Analysis
-
max time kernel
93s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
04/07/2024, 19:45
General
-
Target
2609ac3ef3d06da4ceb703dd3206f48f_JaffaCakes118.exe
-
Size
77KB
-
MD5
2609ac3ef3d06da4ceb703dd3206f48f
-
SHA1
860ab2168ce49b86e2eb9013f38fac8e13471a0e
-
SHA256
00edbdf03b27bf63b379c087015c563871b07e2da0804d3c939c20bdf6a5e64f
-
SHA512
930774ff44e2004ba134cfee70cebbbcae8cbe44621c9f0a238ce6075f98a95fdd8a8d95a284415a60828888d90d90e21b22c3747339804dc4c477bee5c77dda
-
SSDEEP
1536:AMXdGV7bMWWOFkV0du8uFSoyRI57ZBYIHO43Tya8g9p9d0zUe:AMXdGV7tqiY8uFHyO57ZB5z3Tyoqr
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2609ac3ef3d06da4ceb703dd3206f48f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2609ac3ef3d06da4ceb703dd3206f48f_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\datei.exeC:\Users\Admin\AppData\Local\Temp\datei.exe /stext C:\Users\Admin\AppData\Local\Temp\text.txt2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD590d77745113079fed0faf945c6f9c915
SHA1793367afbb4caf0df938748e3999ab386fe1b077
SHA256c5343f6d06b70bc2f4ce38e34934d0f6078145ab92845feecd8952a290dd8973
SHA51281faa265b35a6fb8122ebded02b47a86f107357da2dc4673cfd4bf925e42eb83550e35368043499b290921f5e62194c9e1b5570748a9f5df65791edba72873bf
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
304KB
-
Filesize
32KB
-
Filesize
624KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
4.8MB
-
Filesize
9.6MB
-
Filesize
64KB
-
Filesize
664KB