Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20250207-en -
resource tags
-
submitted
08-02-2025 08:53
General
-
Target
JaffaCakes118_c14112534fc0433164d8f76bb7346f7e.exe
-
Size
3.6MB
-
MD5
c14112534fc0433164d8f76bb7346f7e
-
SHA1
edf1a06ed278a6717aad1a3bc2f45d04deed13c6
-
SHA256
9386fd3c18b3619e73fcf5b4d2d31ec97659fd162dac503bd1ca070c5aaa92e7
-
SHA512
4c551bc5a8951ab9a6f66ca4efee02b7b0c860ac71b1578a2160e9f355243c59e3b4f2a1fb40ecc7028915e3a359e6f86bd92532db939907e7e23b3e73b3ce22
-
SSDEEP
98304:QyGMmDNkTrfEeO9lYGmFLQo3e0WbGchxjBixQnRgJ:BG9qfMBYNe0FcX3RgJ
Malware Config
Signatures
-
Panda Stealer payload 2 IoCs
-
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Pandastealer family
-
Downloads MZ/PE file 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 3 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 2 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 51 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Kills process with taskkill 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 10 IoCs
-
Modifies Internet Explorer start page 1 TTPs 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c14112534fc0433164d8f76bb7346f7e.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c14112534fc0433164d8f76bb7346f7e.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-U1EUG.tmp\JaffaCakes118_c14112534fc0433164d8f76bb7346f7e.tmp"C:\Users\Admin\AppData\Local\Temp\is-U1EUG.tmp\JaffaCakes118_c14112534fc0433164d8f76bb7346f7e.tmp" /SL5="$120062,3545120,54272,C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c14112534fc0433164d8f76bb7346f7e.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-P6VLC.tmp\v9hp_v9nt_umz-2_br_20120907134317_rev.share.exe"C:\Users\Admin\AppData\Local\Temp\is-P6VLC.tmp\v9hp_v9nt_umz-2_br_20120907134317_rev.share.exe" -nation=<h3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\V9Zip_000\NewTab-v9.exeC:\Users\Admin\AppData\Local\Temp\V9Zip_000\NewTab-v9.exe -h4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C taskkill /F /IM firefox.exe5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe6⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\Newtabs_v9.dll"5⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
-
-
-
C:\Users\Admin\AppData\Local\Temp\V9Zip_000\v9ht.exeC:\Users\Admin\AppData\Local\Temp\V9Zip_000\v9ht.exe -oem=umz-2 -app=v9nt -flag=7 -nation=<h4⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c taskkill /f /im rkverify.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rkverify.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzhCNUMzRDQtODYxNS00NUY4LTgyQTUtNENEMUJDMEE4NjBDfSIgdXNlcmlkPSJ7N0ZCREREQUEtQjc5MC00RDM0LTkzNkYtODAyOEQ4RjgwNEExfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RjlGQzhCMjgtN0YzMC00RTgxLUE5Q0ItOTJFNEU5NDlCQ0UzfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDY4ODkiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxOTM2NTgwOTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTA1OTY4NTI3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
551KB
MD5a376fa73657ea9ef1e6acddb94e31c33
SHA1b48ad618e8f6660e24e148a045dc99deb0b9c559
SHA2565bf5bbe24cd97e271ddcb537299c7a6868ad3f6e23752f295cc478586778c871
SHA5123acd2fe9c922a736472bb7bdf61f5595797fcb410de8520ae2d1c118fa1b13e148d2dd0e5986b77af821c5bd17cbc52ae49466deab5288f9d30c02740b6dd8e0
-
Filesize
59KB
MD52b7598adf8886d5988d39874acce8884
SHA144aeadae9e448d23793ec6a54f7813a374e1612b
SHA256a17ee83c7919b18758bfc90c6385c5f126f3d27bd286d37af4d44fbd0e388c71
SHA512cad011f7aebb83ab4c16854de7a98a74777b64dbcd075720598e1a0d3537ff6e299ac0410834d3ebe44dbb10969f485037bb420441ad6dc30cfdd7eea55ecdf8
-
Filesize
977B
MD5236dbcdd224d62a33bbb066b24989717
SHA1c9c5536a30e241b6b33181043a74e0e0c18dd610
SHA256808e0199396b1a02b8336e4a691dbbbd162c58f4d04c200a8a3817d200f55d8a
SHA5124ea70ae351a4bc54b4e2f4485bdbee45428e01a4a381645b34c85d96525338a60460b88d8052b57858d4baeb5f0feb6063d1eb63e8762a7982244b34d5754b90
-
Filesize
1KB
MD5376eeb20e30bfabd91d263c20db442fe
SHA151ad5fab224361cc92789920d3e87f80fa406281
SHA256fdccdf8a4d0b9265bf477ccac9a8b3cd376152cf479920f897471bfc60763740
SHA5123d382fbbac34ab826db9c7edacc43ec1573b33ae111bcf4e0fedaa21ec24e7b9b8c9755260f33b03c9e260a8d63f51d7982b30d800651a6a69680213de6d0776
-
Filesize
922KB
MD59a2f642a99c19b2d7ee60109c7de1b81
SHA18543ffe5e79516d110526fd305dbeacf04b041cb
SHA256c07330c686767287b1d490f5c44d2b0265790860b32f1889d16d60c06d15f111
SHA5121a0eeea8f17d19e81bd331ce324361520339fe75d6110e664fffe7fa654a4f091bb0377e9344f90310e4c85ca37c1dc01022e18d95aee72f60c204bb38099241
-
Filesize
200KB
MD5d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
Filesize
2.0MB
MD545270cbdcc4fd94c03fef3c682cf58c4
SHA1951572c1bc0fcc68fae1f83929809da3ec8627e8
SHA256beb85cba6a6096feae6e859df1d4158a1f6b094b2aaa7b2f1df5595db02d7540
SHA5129019e247efc49dec550f961589ca178c961e88a03c14397f26009ab83f2d6c0e7ce40e65dbf7e02cc21b5376dd2f0dc922263afc9e47e86baa527f7bbcaec9a8
-
Filesize
688KB
MD5c765336f0dcf4efdcc2101eed67cd30c
SHA1fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA51206a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
240KB
-
Filesize
752KB
-
Filesize
240KB
-
Filesize
752KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
40KB