Analysis
-
max time kernel
141s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/10/2024, 10:38
General
-
Target
56f9708ee2642f5fa1f60603df7bc430_JaffaCakes118.exe
-
Size
888KB
-
MD5
56f9708ee2642f5fa1f60603df7bc430
-
SHA1
92602ef1d21d545c8e502c65356170f4db45796e
-
SHA256
e54941b5731833117b3264ed820636a7f22fcdba204929138cba2b838ea578f9
-
SHA512
5d8b0f94fa7ec28961315ad0ddc74dc99278b349d7ad0a758ede3b7e7ec2dd250528d839964a432a2597d13cb080a0a898b9d08a6655d73b0ccbb76515f83631
-
SSDEEP
24576:0rS8rGSigrIzhHva9G6bbf21laH6HXTq/s:oCHzhHva9vffQlU6HXO/s
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\56f9708ee2642f5fa1f60603df7bc430_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\56f9708ee2642f5fa1f60603df7bc430_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx