Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
-
submitted
22-06-2024 21:45
General
-
Target
03f7e21506f089d657a6c04c55902976_JaffaCakes118.exe
-
Size
5.7MB
-
MD5
03f7e21506f089d657a6c04c55902976
-
SHA1
dda208c6619d4e43107666bc6f8a5f84b6cb768a
-
SHA256
8a644dfd2abc6310fc90f7e6908c373190a956544a4fd15de05fc5974704e7d5
-
SHA512
edd93821c820d545610fd1fe5703bbbc4b908b18f2d6020d4e12926207928c4fc99c69c7ec797a745f7bcabff31c2d7b9df1cc50627d5f4fa2a28f9c7f2c82de
-
SSDEEP
98304:qMbTbHYM2WwqOJ4V9PTs8yuCtJ9IL6VkS8nNSlR/W/2l/zAbPppEiPu3mz7:l/HYVtqOJqTsVvXILUkS8NSlR+KsnExw
Malware Config
Signatures
-
Panda Stealer payload 3 IoCs
-
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
-
Shurk Stealer payload 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\03f7e21506f089d657a6c04c55902976_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\03f7e21506f089d657a6c04c55902976_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
3.3MB
-
Filesize
9.4MB