18d217ab1c6a0ecf4bafc48381e41908df78e63d09e2ed7fd4a010145e96caed | Triage

Submit
Reports

Overview

overview

9

Static

static

3

b2134eb920...18.exe

windows7-x64

9

b2134eb920...18.exe

windows10-2004-x64

9

Sharing

General

Target

b2134eb920da4a4da1ee10954594db83_JaffaCakes118
Size

636KB
Sample

240821-eww4dszbqc
MD5

b2134eb920da4a4da1ee10954594db83
SHA1

ee9ee5ab64aa82de0877f6dc5bcce66557d4d794
SHA256

18d217ab1c6a0ecf4bafc48381e41908df78e63d09e2ed7fd4a010145e96caed
SHA512

d57b59eae1076ea71ee3853d68c45fdca4023052f2efeebc155917bba3d8874141db18f2518e8a7dfdc5836588098ea5ef69269e56a65dbcd9afe91adb2333d8
SSDEEP

12288:fTqGBLl+LewWVZc6UtWHha81aSAt8KHdLzo1wljd0eDX6GvSJRuy:JLl+iwWVlUtWA8Y8K93o1wljd0E6USJn

Score

9^/10

credential_access discovery persistence spyware stealer upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

b2134eb920da4a4da1ee10954594db83_JaffaCakes118.exe

Resource

win7-20240704-en

credential_access discovery persistence spyware stealer upx

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

b2134eb920da4a4da1ee10954594db83_JaffaCakes118.exe

Resource

win10v2004-20240802-en

credential_access discovery persistence spyware stealer upx

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  b2134eb920da4a4da1ee10954594db83_JaffaCakes118
- Size
  
  636KB
- MD5
  
  b2134eb920da4a4da1ee10954594db83
- SHA1
  
  ee9ee5ab64aa82de0877f6dc5bcce66557d4d794
- SHA256
  
  18d217ab1c6a0ecf4bafc48381e41908df78e63d09e2ed7fd4a010145e96caed
- SHA512
  
  d57b59eae1076ea71ee3853d68c45fdca4023052f2efeebc155917bba3d8874141db18f2518e8a7dfdc5836588098ea5ef69269e56a65dbcd9afe91adb2333d8
- SSDEEP
  
  12288:fTqGBLl+LewWVZc6UtWHha81aSAt8KHdLzo1wljd0eDX6GvSJRuy:JLl+iwWVlUtWA8Y8K93o1wljd0E6USJn
Score

9^/10

credential_access discovery persistence spyware stealer upx
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Windows Credential Manager

Unsecured Credentials

Credentials In Files

Discovery

Browser Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

credential_accessdiscoverypersistencespywarestealerupx

behavioral2

credential_accessdiscoverypersistencespywarestealerupx

© 2018-2025

Terms | Privacy