Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09-07-2024 06:59
Static task
static1
Behavioral task
behavioral1
Sample
2f638bbf1afac418ff54d0b41fb46f94_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2f638bbf1afac418ff54d0b41fb46f94_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2f638bbf1afac418ff54d0b41fb46f94_JaffaCakes118.exe
-
Size
567KB
-
MD5
2f638bbf1afac418ff54d0b41fb46f94
-
SHA1
666f45633710b57a9350a8ce2f534d505245dd37
-
SHA256
abe206d59751496351baa7b7b6408c1263bee203cfddcaf7d48e31f62a0b4939
-
SHA512
cfb81c94749848047e1fb62195517b1aff30880ec170e76c9ce85683d75803c9ff0e38168b21bfe2fc92d428948bd769ced6c81dcfbe8290e214dea63f935e1c
-
SSDEEP
12288:+OLtXrAYDLH9tK1q5mUo4K55Ke4ao4X0k/NBcDOnH:TUYD7fKkIcKjKvBGnnH
Malware Config
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1952 2f638bbf1afac418ff54d0b41fb46f94_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1952 2f638bbf1afac418ff54d0b41fb46f94_JaffaCakes118.exe