Overview

overview

10

Static

static

3

3074035390...18.exe

windows7-x64

10

3074035390...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10-05-2024 18:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    30740353903640073049d2d5e63fcb6c_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    30740353903640073049d2d5e63fcb6c

  • SHA1

    0b8afb1147c7ca48fcf1560a85932c9c2b59130f

  • SHA256

    94afe7d00b1c901c7a5868f637f673b2b7922f5dbbb2a907ce9b9ba5afdd8e61

  • SHA512

    ab94f625cea82f3ee28d3df58934f36c438851448e94fd7059a8595e554919f6372db3f4bc56d972d9122e719dbe4d38f4a350d7d2287c4c124c9dd26d99b9bd

  • SSDEEP

    24576:3Hw4EFankbeWmvQ8DRYQLpkZD8kb9F4NPxs6eFKqBIT9OX:3TEFdH8DRYWpk3b9F4HPeFpBW

Score
10/10
poullightspywarestealertrojan

Malware Config

Signatures

  • Poullight

    Poullight is an information stealer first seen in March 2020.

    trojanstealerpoullight
  • Poullight Stealer payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\30740353903640073049d2d5e63fcb6c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\30740353903640073049d2d5e63fcb6c_JaffaCakes118.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1756

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\vmak70xciu5
    Filesize

    92KB

    MD5

    bbe71b58e84c50336ee2d3bad3609c39

    SHA1

    bdd3227b48977e583127425cbc2f86ff4077ba10

    SHA256

    b25b7e57924b2382d3178696782b51fa62b68fa7e763081d7a53471cccc1ff3c

    SHA512

    07fcac6778f114fb372dac7ed489624b8e0aed347bc14af77ec36b5201df8b3d99e2a69a384756606030bb146f5c0780f39a274dc5a4b4f6863746ec7fa2ca2a

    Download Submit
  • C:\Users\Admin\AppData\Local\h0-gnkym\Skype\data.txt
    Filesize

    55B

    MD5

    f42b48302a71c9b07559c714520a5691

    SHA1

    56961243dbdfd2663ff593367170eddd789acf53

    SHA256

    16c37c7a818dd689367d4c89d548338818b839bde3b2f0498dc8c854097d34a7

    SHA512

    a84dcda6a4f4dcf8968e123f173b4db2b2700e9ceb7787488c6d46ec2404096e59807f6878f6b6d7613cc838e5ce13be932771578a4f088ad59492eba9094504

    Download Submit
  • memory/1756-0-0x00000000003F0000-0x0000000000774000-memory.dmp
    Filesize

    3.5MB

    Download
  • memory/1756-1-0x000000007425E000-0x000000007425F000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1756-2-0x00000000003F0000-0x0000000000774000-memory.dmp
    Filesize

    3.5MB

    Download
  • memory/1756-3-0x0000000074250000-0x000000007493E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/1756-61-0x000000007425E000-0x000000007425F000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1756-62-0x0000000074250000-0x000000007493E000-memory.dmp
    Filesize

    6.9MB

    Download