3c4814aae1568c8bb386e9a4f28d0142cd9ace2494be2d73fea69881942e545b | Triage

Submit
Reports

Overview

overview

9

Static

static

3

ddc830e7c4...18.exe

windows7-x64

9

ddc830e7c4...18.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

Target

ddc830e7c4a392c7dd7247bff704cb51_JaffaCakes118
Size

637KB
Sample

240913-gdf1kaxbmp
MD5

ddc830e7c4a392c7dd7247bff704cb51
SHA1

5b1bf652038a5b4c923ecc64496e9140836d23d7
SHA256

3c4814aae1568c8bb386e9a4f28d0142cd9ace2494be2d73fea69881942e545b
SHA512

d6e5364d978e72fc58a1c461e52cc885763c0044d557631c7d4047609cc25408216136a494c6ba6d2cc6bde6bda265e59825c56f1924dfc16084fdf14d69f81d
SSDEEP

12288:WiCFdcQ4wIU6MEZlQI0PsdFui/oyID6KVzU4ANdA6hQxV+2SieaG3RnMIU:Wii63MED2s+i/JIZVzkhu3exRn8

Score

9^/10

credential_access discovery persistence spyware stealer upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

ddc830e7c4a392c7dd7247bff704cb51_JaffaCakes118.exe

Resource

win7-20240903-en

credential_access discovery persistence spyware stealer upx

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

ddc830e7c4a392c7dd7247bff704cb51_JaffaCakes118.exe

Resource

win10v2004-20240802-en

credential_access discovery persistence spyware stealer upx

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  ddc830e7c4a392c7dd7247bff704cb51_JaffaCakes118
- Size
  
  637KB
- MD5
  
  ddc830e7c4a392c7dd7247bff704cb51
- SHA1
  
  5b1bf652038a5b4c923ecc64496e9140836d23d7
- SHA256
  
  3c4814aae1568c8bb386e9a4f28d0142cd9ace2494be2d73fea69881942e545b
- SHA512
  
  d6e5364d978e72fc58a1c461e52cc885763c0044d557631c7d4047609cc25408216136a494c6ba6d2cc6bde6bda265e59825c56f1924dfc16084fdf14d69f81d
- SSDEEP
  
  12288:WiCFdcQ4wIU6MEZlQI0PsdFui/oyID6KVzU4ANdA6hQxV+2SieaG3RnMIU:Wii63MED2s+i/JIZVzkhu3exRn8
Score

9^/10

credential_access discovery persistence spyware stealer upx
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Windows Credential Manager

Unsecured Credentials

Credentials In Files

Discovery

Browser Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

credential_accessdiscoverypersistencespywarestealerupx

behavioral2

credential_accessdiscoverypersistencespywarestealerupx

© 2018-2025

Terms | Privacy