Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
19/07/2024, 03:13
General
-
Target
5a3eddd6036ba673d27ac4e8d0ea201c_JaffaCakes118.exe
-
Size
870KB
-
MD5
5a3eddd6036ba673d27ac4e8d0ea201c
-
SHA1
4ac4a14141abf5765e0e2e26b9dbb957fdd5fa02
-
SHA256
e2d74a5476298f23a533e700b10ace6b0ad176d0700e211e1e9188d277ba1197
-
SHA512
5d4ec7bb2a7848adbd8504aad5db1e479af85b0e42f4ffd3aa5a1405134be0f1ad028b99cbb97af9819ba72caa417880fe8ad1683a65ccf0714db82251660b4f
-
SSDEEP
24576:Arng3WCqJuQljT05KYAWdtxEfefO+fCRIeJ:Arg3WCquQ65SWrxEAqWk
Malware Config
Signatures
-
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a3eddd6036ba673d27ac4e8d0ea201c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5a3eddd6036ba673d27ac4e8d0ea201c_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
824KB
-
Filesize
888KB
-
Filesize
2.2MB
-
Filesize
2.6MB
-
Filesize
2.2MB