Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 19:23
Behavioral task
behavioral1
Sample
31a8756b48576862e6312bdc063fa94b_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
31a8756b48576862e6312bdc063fa94b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
31a8756b48576862e6312bdc063fa94b_JaffaCakes118.exe
-
Size
378KB
-
MD5
31a8756b48576862e6312bdc063fa94b
-
SHA1
b463b6d251a26a86a1f1472d6dbc0d953f4b4d5c
-
SHA256
9fd8ae4b3bf5dcc239a3ea97e113683d1eb3ce564987109ccbeb2b2565c47d15
-
SHA512
f436e13c9b6886b5ea5367d906d10f3f6ad596b969f205f7ceab5bcc9a1f6044e5a08a2c74ab6e09071c86f8c8fc9fcb661920e34f0208fae663ad44f9a813d6
-
SSDEEP
6144:HMrDwd7lMQ5BCljd6S9Kt0CvvpoUqXxxRuoC2JrgWCSaLRXYh/qiJlzZPWzLoKHf:HqEd7lMY43Kt0CXSUSXagEs/RxWAkf/
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2912-0-0x0000000000400000-0x00000000004EC000-memory.dmp upx behavioral1/memory/2912-1-0x0000000000400000-0x00000000004EC000-memory.dmp upx behavioral1/memory/2912-7-0x0000000000400000-0x00000000004EC000-memory.dmp upx behavioral1/memory/2912-10-0x0000000000400000-0x00000000004EC000-memory.dmp upx behavioral1/memory/2912-13-0x0000000000400000-0x00000000004EC000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PromoReg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\31a8756b48576862e6312bdc063fa94b_JaffaCakes118.exe" 31a8756b48576862e6312bdc063fa94b_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2912 31a8756b48576862e6312bdc063fa94b_JaffaCakes118.exe