Analysis
-
max time kernel
119s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
19-04-2024 18:40
General
-
Target
faee06a90a9cbbff9407ced9494fd7c3_JaffaCakes118.exe
-
Size
3.3MB
-
MD5
faee06a90a9cbbff9407ced9494fd7c3
-
SHA1
c580e0907ef1bb5b5728a53beec4db14bc153625
-
SHA256
34f27154b9594d049db97fa647be0bcef4228bed786e21f4899ca0da3e0874f7
-
SHA512
a83d279b26106e8921b15f8f5db88d28567e975b4980f52958d7f19db130b19ecf43f979817c4d3c99ebddabdef1104ba22fd23f4e31c255d1f87f9e8c214ba2
-
SSDEEP
98304:SVuD8LsOi4HhOqylicerYxyQHWjv41ABa8ep:SVe8L5Oqz7cB71ABa8q
Malware Config
Signatures
-
Darkstealer
Darkstealer is a file grabber, data stealer, and RAT.
-
Detects Echelon Stealer payload 1 IoCs
-
Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
-
Echelon - DarkStealer Fork 1 IoCs
Payload resembles modified variant of Echelon Stealer called DarkStealer.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\faee06a90a9cbbff9407ced9494fd7c3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\faee06a90a9cbbff9407ced9494fd7c3_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.2MB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
8KB
-
Filesize
960KB
-
Filesize
9.2MB
-
Filesize
960KB