDEEP
6144:IOuxnZzEyIbBDpVI5EDXNCeg1rrOPayaB3HfoVrn/EVpo+/qj:IOu3z2VqEDXNCegkxal/on/IGiqj
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_3862cefe93343f4e78a81f01fdf3acd2.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_3862cefe93343f4e78a81f01fdf3acd2.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
JaffaCakes118_3862cefe93343f4e78a81f01fdf3acd2
-
Size
272KB
-
MD5
3862cefe93343f4e78a81f01fdf3acd2
-
SHA1
f17bd83180dfd616cb8ee3990c5998465c13adfc
-
SHA256
07c086a81e8d89e50afd21f5690a1322b17c1517cfaf2ab68705c40ee8530def
-
SHA512
61a8863ef8d83a9b53a29980219b122636b9fea511490f3daca687f66b2eb16987c1bb69dc464cf8e38fdd89aca5d0a00ebcc56c11e314bc6f36a854e7422c9d
-
SSDEEP
6144:IOuxnZzEyIbBDpVI5EDXNCeg1rrOPayaB3HfoVrn/EVpo+/qj:IOu3z2VqEDXNCegkxal/on/IGiqj
-
Cycbot family
-
Detects Cycbot payload
Cycbot is a backdoor and trojan written in C++.
-
Modifies security service
-
Pony family
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3