Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
22-06-2024 21:45
Behavioral task
behavioral1
Sample
03f7e21506f089d657a6c04c55902976_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
03f7e21506f089d657a6c04c55902976_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
03f7e21506f089d657a6c04c55902976_JaffaCakes118.exe
-
Size
5.7MB
-
MD5
03f7e21506f089d657a6c04c55902976
-
SHA1
dda208c6619d4e43107666bc6f8a5f84b6cb768a
-
SHA256
8a644dfd2abc6310fc90f7e6908c373190a956544a4fd15de05fc5974704e7d5
-
SHA512
edd93821c820d545610fd1fe5703bbbc4b908b18f2d6020d4e12926207928c4fc99c69c7ec797a745f7bcabff31c2d7b9df1cc50627d5f4fa2a28f9c7f2c82de
-
SSDEEP
98304:qMbTbHYM2WwqOJ4V9PTs8yuCtJ9IL6VkS8nNSlR/W/2l/zAbPppEiPu3mz7:l/HYVtqOJqTsVvXILUkS8NSlR+KsnExw
Malware Config
Signatures
-
Panda Stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2724-3-0x0000000000AF0000-0x0000000001454000-memory.dmp family_pandastealer behavioral2/memory/2724-6-0x0000000000AF0000-0x0000000001454000-memory.dmp family_pandastealer behavioral2/memory/2724-7-0x0000000000AF0000-0x0000000001454000-memory.dmp family_pandastealer behavioral2/memory/2724-37-0x0000000000AF0000-0x0000000001454000-memory.dmp family_pandastealer -
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
-
Shurk Stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2724-3-0x0000000000AF0000-0x0000000001454000-memory.dmp shurk_stealer behavioral2/memory/2724-6-0x0000000000AF0000-0x0000000001454000-memory.dmp shurk_stealer behavioral2/memory/2724-7-0x0000000000AF0000-0x0000000001454000-memory.dmp shurk_stealer behavioral2/memory/2724-37-0x0000000000AF0000-0x0000000001454000-memory.dmp shurk_stealer -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/2724-3-0x0000000000AF0000-0x0000000001454000-memory.dmp vmprotect behavioral2/memory/2724-6-0x0000000000AF0000-0x0000000001454000-memory.dmp vmprotect behavioral2/memory/2724-7-0x0000000000AF0000-0x0000000001454000-memory.dmp vmprotect behavioral2/memory/2724-37-0x0000000000AF0000-0x0000000001454000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
03f7e21506f089d657a6c04c55902976_JaffaCakes118.exepid process 2724 03f7e21506f089d657a6c04c55902976_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
03f7e21506f089d657a6c04c55902976_JaffaCakes118.exepid process 2724 03f7e21506f089d657a6c04c55902976_JaffaCakes118.exe 2724 03f7e21506f089d657a6c04c55902976_JaffaCakes118.exe 2724 03f7e21506f089d657a6c04c55902976_JaffaCakes118.exe 2724 03f7e21506f089d657a6c04c55902976_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2724-0-0x0000000000B6A000-0x0000000000EAB000-memory.dmpFilesize
3.3MB
-
memory/2724-3-0x0000000000AF0000-0x0000000001454000-memory.dmpFilesize
9.4MB
-
memory/2724-6-0x0000000000AF0000-0x0000000001454000-memory.dmpFilesize
9.4MB
-
memory/2724-2-0x0000000001A10000-0x0000000001A11000-memory.dmpFilesize
4KB
-
memory/2724-7-0x0000000000AF0000-0x0000000001454000-memory.dmpFilesize
9.4MB
-
memory/2724-1-0x0000000001A00000-0x0000000001A01000-memory.dmpFilesize
4KB
-
memory/2724-36-0x0000000000B6A000-0x0000000000EAB000-memory.dmpFilesize
3.3MB
-
memory/2724-37-0x0000000000AF0000-0x0000000001454000-memory.dmpFilesize
9.4MB