oski | 5ef0850150c577b7184b16ca066af5322d280d6e4208b8cb2d8059c8fdcd1da2

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-04-2024 15:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5351dc8fbec2f874e623c30e719c48b_JaffaCakes118.ps1
Size

421KB
MD5

e5351dc8fbec2f874e623c30e719c48b
SHA1

af756d841b0e9bc3accc58561f97111351dc4719
SHA256

5ef0850150c577b7184b16ca066af5322d280d6e4208b8cb2d8059c8fdcd1da2
SHA512

204dd0f88dd1085a616fc611e3b4e49c7d974e1c70eb110c19b040100faf1d8ba699ec3735f7b90cf664e980907878d3ee7e45ce689557ba85d677d1ed5c6c76
SSDEEP

12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw64sL68:q3n

Score

10^/10

oski infostealer

Malware Config

Extracted

Family

oski

/103.114.107.28/l2323/

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2172 set thread context of 2684	2172	powershell.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2500	2684	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2172	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2172	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2684	2172	powershell.exe	29
PID 2172 wrote to memory of 2684	2172	powershell.exe	29
PID 2172 wrote to memory of 2684	2172	powershell.exe	29
PID 2172 wrote to memory of 2684	2172	powershell.exe	29
PID 2172 wrote to memory of 2684	2172	powershell.exe	29
PID 2172 wrote to memory of 2684	2172	powershell.exe	29
PID 2172 wrote to memory of 2684	2172	powershell.exe	29
PID 2172 wrote to memory of 2684	2172	powershell.exe	29
PID 2172 wrote to memory of 2684	2172	powershell.exe	29
PID 2172 wrote to memory of 2684	2172	powershell.exe	29
PID 2684 wrote to memory of 2500	2684	MSBuild.exe	30
PID 2684 wrote to memory of 2500	2684	MSBuild.exe	30
PID 2684 wrote to memory of 2500	2684	MSBuild.exe	30
PID 2684 wrote to memory of 2500	2684	MSBuild.exe	30

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\e5351dc8fbec2f874e623c30e719c48b_JaffaCakes118.ps1
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 500
    3⤵
    - Program crash
    PID:2500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2172-4-0x000000001B590000-0x000000001B872000-memory.dmp

Filesize
2.9MB

Download
memory/2172-5-0x000007FEF59C0000-0x000007FEF635D000-memory.dmp

Filesize
9.6MB

Download
memory/2172-7-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2172-6-0x0000000002C80000-0x0000000002D00000-memory.dmp

Filesize
512KB

Download
memory/2172-8-0x000007FEF59C0000-0x000007FEF635D000-memory.dmp

Filesize
9.6MB

Download
memory/2172-9-0x0000000002C80000-0x0000000002D00000-memory.dmp

Filesize
512KB

Download
memory/2172-10-0x0000000002C80000-0x0000000002D00000-memory.dmp

Filesize
512KB

Download
memory/2172-11-0x0000000002C80000-0x0000000002D00000-memory.dmp

Filesize
512KB

Download
memory/2172-12-0x0000000002D70000-0x0000000002D7A000-memory.dmp

Filesize
40KB

Download
memory/2172-27-0x000007FEF59C0000-0x000007FEF635D000-memory.dmp

Filesize
9.6MB

Download
memory/2684-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2684-21-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2684-19-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2684-17-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2684-15-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2684-13-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2684-26-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2684-24-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2684-28-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2684-30-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download