Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
11-07-2024 02:12
General
-
Target
37514775ce8c353351766d3c63bbe20a_JaffaCakes118.exe
-
Size
4.1MB
-
MD5
37514775ce8c353351766d3c63bbe20a
-
SHA1
0c24e04e08453e5ebb51eda74fe703bdd010801a
-
SHA256
8682b402998f5069e2922a8cec15c4ab875a104c364366e02efed84cecb49355
-
SHA512
60e746fe63898d3640f9dba29bb49966c97060b4182b38715c3dbb9e556f5828d236248d467143764a4fd47ad2c195af6f801b315b20d0c6185f20aab784873f
-
SSDEEP
98304:uCoUst7FS9W07TERUZ7imTFMSfLjb4rsLwAYtEShShLHF/w:32t7w9vYKZ7ZHfbRL1yWl4
Malware Config
Signatures
-
Panda Stealer payload 15 IoCs
-
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
-
Shurk Stealer payload 15 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\37514775ce8c353351766d3c63bbe20a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\37514775ce8c353351766d3c63bbe20a_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17.8MB
-
Filesize
3.8MB
-
Filesize
17.8MB
-
Filesize
17.8MB
-
Filesize
17.8MB
-
Filesize
3.8MB
-
Filesize
17.8MB
-
Filesize
17.8MB
-
Filesize
17.8MB
-
Filesize
17.8MB
-
Filesize
17.8MB
-
Filesize
17.8MB
-
Filesize
17.8MB
-
Filesize
17.8MB
-
Filesize
17.8MB
-
Filesize
17.8MB
-
Filesize
17.8MB
-
Filesize
17.8MB