Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-01-2025 08:50
General
-
Target
JaffaCakes118_a5488cad8f86df87e8392fa2ee2d2454.exe
-
Size
321KB
-
MD5
a5488cad8f86df87e8392fa2ee2d2454
-
SHA1
0315c5c3a77cb27457b878e5957c2f58e3fe4fb2
-
SHA256
202333c643ef48e05f881c5fb61ab2ad8a9f54f84adafa76e3776f7f4287e9b9
-
SHA512
4ccdcc69ac14c2f4de22939b0de981ce93506de6954f22a90fdbaecf14aaa36f554894b2d2c3371948259e247dc06f5bc3272ec57f6e0c5eefc74bbde9baf7be
-
SSDEEP
3072:YL9o6xJXHarVvl5ia3dXmkKI2yJKX63hn6c380z+BaL4KIgzL9o6xJXHarVvl5iS:YL5JXWlDlNKIdKqd6mqBa0QL5JXWlDr
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a5488cad8f86df87e8392fa2ee2d2454.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a5488cad8f86df87e8392fa2ee2d2454.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB