Analysis
-
max time kernel
141s -
max time network
67s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
27-01-2025 14:15
General
-
Target
JaffaCakes118_40637b7df1b4551e5297192c17df47e5.exe
-
Size
172KB
-
MD5
40637b7df1b4551e5297192c17df47e5
-
SHA1
4c5e50143d566ac5e88b044b28a1a42dd7eb8df5
-
SHA256
9cd3e63886b7d682c6c3a85813c263fca2d0d47dbd94c64faef588bf649b679a
-
SHA512
ab9ef664573c03a64e80d28759aa1a008a098da93e728eb8b1fd65a8018ce6f5933041629a683540ff83f818faebbb65aa2f6bf805909959f2f2658ce68b624b
-
SSDEEP
3072:OxImS8Dv2HADLdKDmyp2SIep20o9Xq/6GJsTNu+Rp4NIghAmdbh:1YvaADLdwmG2SIep2J6/6GaTNDMhV9
Malware Config
Signatures
-
Cycbot
Cycbot is a backdoor and trojan written in C++..
-
Cycbot family
-
Detects Cycbot payload 6 IoCs
Cycbot is a backdoor and trojan written in C++.
-
Modifies security service 2 TTPs 1 IoCs
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 28 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40637b7df1b4551e5297192c17df47e5.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40637b7df1b4551e5297192c17df47e5.exe"1⤵
- Modifies security service
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40637b7df1b4551e5297192c17df47e5.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40637b7df1b4551e5297192c17df47e5.exe startC:\Users\Admin\AppData\Roaming\D4AE6\91ED3.exe%C:\Users\Admin\AppData\Roaming\D4AE62⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40637b7df1b4551e5297192c17df47e5.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40637b7df1b4551e5297192c17df47e5.exe startC:\Program Files (x86)\E6F59\lvvm.exe%C:\Program Files (x86)\E6F592⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x55c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57abf7e18ee9de384eb13eba009f4a204
SHA145bd523286337b67864623cb8f5a70c1dab59e82
SHA256f2d6854be1ad5c2a10dd06156b3bc63a6136ac48e9ac7869223edf3bd1faeb6e
SHA5123e664fbd02ccbaec19c3b26233f43db0fe02f884662711af4c3dd7bd75fd8685faaa0fbe6a86307b5de204b71fa286ac389a53c8ff54718e6fcf8b43a9dc95b9
-
Filesize
600B
MD57d8dd014415d1c5b8154fd92b057c404
SHA10c12613205a07dd5dffd9b31946da6d8e142e95e
SHA25688ed8991284969eb3f61da150c4579df02b8446d08b33cf25fb36356461d9eb7
SHA5128d39e5c2e3ced215c2b8570ef91027eb3eb4e21db04f5b560ff34cf2de3d411dc3be8759caa71553bd97f301edc32aa57afd796125902d9e103a9f161958aa11
-
Filesize
996B
MD55bf20a4d8572782b441c84bda92fc571
SHA1de3d7f7bee89dde07134915651919e0a3eefa344
SHA2564ed2fcb07937fc44b071254df0c670935c80f8bcb9e57795ff063547ce33b46d
SHA512f31c8bf50f4254dab269f6ce5f126af5ac43d32bf27474d13e707cb23b3828b4286086b041a0041852bcc1fb811f90f40e63f57cf301bf95ebfe5a5259eeae42
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB