Overview

overview

10

Static

static

3

JaffaCakes...4c.exe

windows7-x64

10

JaffaCakes...4c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30-01-2025 21:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_66e8c3a47bccc28520d2b90d47cca64c.exe

  • Size

    280KB

  • MD5

    66e8c3a47bccc28520d2b90d47cca64c

  • SHA1

    ccc6d97ae47fd11bd18b1b29ed103550686cefa8

  • SHA256

    111d69fa077a4e5fde4125a33e1672d274714ed0565587d5d2e149df5a5c68ec

  • SHA512

    e3d0dc3f03e78e2f5a3f016a8da41221e7f69df0a677247424b5e5d8f7cf0c786e9d56ef28c085575fc6f20b73084930689a26d25a19717272c0a152bac01d78

  • SSDEEP

    6144:WNLcGZ3WKCUJuqkw/xI/Qlzpb2tv0dQ0IaaMARuI7Mcj8:W5cGZGbUeR/QzxWRvP8

Score
10/10
cycbotponybackdoorcredential_accessdefense_evasiondiscoverypersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 7 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_66e8c3a47bccc28520d2b90d47cca64c.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_66e8c3a47bccc28520d2b90d47cca64c.exe"
    1⤵
    • Modifies security service
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:944
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_66e8c3a47bccc28520d2b90d47cca64c.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_66e8c3a47bccc28520d2b90d47cca64c.exe startC:\Users\Admin\AppData\Roaming\5136A\1F0DC.exe%C:\Users\Admin\AppData\Roaming\5136A
      2⤵
      • System Location Discovery: System Language Discovery
      PID:744
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_66e8c3a47bccc28520d2b90d47cca64c.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_66e8c3a47bccc28520d2b90d47cca64c.exe startC:\Program Files (x86)\6A15E\lvvm.exe%C:\Program Files (x86)\6A15E
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2868
    • C:\Program Files (x86)\LP\DCB5\6BED.tmp
      "C:\Program Files (x86)\LP\DCB5\6BED.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2748
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2336
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

4
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Query Registry

2
T1012

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\5136A\A15E.136
    Filesize

    600B

    MD5

    563648f3302efbb592ec7843d64c1aee

    SHA1

    8802ff1f65d963c7718781806644507a4e683a1b

    SHA256

    5689056a921168403fe5f35588bc9e0b35e58200efca862f01e4d2949dbcc861

    SHA512

    3566b66ec45e019e28095b5da6d6086d2d94329b4dc6bd78bad92b71cfc3b6e5241d066b747eac0a3ac8b3b149ff331283ba9f97f1e89835f450584f0fa9cab7

    Download Submit

  • C:\Users\Admin\AppData\Roaming\5136A\A15E.136
    Filesize

    1KB

    MD5

    029a0f625cc4a2bd350bd99b9a3ec3c8

    SHA1

    a125097b7b76fe59fbc0a781ae65f6cd2a6d474c

    SHA256

    c83daab71b4a5f1373ede7a6b9ef9969b7300c156aa07a72fb86185fc8efc19f

    SHA512

    9a3c59ae29a35564c82cfff894e8a4a1f5c9f298a3984ecb15bdfb087f83f25b31a935d2a704ad5bbc125b691eee623b610a364f7886ab5854404b57f4131f55

    Download Submit

  • C:\Users\Admin\AppData\Roaming\5136A\A15E.136
    Filesize

    996B

    MD5

    64f18b63195e1790f9073e13d7f28b05

    SHA1

    495aeb64ef2af0d7e9b1185e2c34300b9d3afd7e

    SHA256

    c8a234827c29fb5e5f838d5036e92456804316fe17a8939e81e2706d54052398

    SHA512

    89872f4c623cce6ee797ae368a1d933aaf06090c5a2d24db481596af91fa7e20a6b2a86629b3e3ae24a97a2237f3c6f7ce56bdd97f6824fb119f71dab2b4cf50

    Download Submit

  • \Program Files (x86)\LP\DCB5\6BED.tmp
    Filesize

    100KB

    MD5

    bfc2cd6d0b7e0440413c1fa500d0bd78

    SHA1

    6b269d638bb04bb7b94b7572f3f93db0d5130e8d

    SHA256

    96f7ce07e7a6eb6e73c61dcb55efe9ca941795a1f12d2c001bb87783874697f2

    SHA512

    54c1fdca1c35c79f9147a3ec65c271f99b3d9a5d8c5e4f5d04fd5989dc81f05685a6eae691e28148585de1e7028469512a52ff2b7b32d45687fe9d393a1b0016

    Download Submit

  • memory/744-14-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/744-15-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/744-16-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/944-13-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

    Download

  • memory/944-84-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/944-1-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

    Download

  • memory/944-11-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/944-2-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/944-207-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/944-211-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2748-208-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2868-86-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download