Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
01/04/2024, 09:32
General
-
Target
6e667db54814bbf9cde7c00a1f9ccaad_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
6e667db54814bbf9cde7c00a1f9ccaad
-
SHA1
a2feadc2e292c60436f63cdc17a7a61ed78b9859
-
SHA256
eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801
-
SHA512
c77f5395a188feae436ac88d675d215d220bbd0fdd659522d99140c5add8edfa17f8447ce8f56f17ff22f51a2aac21ca393c01b8c46093c1c5080f9f4f3427ba
-
SSDEEP
24576:yzd9Sm6s3SB4VbhzGcHb0bBhXxtyesOlU0YOTAXnA91IV7HExDaIS:yzTSmvdcwb0VhXHlrTKA91IV7HExOIS
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e667db54814bbf9cde7c00a1f9ccaad_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6e667db54814bbf9cde7c00a1f9ccaad_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22B
MD576cdb2bad9582d23c1f6f4d868218d6c
SHA1b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA2568739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA5125e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
-
Filesize
22B
MD5da9d4d37ed68fc189027121a2353b2a0
SHA1f11493c06e2a1ecd90fcb3b0df26d24ab8e4e4dd
SHA25677ba0d5b46274294395cc7521ee72d19519954d95d05165584fe2ca6788cac24
SHA512c1063a68faa4286ebb398daf99614552589febb66994ac4fa42d089ae8e36accf28afb7df04b64a5b51eb8857e2574a83277aee41712e14b9dcdccd564cef084
-
Filesize
324KB
MD542b6ce8bb3ad66d7f3e0863d22608c35
SHA19deee3167fa2f489318f531319992b2be354f164
SHA256c32e10b9ef6de348421b6842bfce8991557f8d2e3cd2c09a0c1012e731cadbea
SHA51275bfedc8e5b6ec769900fff64b0a0453d8b9a23ba851bb2c1dda0a0c84d78d63b1b8d6fbb42f7ca3a84b604952e58ca4767bb28e3d6d98566894cb920d6bb8c7