Overview

overview

10

Static

static

3

JaffaCakes...84.exe

windows7-x64

10

JaffaCakes...84.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02/02/2025, 03:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_788a6d235cd2a72a7ebeb0e0a902d684.exe

  • Size

    266KB

  • MD5

    788a6d235cd2a72a7ebeb0e0a902d684

  • SHA1

    7d0ff9dbb74d4b6b3e3bd35fb06788ffb69532e5

  • SHA256

    2d2e942e949fed143aa5fe6a47694d8d073a96180d0fa895eca6bb1dcf1fafec

  • SHA512

    c76224bd3e1b7f333a2c01f0a4d4fedd52a53e086977aa885ebc37aeff5315a20bd6a98ce4d6cb7d636274e27047923110bdda78a0c3401c15e11d1d7705a8ed

  • SSDEEP

    6144:rQYhyGhpqCJOWeXdAq6UIFOsP/7Lh0flIU63Va2:jhdk3f6ySLifly3V

Score
10/10
cycbotponybackdoorcredential_accessdefense_evasiondiscoverypersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 8 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 17 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_788a6d235cd2a72a7ebeb0e0a902d684.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_788a6d235cd2a72a7ebeb0e0a902d684.exe"
    1⤵
    • Modifies security service
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1968
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_788a6d235cd2a72a7ebeb0e0a902d684.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_788a6d235cd2a72a7ebeb0e0a902d684.exe startC:\Users\Admin\AppData\Roaming\2D82C\ACAEA.exe%C:\Users\Admin\AppData\Roaming\2D82C
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1244
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_788a6d235cd2a72a7ebeb0e0a902d684.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_788a6d235cd2a72a7ebeb0e0a902d684.exe startC:\Program Files (x86)\2CCE7\lvvm.exe%C:\Program Files (x86)\2CCE7
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2796
    • C:\Program Files (x86)\LP\EA32\81C.tmp
      "C:\Program Files (x86)\LP\EA32\81C.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1048
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2800
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

4
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Query Registry

2
T1012

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\2D82C\CCE7.D82
    Filesize

    696B

    MD5

    fae8689afa13a63361653e928b6ae2a5

    SHA1

    84e67a7a263c68792ab01b727e23b3d33de75aa0

    SHA256

    f71c97d0b346a2364cdc4122cb7867727f0d4d7ca1366d4c1caeb960cad52054

    SHA512

    b50de1e1b61599e6c7e9db0a3ce9819664b8861c13395a50a399b65b24a317eae0c80c293952b4d3fde0b81d7cfefc1f1823fc92f4460f62e14bfc9be25a60c5

    Download Submit

  • C:\Users\Admin\AppData\Roaming\2D82C\CCE7.D82
    Filesize

    300B

    MD5

    ee96ced59c8dc02f3d3bef6cac87bb07

    SHA1

    2a0fc384eededb8e023fc5c3ee18ff114b328700

    SHA256

    4a5938a9a0dbfe20a66630b0a5822afb46fea562cc40b7b58c43c9a338ca5cbc

    SHA512

    a5b75edf2bc2ca95e551b340b513478ce9fbffee76d68c393663fa6ed7144ff99b2fb4a55ac86c047b650790e1c74c8db3a729216d84570648fb74fa9f25976c

    Download Submit

  • C:\Users\Admin\AppData\Roaming\2D82C\CCE7.D82
    Filesize

    1KB

    MD5

    bf0334157224d6d0f0f3618dca8896e4

    SHA1

    b8aa8ec22caf58c9ab2fa38dc493a452818af39f

    SHA256

    15dd26d5c6d76fb91dd3409cc09112f97519f6cb6b525bed559a6f65d653f6b5

    SHA512

    f1bf9e5d69ae2e5dedbeb9bd04eec340e3c7fa65691f97b118f93f0e4b9830b90dd268199f5656032cb48aadad098c9214bad0a3356e209a3985fcfabf3c9bda

    Download Submit

  • C:\Users\Admin\AppData\Roaming\2D82C\CCE7.D82
    Filesize

    1KB

    MD5

    6b1d7a81559da98054ab5a842f260b80

    SHA1

    7f3c8b830f6d742b1fabdcdf760a84b81f92879c

    SHA256

    47226880327d19bfe99ae135abe90558e508e130af4a4a1d9fe8ba7678bed489

    SHA512

    baa8c83419c7d80df39e8685b9be728b75b83e44fa2ec73a399501fc0506b5f8e7081476a5d4daf23fbc452c2c1c18fbd814c79c306f91525ae57f9d91957991

    Download Submit

  • \Program Files (x86)\LP\EA32\81C.tmp
    Filesize

    97KB

    MD5

    96927b650398afcb870ecdcdd24700d1

    SHA1

    65ffa36363861a524a21689efda38723b40e2bf1

    SHA256

    59a70ee622f4af7b5e932e6e66d49d58a79d700e0fe80fbf4dcbf586abd2c05f

    SHA512

    dd99b6f2370376d8967ce0808b9501b79230eb57f1d695304368240f3c4353516ee29f207da70c22f74ccf64eeca8a89893e3d8071b96db3e58834ee5aca4df9

    Download Submit

  • memory/1048-245-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/1244-14-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/1244-15-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/1244-11-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/1968-12-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

    Download

  • memory/1968-2-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

    Download

  • memory/1968-3-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/1968-0-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/1968-244-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/1968-120-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/1968-9-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/1968-302-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/2796-123-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/2796-122-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download