Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
08-10-2024 02:00
General
-
Target
1ef885180b8c94fde6c5e565f6db81b4_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
1ef885180b8c94fde6c5e565f6db81b4
-
SHA1
33050d1789d3c546120de50d50590c10419e8617
-
SHA256
a8068ff1d828406bdf89fc700bb6f4beac215ee18248f0afe3dbb451253b6d37
-
SHA512
cb71808409587efbdad2d41223838c9c3a706547bb24240eba51c7c1d8dcafac77314c4367cb73a96c5410860afa00064add4912310a179930c9c198b986d142
-
SSDEEP
24576:1QBRDxAlCXxX87wsRL+74l/LwwehUofEvC2eEgN/K3vuI5akK5C3:u3DSlCXSN6Y/Lx/ofWMnq
Malware Config
Signatures
-
Panda Stealer payload 2 IoCs
-
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks for any installed AV software in registry 1 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ef885180b8c94fde6c5e565f6db81b4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1ef885180b8c94fde6c5e565f6db81b4_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Thinstall\CCleaner_2.07.575\40000012400002i\CCleaner.exe"C:\Users\Admin\AppData\Local\Temp\Thinstall\CCleaner_2.07.575\40000012400002i\CCleaner.exe"2⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD50d3be9ad33ff1a4f7409d84af26ab907
SHA1dc399b72589e5873c9e1a9ef411759ddd9932db1
SHA2564a2bf92d6cd4e09a7eff7e50fd9f1b7a67b2a406cfdb636a78581b4171d269bc
SHA512258ff66fdf7834e5d97ff921878aadfeb8ed3cf1023d26f053544aa4efd26a12e08746b671ad98dc1a1f866aa37d11e36da9239ad8f50fb806776a1fee137829
-
Filesize
36B
MD5a9191faa7c16e844ccd908302fe11c06
SHA13b1f703c361f16c97de3e35e6a0a7fb00dcfb669
SHA2560ed17dff6290d17f18234871892c622712656ca3672eae6ab1211df5298df4a3
SHA512303684e5f1360ffa51d3bc82b769f61ee90deaa562c309b5b95bfe57baf796ece0dade56d0d096ccd61f8c76e5bee295bd8067abd62c21133ce445d08e17d1cd
-
Filesize
4KB
MD5918ec7a57be1ef7d1ec9348c9384d306
SHA1104f72f1e2a75af9ed5f5cc813d11d38594b7d73
SHA256b1a966318838ed22e005aa264f7e4e06526014f0c59415404d7c3a1535a01091
SHA512d6e21404628639d8b0daf2f9c8122e9a738522232490249a7af124ab6fb430c6960a59af74f91371a045340f89ccd86e0ccad3874a00361c68ce9132427952dd
-
Filesize
4KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
1.5MB
-
Filesize
5.7MB
-
Filesize
1.5MB
-
Filesize
276KB
-
Filesize
24KB
-
Filesize
1.1MB
-
Filesize
1.5MB
-
Filesize
1.6MB
-
Filesize
144KB
-
Filesize
488KB
-
Filesize
908KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
908KB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
144KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
488KB
-
Filesize
24KB
-
Filesize
276KB
-
Filesize
5.7MB
-
Filesize
1.1MB
-
Filesize
1.6MB