Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08-10-2024 02:00
General
-
Target
1ef885180b8c94fde6c5e565f6db81b4_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
1ef885180b8c94fde6c5e565f6db81b4
-
SHA1
33050d1789d3c546120de50d50590c10419e8617
-
SHA256
a8068ff1d828406bdf89fc700bb6f4beac215ee18248f0afe3dbb451253b6d37
-
SHA512
cb71808409587efbdad2d41223838c9c3a706547bb24240eba51c7c1d8dcafac77314c4367cb73a96c5410860afa00064add4912310a179930c9c198b986d142
-
SSDEEP
24576:1QBRDxAlCXxX87wsRL+74l/LwwehUofEvC2eEgN/K3vuI5akK5C3:u3DSlCXSN6Y/Lx/ofWMnq
Malware Config
Signatures
-
Panda Stealer payload 2 IoCs
-
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks for any installed AV software in registry 1 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ef885180b8c94fde6c5e565f6db81b4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1ef885180b8c94fde6c5e565f6db81b4_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Thinstall\CCleaner_2.07.575\40000012400002i\CCleaner.exe"C:\Users\Admin\AppData\Local\Temp\Thinstall\CCleaner_2.07.575\40000012400002i\CCleaner.exe"2⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36B
MD5c74d0b6ab0a9ce857b2100146a12f991
SHA12ac51199f35603e06e9e94e7d16d9f86f5f8aad4
SHA25618c52e74cbf33fe4618512c14cd19ab9ffd974d9a3042fe8a951154d52043f27
SHA512f36385f69e37b0ec7775b250d4d533e66fc3272c0b4b4331f405f1dcf09f3c23003d53acb681cf42a61b817f1cf553cb0fa0e322c1cc08ebd1adc16be8cebedb
-
Filesize
74KB
MD50d3be9ad33ff1a4f7409d84af26ab907
SHA1dc399b72589e5873c9e1a9ef411759ddd9932db1
SHA2564a2bf92d6cd4e09a7eff7e50fd9f1b7a67b2a406cfdb636a78581b4171d269bc
SHA512258ff66fdf7834e5d97ff921878aadfeb8ed3cf1023d26f053544aa4efd26a12e08746b671ad98dc1a1f866aa37d11e36da9239ad8f50fb806776a1fee137829
-
Filesize
1.4MB
-
Filesize
20KB
-
Filesize
12.3MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.1MB
-
Filesize
1.5MB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
1.1MB
-
Filesize
1.5MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
348KB
-
Filesize
1.5MB
-
Filesize
640KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.1MB
-
Filesize
1.5MB
-
Filesize
1.1MB
-
Filesize
1.5MB
-
Filesize
1.1MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
640KB
-
Filesize
1.1MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.1MB
-
Filesize
1.4MB
-
Filesize
20KB
-
Filesize
12.3MB
-
Filesize
348KB
-
Filesize
1.1MB
-
Filesize
1.5MB
-
Filesize
1.1MB
-
Filesize
1.1MB