Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
17-07-2024 19:23
General
-
Target
546d2ae4811359ac99f519ddc36a7b34_JaffaCakes118.exe
-
Size
358KB
-
MD5
546d2ae4811359ac99f519ddc36a7b34
-
SHA1
d02964232311c54e86d5ad95d65c0e7e3b87d18f
-
SHA256
58db15d4b45db176d80ad7cc21b544dcec55d89543a50f1649b4eb9cd7194229
-
SHA512
034fd0c727ea190a4d539b2f5798bd0cd7b82929ee47e88edb112630633d5acac8dcd08a8598008619af1aa0d1e82330d15988e34e273f2f4978f9f3965a00cf
-
SSDEEP
6144:fH8OjBd3ICtA2GGfAcghy142UCsjMmvJgMi1SYyn8SjuG:bjzFzzYcM83TmahCnjh
Score
7/10
Malware Config
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\546d2ae4811359ac99f519ddc36a7b34_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\546d2ae4811359ac99f519ddc36a7b34_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx