Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09-10-2024 01:43
General
-
Target
289ed07cf024d8f1cedde485efdd2193_JaffaCakes118.exe
-
Size
564KB
-
MD5
289ed07cf024d8f1cedde485efdd2193
-
SHA1
65f17edc9ccdec47ce74d7b1db107acd8c5fd4ed
-
SHA256
1a2d70bec3493d947460ac875a5991134a68a14afd01937d510e8d97c7a158bc
-
SHA512
384861f5d6f0e193a748c4d224b04e59f507825921abb841a7332015d326b128499eb6d2ed43fb73175e0d7c145cee29f377629220a67568d2a70c91387d5668
-
SSDEEP
12288:a/XM4DShe9EcHPLrLZ5AICgkHP3/vmQgKLzvlu2yDk7qAU:aM4DSs9FvzAICgkHjgq3yDk71
Malware Config
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\289ed07cf024d8f1cedde485efdd2193_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\289ed07cf024d8f1cedde485efdd2193_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery