Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02-10-2024 03:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
General
-
Target
08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe
-
Size
3.2MB
-
MD5
08a8c76663ccda0a3b6d84485cc0632b
-
SHA1
e0bd0a16fa3f5a1b8a861f72a051e0c614c136bd
-
SHA256
ee8e2a13038093f97843b00f264c1aaf093110806a00b6ce414c0c1471c2d01b
-
SHA512
9431b5d21cc41e643a5cb8dc8b299c919e8e36da3047747456b7523b684396705912566c29300447e6aa87a068b98544b71a3327901c7d9dc9f08fa8047a8a1a
-
SSDEEP
49152:3OstrL8hCU/YIp5B8r35GQiVpHa/zQ8xgmcAu96+GUxp95gGlB8SU:TAhCUgIp+UlVv+z66+lgGf8SU
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe Token: SeDebugPrivilege 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe Token: SeDebugPrivilege 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe Token: SeDebugPrivilege 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe 2392 08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\08a8c76663ccda0a3b6d84485cc0632b_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2392