Analysis
-
max time kernel
122s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
17-10-2024 21:11
General
-
Target
53c17b33c0397db5ca6c944255d1f81f_JaffaCakes118.exe
-
Size
12KB
-
MD5
53c17b33c0397db5ca6c944255d1f81f
-
SHA1
c11c7d19d82c9ecce01e10b79c783ad280f93a1b
-
SHA256
5cf7a543cae18e1b613f65b278e7bf536e491c8cf9a30551fc91c367a61462e2
-
SHA512
1f86ab59a6be40fd8abe88c0b96d8b7a85ad28ded5e4414cf236cec6e38afb3e63a0b019cdd7ec2c5df83e3dd8b9dcf26f9fc215d4d3db61e21afc853ce33b72
-
SSDEEP
192:C/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMjox:CebFNw4Pk1itKkpAjjI2Ypdmjox
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\53c17b33c0397db5ca6c944255d1f81f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\53c17b33c0397db5ca6c944255d1f81f_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class