Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
27-01-2025 22:09
General
-
Target
JaffaCakes118_442059cac43d01d07ade2b406cb4b479.exe
-
Size
177KB
-
MD5
442059cac43d01d07ade2b406cb4b479
-
SHA1
a745ebfa7e26de31017e9df35f8041f36f960244
-
SHA256
9a5408f93ab95b1323b4717fc9aa491f0cb8eea6c35651bd6205e55a646107c1
-
SHA512
d886e63778f85ec536848fd79f6005a1686a81beadf1d61c4e1a61e80dcd0ce109bb2d7fbd61ed84c778c30bf397bb6b0c494dfde8b321249966281c90978365
-
SSDEEP
3072:ZEfjF3/el3EEDWobFxQpseuIBU/p8ZtfeG47RMIELEzJ4D3TPOlHDRu3:CfR3YpxWsebBi8X2H76ZkuDjmdg
Malware Config
Signatures
-
Cycbot
Cycbot is a backdoor and trojan written in C++..
-
Cycbot family
-
Detects Cycbot payload 7 IoCs
Cycbot is a backdoor and trojan written in C++.
-
Modifies security service 2 TTPs 1 IoCs
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 3 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 15 IoCs
-
Suspicious use of FindShellTrayWindow 28 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_442059cac43d01d07ade2b406cb4b479.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_442059cac43d01d07ade2b406cb4b479.exe"1⤵
- Modifies security service
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_442059cac43d01d07ade2b406cb4b479.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_442059cac43d01d07ade2b406cb4b479.exe startC:\Users\Admin\AppData\Roaming\D10CA\AB23D.exe%C:\Users\Admin\AppData\Roaming\D10CA2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_442059cac43d01d07ade2b406cb4b479.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_442059cac43d01d07ade2b406cb4b479.exe startC:\Program Files (x86)\CA07E\lvvm.exe%C:\Program Files (x86)\CA07E2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD578a8944ecbea7c9752fbcfd1a7ef48e6
SHA13466217b40f14cec5552bb6ebe338b10a3342efc
SHA256f9f147b123c1491dc81c07bd765a8a38813ef9a33de2e75bcea1ef550e32db79
SHA51278fd160db511d1caef0e5aba5dddcd9a41411f53190cfc70a22b3bfeab57951e9912f2e1fcdf1eedd7314ce1dd09c4946b0d9c71e397d840300869dde139db6a
-
Filesize
600B
MD55a4d5cf7266d5468d3000d25c5eb6887
SHA1bb98b8b94d2ea183e35b4a82be71ead8684fb668
SHA256c113cdc3f5fa768439b82214ba69de16e9e5b38996051e1a6fd80dd853d1df61
SHA512e19c101ec0af40877bad91948ae3006557514eeeacc4cc1295c478bfa53103e40d4802d606b20545c575e6da9905e90a0331fa0c4b9592f65a86f73320861a32
-
Filesize
996B
MD5ea1821dbe138d0b9386e621b3ad77a71
SHA148f460f004f3936cd985ae17361be640c3417a05
SHA256c452b4173f439cff32215d50c8db27a7b8f10f02fb1f97016d2285d52b2c99bb
SHA512bde822fa29a8c5dbeb1e44861ad67f13b6995dd35a8be8b738e72abec74dae93b69811f4fc6e88d1b085283fd4bfa0a718813e12dc7e28f2b00141f1cc464078
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
316KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
316KB
-
Filesize
396KB
-
Filesize
396KB