Analysis
-
max time kernel
143s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 18:03
General
-
Target
3b5d99125885b1c32abed26ac03d0914_JaffaCakes118.exe
-
Size
914KB
-
MD5
3b5d99125885b1c32abed26ac03d0914
-
SHA1
9301d37522f15f069d1d4a2e653798d192010872
-
SHA256
9feb0c47916fbf71800452abdadf9c200ff48ad94e845ba32a81dc253c7bad07
-
SHA512
080dc554413a52714bcc68a97efa966eafb21ee935075ce397abe3a97b982d44a86de7ef5981023cd23516746dbb8bbb73debaa9815ad57eeca7f440949dcd70
-
SSDEEP
24576:ESyMJfstrtr5cdy1hppe+7h9jFF0nXlTLR2utEch7+Eh:zlJfsxtlcUfppbDpoV3RzEcd+A
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 56 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b5d99125885b1c32abed26ac03d0914_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3b5d99125885b1c32abed26ac03d0914_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156B
MD51ea9e5b417811379e874ad4870d5c51a
SHA1a4bd01f828454f3619a815dbe5423b181ec4051c
SHA256f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a
SHA512965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa
-
Filesize
6KB
MD52ceb27c6ac9337b69c12261babf9de58
SHA11be81527901eab19a6de55888e8c9a4a21477d3b
SHA2569505cecd87caacc12391df26392d61f8b7b8221d9f9bd14d42c4db2d20cf396f
SHA5126ba10616f1689b9706e21d2e6e02aa3d1fa58aaf5e5f26be4c38e7335cff7dc17db6b9945867032a35a631ba639b1a19fc770d6e341a4994112da68b565abfb7
-
Filesize
506B
MD55335f1c12201b5f7cf5f8b4f5692e3d1
SHA113807a10369f7ff9ab3f9aba18135bccb98bec2d
SHA256974cd89e64bdaa85bf36ed2a50af266d245d781a8139f5b45d7c55a0b0841dda
SHA5120d4e54d2ffe96ccf548097f7812e3608537b4dae9687816983fddfb73223c196159cc6a39fcdc000784c79b2ced878efbc7a5b5f6e057973bf25b128124510df
-
Filesize
153KB
MD580b8558bb89dd8f78f4de8cb26feb678
SHA17d77ed3a570b0b73af222bb5da902fbc7498956f
SHA2565b346551b962f7f920d8bf18a43665f4782e0bb6d75c9474e88dcf3e01cede31
SHA51271f3074ae0f26a98e19def61017167de06e7189d9525b86cb60ff56f7645b2ff0be0e1fae61cba4533c1bbadc4e768bf771a3b2b706c66a58fd4e584f05afd53
-
Filesize
1KB
MD560e7a3f760637dd125a1150474e7f6bb
SHA146e4b53480dd7b3db532e3511a7ad3b9e99b2f48
SHA256d244e6d623fb3706340ead5491bb61663e5d53a3f7d96d4b613175c875c42184
SHA512d279b197d330c4fe7de5e891b45e60273b603d58c84a502461ba2edf008ed51e6bcfd8768a74ee95bc9558bcbe8294f9f759c188327f7c54b1483d1072b32268
-
Filesize
1KB
MD562d7273f7bfd374313f6fb0155b2e7f7
SHA1dcc738108fa120a4d8ec47ff3e6e71c336c59c16
SHA2568c7b475a063df4c3a3aaa79c26010eddc3259ab91d8ed904a539e17eea8e5caa
SHA51276b316228fefc32424236019e931626611e9b50944960ded528a1e7f6c33b102f9f1326d758411b65fa3c96e99de222324ae3bc85989435da434005245d25a0b
-
Filesize
3KB
MD54494970d8270d72c85faa39e600cd6c4
SHA11a083424cf97a015798b2d87d1d3ca0dc609e780
SHA25658d6b88a87b14121a6c1b4c92414a39a5a6404c245424b95d2877ed75ea88f67
SHA51289b4f860073f65d8f1898afd536d7fd27928baec80099f44f4d911df4828d66efa80495bc75e37f2bd1e4ba5930455fe0bcff5f5570c933618f0c5678d9e0945
-
Filesize
3KB
MD5b83749cfe0e95eb06f7d54bc53ca9c41
SHA10031fbbd170d635abece51d38b52775123415241
SHA25689c1b13b0de232cc8fa6f7276508b26ebdf12760726f8d8cc41f7b9d869042c0
SHA512447a1895a028daadb0b91a7349cd3308be2a38cc6cb066268a5a9402ee8a89605b6352c9214bcae742e10d4d545fcc09d5594059385292c8666fae656074877c
-
Filesize
2KB
MD5377a4cc417c35e8bca043b5fa45c76f4
SHA1bba1d0a63c01c777536008dc177e8c8e3d1f3d0a
SHA256d6476ab7dab6839357bda90d337593833f42b95f474ee358db9ddcd5b689c2c5
SHA512b6a5d34089d830ba39194d7a40b7f394609b5dd4c3297f9e168f66d41e8ca29ef84cb46a3dc59ca305235e8ce33fb0c52766056fede28405b9f78f2382d1b4e8
-
Filesize
2KB
MD57af396fe907f2279c7be2f45c4a71f68
SHA1e2915cd58658e004a528d6afb41a719e2f8bc906
SHA25679aaaa8a2c4196a8fe5608ed9638c02febca9a5f01aaccd024741543893c10a7
SHA5124b32408f9f8e101f93150fa991bbf7048b87d73ef284f1ab6b70e377ddf4dbd55d256a8be303f1a687b2b5d072444bd80fcf4905417524392dc4406157a5bdde
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
100KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
36KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
