Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
30-09-2024 23:24
General
-
Target
039add69cbfa3c28a5ca55eef4e9abcb_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
039add69cbfa3c28a5ca55eef4e9abcb
-
SHA1
e635ab8f479ad63b445984cf65dbec328e923463
-
SHA256
779c3c947259c02d5a9e6cd64b5ba80cd94052a977aa2a31e3a443d52d57839e
-
SHA512
bb22752e758d47be889ec65e8f94259fc5f863cef279557f72d8a7439c4b36996d025fbf3888c01cf9b6e15884da75daabccbf29d16df07f207b8955a792b87d
-
SSDEEP
24576:+wfpEyyeslTE3mxSpWmi2lr7vf8Gpi88MXnSM9ISRC2CQZqLyG2Oe3twko6jgj5m:o0C27/po6jO5tj2b
Malware Config
Signatures
-
Panda Stealer payload 2 IoCs
-
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks for any installed AV software in registry 1 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes
-
C:\Users\Admin\AppData\Local\Temp\039add69cbfa3c28a5ca55eef4e9abcb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\039add69cbfa3c28a5ca55eef4e9abcb_JaffaCakes118.exe"1⤵
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB