Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
27-04-2024 07:44
General
-
Target
02bfd695ecea2b103511e4bc6778a003_JaffaCakes118.exe
-
Size
279KB
-
MD5
02bfd695ecea2b103511e4bc6778a003
-
SHA1
8e32e873af163ceb1c0736e06645498115e3dec3
-
SHA256
6aeacdc72ad78c30cb2b4f3108966a40b51e8059569730afebeece8e7714ae10
-
SHA512
187c4f7786c036c3f254d6e445d703dfe125621ad20199fb909e2802af4497ed88f1bf06ef2968cdd2feb0964beee76b692167931ee8a349f041fc890130a877
-
SSDEEP
6144:V0JbGMLl8sKzy3naTVBtGXPzNld/gIpTCtrBuVUXibY:EiZsQVBoXPHlZc
Malware Config
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\02bfd695ecea2b103511e4bc6778a003_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\02bfd695ecea2b103511e4bc6778a003_JaffaCakes118.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
256KB