Analysis
-
max time kernel
136s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
31/05/2024, 23:26
General
-
Target
88b8441562f66e629334bde8b40132c2_JaffaCakes118.exe
-
Size
510KB
-
MD5
88b8441562f66e629334bde8b40132c2
-
SHA1
e7eb07017b798bf17ac05f82c3f58957f0a66d1b
-
SHA256
71a1b762cc640d1719150451591ba3db1f78d23d12998feaec3c87606059d144
-
SHA512
cfa4f397fcea68fa0a8a165148b84ede970b989f4b0e67813c3f00d8c6d0e28a9ae25eff0ec7b25bbb504f6f4f8a2b0aee4c4dab3b1b5613b909a5c2c5825a81
-
SSDEEP
6144:JknKx/nscytzoyWL9+vZTh6YI0t8CrbmsG5lDv62NvTXhCCCZPnMdVUGO74lubmO:Jk6s4552ZTh6ctSDBpjhbSPnwyGOgBY
Score
10/10
Malware Config
Signatures
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\88b8441562f66e629334bde8b40132c2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\88b8441562f66e629334bde8b40132c2_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
544KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
584KB
-
Filesize
4KB
-
Filesize
7.7MB