Analysis
-
max time kernel
138s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
22-05-2024 20:33
General
-
Target
6888af27473bfaa2b3cedc98a7f4ab98_JaffaCakes118.exe
-
Size
7.1MB
-
MD5
6888af27473bfaa2b3cedc98a7f4ab98
-
SHA1
9ca6b09cd836bc50684feb2b208a793c96b80572
-
SHA256
19ca2909d017c2f91bfe58b5ca08f204bec897fac866ef7eb7431895e78b3a91
-
SHA512
80ca8d90043989c073f9afa002bd2e702b5dfd6e1e5f35cab10d8339a047bc32b952b36c9d150c2cb1db9a8f7e201125cc132a5a9b526131adfbf728f363939f
-
SSDEEP
98304:JKQMP8qiQweEEXlR0U//UpNW6BdnS5vx6bvUkbNFU9:AQMP81QweEE1RlEpNW6astbk9
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6888af27473bfaa2b3cedc98a7f4ab98_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6888af27473bfaa2b3cedc98a7f4ab98_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses