Analysis
-
max time kernel
144s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13-08-2024 09:24
General
-
Target
927b306074fd7627714385e8dfea4a18_JaffaCakes118.exe
-
Size
6.8MB
-
MD5
927b306074fd7627714385e8dfea4a18
-
SHA1
23af8c09422dbd19d3c4ee41dd9366803532da92
-
SHA256
8dde5af4425dfa284a1cd3fb6415fa419a428c647561757292fb1b1a988e7e9e
-
SHA512
80574d03838b7c8013a108138c165f81499ed1ca975f2bfcd37dc1ebac2953241cd40dd956cf99cb3d4a03c4d98d3385ff1ce62b4c2f6f3760213cd34aec614a
-
SSDEEP
196608:Eed2XeBBW84st5j9cWbq3I3o+xi9ICMR8d:E62OHW84+j9oQX4yCMSd
Score
10/10
Malware Config
Signatures
-
Panda Stealer payload 4 IoCs
-
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
VMProtect packed file 4 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\927b306074fd7627714385e8dfea4a18_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\927b306074fd7627714385e8dfea4a18_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.3MB
-
Filesize
9.6MB