Analysis
-
max time kernel
93s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
13-07-2024 06:52
General
-
Target
40a00ba5605df8bbaa13cdba529de522_JaffaCakes118.exe
-
Size
81KB
-
MD5
40a00ba5605df8bbaa13cdba529de522
-
SHA1
3c00223dcbafd95a9c548b9a98a9e615aef2e4f8
-
SHA256
e26bc00aac2d0dcb538d75f695917236f114f91b5a99ace5a838aec1661e5a7f
-
SHA512
266ae8be2a85eca8c3c26654fc749bc9b298e83763a89fa63a0aa658b3d4655dc343e759481f3c2da8e3bf3fb14a33191e6d4076a0e71676236b85af50d964ea
-
SSDEEP
1536:h9bx7QcYZ+7z90ueaGs/uHgrlcP4H7Ey66dkgrD9j0nfLZN4WZyhXaXK1o:rdAGz90ueaGs/uHAcPLykgrxq9IaXK1o
Malware Config
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
motorolka
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\40a00ba5605df8bbaa13cdba529de522_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\40a00ba5605df8bbaa13cdba529de522_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
664KB
-
Filesize
9.6MB
-
Filesize
4.8MB
-
Filesize
624KB
-
Filesize
9.6MB
-
Filesize
32KB
-
Filesize
304KB
-
Filesize
9.6MB
-
Filesize
392KB
-
Filesize
3.1MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB