Analysis
-
max time kernel
93s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
27-09-2024 12:34
General
-
Target
fa6ab02d2faa908e5da1746f76da402d_JaffaCakes118.exe
-
Size
17KB
-
MD5
fa6ab02d2faa908e5da1746f76da402d
-
SHA1
a1272352b54472cac13fb8039c14218947af44e2
-
SHA256
a7edf2bb07e3647802f0c8cf40275d97e19a3e159418ebf493b9a6481a05fcfe
-
SHA512
57a73b8a24173007cd7a853b9d16e35e3c3015580ec7c68b85caccca9b9ba6e31904710b82d09957be79f2de49c7f679be0467d62276b1f3b07f551287c00334
-
SSDEEP
384:YpmJRTSf71qz1SdZd5zs9xv9CmnarF7FUjq4EMOnNV:AmJRTSf71qz1SdZd549xItLx
Score
10/10
Malware Config
Extracted
Credentials
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
umut19055
Signatures
-
Growtopia
Growtopa is an opensource modular stealer written in C#.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa6ab02d2faa908e5da1746f76da402d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fa6ab02d2faa908e5da1746f76da402d_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
40KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
7.7MB