Overview

overview

10

Static

static

3

JaffaCakes...e3.exe

windows7-x64

10

JaffaCakes...e3.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    29/03/2025, 17:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_8df4d6a07cad564fcd0c12419a3d4fe3.exe

  • Size

    274KB

  • MD5

    8df4d6a07cad564fcd0c12419a3d4fe3

  • SHA1

    58b23b3617e0a8098d4ae473c936804f2a40ee71

  • SHA256

    1ba0a0b4ecd9de570eca00adeb7ccdb8ad3cf0dd1eb5d650248b6c393ab9bf6e

  • SHA512

    3134f67ab259f28dc2d997ead6116e6419fab0bc8144d835f5108a27147d5dd39b4b219d7262c3af4fbf017d678a5d9cba3b6efeadcedd17ab0bdca2891ac955

  • SSDEEP

    6144:U0VYr9HD2jhgdC50ZuqUBeHu9G0SKS3IeuMUN9:U0iZsitpcGtKS3yMUN9

Score
10/10
cycbotponybackdoorcredential_accessdefense_evasiondiscoverypersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 7 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of FindShellTrayWindow 48 IoCs
  • Suspicious use of SendNotifyMessage 36 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8df4d6a07cad564fcd0c12419a3d4fe3.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8df4d6a07cad564fcd0c12419a3d4fe3.exe"
    1⤵
    • Modifies security service
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2672
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8df4d6a07cad564fcd0c12419a3d4fe3.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8df4d6a07cad564fcd0c12419a3d4fe3.exe startC:\Users\Admin\AppData\Roaming\29418\222BB.exe%C:\Users\Admin\AppData\Roaming\29418
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2824
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8df4d6a07cad564fcd0c12419a3d4fe3.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8df4d6a07cad564fcd0c12419a3d4fe3.exe startC:\Program Files (x86)\18CFA\lvvm.exe%C:\Program Files (x86)\18CFA
      2⤵
      • System Location Discovery: System Language Discovery
      PID:316
    • C:\Program Files (x86)\LP\BBA2\6F18.tmp
      "C:\Program Files (x86)\LP\BBA2\6F18.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2332
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2792
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2972
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

4
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Query Registry

2
T1012

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\LP\BBA2\6F18.tmp
    Filesize

    105KB

    MD5

    1c2bce0519de8357c7cb082d1be5ef2d

    SHA1

    d6619d654247eab6ea0e15b935e51d6048ab61fd

    SHA256

    89b05808a3d33c0cc66d7ea408fd51021e014361ec0743d12d2b9c158265ec9c

    SHA512

    c7673ebba591e5e6ca9c7d93dd51ec1c92ed2ad215cf20ed4b62abff9ee54117326118ff8c0c78e6028ea4b70b62a7c1648112ebbed5c6428558d366819c876e

    Download Submit

  • C:\Users\Admin\AppData\Roaming\29418\8CFA.941
    Filesize

    996B

    MD5

    9f7b1d9c323b7c37200f5bf9467af752

    SHA1

    25d79095f413c90f54ef012f733de9d52ed88a60

    SHA256

    a52ad99280cf2ed096de6912e81a15631aa5e5d02b28d69f5c4d3820f5fd49ab

    SHA512

    d09713d551b12d83da0f8f352c88d1101348832bfb8f8e47807d2a16353e91926118a23d1cc6c05bacda82660cee838ad913c3e3a419f0751c0d9fc220a76bb6

    Download Submit

  • C:\Users\Admin\AppData\Roaming\29418\8CFA.941
    Filesize

    600B

    MD5

    664de69a3947aed9409b5e3caab4718d

    SHA1

    20843d71a509f74bdbc49d9b415c21692279b5e9

    SHA256

    609984e212d8834a7c65f64245e988e29e6bd7ab09eea2ec0ad162859aecbf45

    SHA512

    18620cc54e4b95eee0cc4143f471cafb789b67cf0680084b2adb3d378a471185574218a444ca0990220bfbf56c5ffdf6835791479e1612622da0eb964c8eda87

    Download Submit

  • C:\Users\Admin\AppData\Roaming\29418\8CFA.941
    Filesize

    1KB

    MD5

    0e6303497159d5cef6aea2bcd0f501f2

    SHA1

    edee4be90f552bd9d3377863a2b4d0a6bdae9c9c

    SHA256

    80ee45d62057953c8ab7a857fc108ca8924beae940f39b527ad36ba66680b787

    SHA512

    ba30fd91b828919c2800421370c856fd5e804c4df9c4efa7fc64307134901b4697d0deaf7964b5fec9ca23e49cfaeb71e0eabd736baa299b64487ac873539a77

    Download Submit

  • memory/316-120-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

    Download

  • memory/2332-292-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

    Download

  • memory/2672-118-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

    Download

  • memory/2672-1-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/2672-14-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/2672-11-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

    Download

  • memory/2672-291-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

    Download

  • memory/2672-2-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

    Download

  • memory/2672-295-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

    Download

  • memory/2824-13-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

    Download