Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 21:17
General
-
Target
3c147e4cad850c360e9fba39d4471685_JaffaCakes118.exe
-
Size
1.7MB
-
MD5
3c147e4cad850c360e9fba39d4471685
-
SHA1
9e84e0ecf8c63f964b8b040197df8f70cb81f1dc
-
SHA256
d4d1c5c9fddc6680f979f4f1e78812bfb13153ca2718dd210e775cc835386582
-
SHA512
03f10b9fddea6e97a10b7ce88e2daccb0294843ddc0ea7cc6e2fe83cb6a90ee39d838cee7551c4cf94e924869bc7e9d203575ca9483774bb8228458e25d3fde9
-
SSDEEP
49152:tiS1UQRIOFrzqV0zL3puF6e1PRKSIs9Mn5sJM2JAgxgly0:MS1UQRHFrk0361PRKS7xTJruv
Malware Config
Signatures
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 4 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c147e4cad850c360e9fba39d4471685_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c147e4cad850c360e9fba39d4471685_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\StormKittyBuild.exeC:\Users\Admin\AppData\Roaming\StormKittyBuild.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\WotBruteSBcracked_boxed.exeC:\Users\Admin\AppData\Roaming\WotBruteSBcracked_boxed.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD555a0652ed4a43f8df6a905465b6c0ffe
SHA1ad3e826e19ad76a9bafde5aa7e641b7ed0fc830a
SHA25663b28cbb234eadee6878ad7d1260d67127b760a7eb9f7abfddd20eb0410b5152
SHA512c375747a7425d1cb864571a9dad8e5a7545bdc890eb341f377901bd460a4443cb03699f312cb9fac2b7e855753de288b49c2119dd94d76ff358e981954448a94
-
Filesize
309KB
MD54813614a3144b6be136f35ac592bda06
SHA11bbe7a993fdf7daf2497785beb10e95c8f9c2cc1
SHA25685e65021df1039c606f9a1b71581a2c829a2617a05e5366033ac92d5597b1ee9
SHA512859259889c07c03b525b97c239f6db2370a485d8b2e8f244e457d5a77c9ace9fe2ba7831b0106b04bd34eb6b9c5c2ea47e365445461a1bf47ae1d6d2699f3b9e
-
Filesize
3.9MB
MD5be079a3a510082fd2f1a482d81a960a5
SHA160a87bf062da45678cf011dd093e8b80985fcad4
SHA256bf2a9b6812b8f2433178b23f61dea16ecbba93dedc52775cc652eaa6a26c365b
SHA512b9bb702e58523dc1fa3416855a12e0834a3b3b0b71fc95087420e6911797f8479605113512ed642d0158a6f53cee12bb03ac13e64a433b02e899c538d57d8427
-
Filesize
64KB
-
Filesize
320KB
-
Filesize
464KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
160KB
-
Filesize
424KB
-
Filesize
712KB
-
Filesize
4KB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
4KB
-
Filesize
712KB
-
Filesize
4KB
-
Filesize
64KB